Windows Process Command Line Matches Perfect Homoglyph Unicode Characters
Alerts when a Windows process command line includes Unicode homoglyphs that look like ASCII letters.
- Product
- windows
- Category
- process_creation
- Author
- Micah Babinski, @micahbabinski (SigmaHQ), DRL 1.1
- Published
- 2023-05-07
- Updated
- 2026-07-30
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process creation command lines that contain specific Unicode characters which visually match ASCII letters (homoglyphs). Attackers can use these characters for obfuscation and masquerading, making malicious strings and file or executable names harder to recognize. The detection relies on process creation telemetry and examines the CommandLine field for the presence of the listed homoglyph characters.
Reporting behind it
- redcanary.comhttps://redcanary.com/threat-detection-report/threats/socgholish/#threat-socgholish
- irongeek.comhttp://www.irongeek.com/homoglyph-attack-generator.php
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_homoglyph_cyrillic_lookalikes.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Process Command Line Matches Perfect Homoglyph Unicode Characters
id: 22e952c4-7897-439e-8e89-e6ac2e5346c6
status: test
description: This rule flags Windows process creation command lines that contain specific Unicode characters which visually match ASCII letters (homoglyphs). Attackers can use these characters for obfuscation and masquerading, making malicious strings and file or executable names harder to recognize. The detection relies on process creation telemetry and examines the CommandLine field for the presence of the listed homoglyph characters.
references:
- https://redcanary.com/threat-detection-report/threats/socgholish/#threat-socgholish
- http://www.irongeek.com/homoglyph-attack-generator.php
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_homoglyph_cyrillic_lookalikes.yml
author: Micah Babinski, @micahbabinski, Huntrule Team
date: 2023-05-07
tags:
- attack.stealth
- attack.t1036
- attack.t1036.003
logsource:
category: process_creation
product: windows
detection:
selection_upper:
CommandLine|contains:
- А
- В
- Е
- К
- М
- Н
- О
- Р
- С
- Т
- Х
- Ѕ
- І
- Ј
- Ү
- Ӏ
- Ԍ
- Ԛ
- Ԝ
- Α
- Β
- Ε
- Ζ
- Η
- Ι
- Κ
- Μ
- Ν
- Ο
- Ρ
- Τ
- Υ
- Χ
selection_lower:
CommandLine|contains:
- а
- е
- о
- р
- с
- х
- ѕ
- і
- ӏ
- ј
- һ
- ԁ
- ԛ
- ԝ
- ο
condition: 1 of selection_*
falsepositives:
- Commandlines with legitimate Cyrillic text; will likely require tuning (or not be usable) in countries where these alphabets are in use.
level: medium
license: DRL-1.1
related:
- id: 32e280f1-8ad4-46ef-9e80-910657611fbc
type: derived