Windows Process Command Line Matches Perfect Homoglyph Unicode Characters

title: Windows Process Command Line Matches Perfect Homoglyph Unicode Characters
id: 22e952c4-7897-439e-8e89-e6ac2e5346c6
status: test
description: This rule flags Windows process creation command lines that contain specific Unicode characters which visually match ASCII letters (homoglyphs). Attackers can use these characters for obfuscation and masquerading, making malicious strings and file or executable names harder to recognize. The detection relies on process creation telemetry and examines the CommandLine field for the presence of the listed homoglyph characters.
references:
  - https://redcanary.com/threat-detection-report/threats/socgholish/#threat-socgholish
  - http://www.irongeek.com/homoglyph-attack-generator.php
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_homoglyph_cyrillic_lookalikes.yml
author: Micah Babinski, @micahbabinski, Huntrule Team
date: 2023-05-07
tags:
  - attack.stealth
  - attack.t1036
  - attack.t1036.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_upper:
    CommandLine|contains:
      - А
      - В
      - Е
      - К
      - М
      - Н
      - О
      - Р
      - С
      - Т
      - Х
      - Ѕ
      - І
      - Ј
      - Ү
      - Ӏ
      - Ԍ
      - Ԛ
      - Ԝ
      - Α
      - Β
      - Ε
      - Ζ
      - Η
      - Ι
      - Κ
      - Μ
      - Ν
      - Ο
      - Ρ
      - Τ
      - Υ
      - Χ
  selection_lower:
    CommandLine|contains:
      - а
      - е
      - о
      - р
      - с
      - х
      - ѕ
      - і
      - ӏ
      - ј
      - һ
      - ԁ
      - ԛ
      - ԝ
      - ο
  condition: 1 of selection_*
falsepositives:
  - Commandlines with legitimate Cyrillic text; will likely require tuning (or not be usable) in countries where these alphabets are in use.
level: medium
license: DRL-1.1
related:
  - id: 32e280f1-8ad4-46ef-9e80-910657611fbc
    type: derived