huntrule

Windows Process Creation: Command Line Contains Emoji Characters

Alerts on Windows process executions whose command line includes emoji/symbol characters from a predefined list.

FreeReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
@Kostastsale, TheDFIRReport (SigmaHQ), DRL 1.1
Published
2022-12-05
Updated
2026-07-30
AnalysisDetection

What it detects

This rule flags Windows process creation events where the command line contains one of a large set of specific emoji characters and emoji-like symbols. Attackers may use unusual Unicode characters in command lines to hinder readability, evade simple text-based detections, or blend into operator-generated output. The detection relies on Windows process creation telemetry and matches directly against the command line string contents.

Reporting behind it

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.