Windows Process Creation: Command Line Contains Emoji Characters

title: "Windows Process Creation: Command Line Contains Emoji Characters"
id: 35b6ca50-1c07-4e26-baa4-729462c1a874
status: test
description: This rule flags Windows process creation events where the command line contains one of a large set of specific emoji characters and emoji-like symbols. Attackers may use unusual Unicode characters in command lines to hinder readability, evade simple text-based detections, or blend into operator-generated output. The detection relies on Windows process creation telemetry and matches directly against the command line string contents.
author: "@Kostastsale, TheDFIRReport, Huntrule Team"
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_emoji_usage_in_cli_4.yml
tags:
  - attack.stealth
date: 2022-12-05
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    CommandLine|contains:
      - 🔸
      - 🔹
      - 🔶
      - 🔷
      - 🔳
      - 🔲
      - ▪️
      - ▫️
      - ◾️
      - ◽️
      - ◼️
      - ◻️
      - 🟥
      - 🟧
      - 🟨
      - 🟩
      - 🟦
      - 🟪
      - ⬛️
      - ⬜️
      - 🟫
      - 🔈
      - 🔇
      - 🔉
      - 🔊
      - 🔔
      - 🔕
      - 📣
      - 📢
      - 👁‍🗨
      - 💬
      - 💭
      - 🗯
      - ♠️
      - ♣️
      - ♥️
      - ♦️
      - 🃏
      - 🎴
      - 🀄️
      - 🕐
      - 🕑
      - 🕒
      - 🕓
      - 🕔
      - 🕕
      - 🕖
      - 🕗
      - 🕘
      - 🕙
      - 🕚
      - 🕛
      - 🕜
      - 🕝
      - 🕞
      - 🕟
      - 🕠
      - 🕡
      - 🕢
      - 🕣
      - 🕤
      - 🕥
      - 🕦
      - 🕧✢
      - ✣
      - ✤
      - ✥
      - ✦
      - ✧
      - ★
      - ☆
      - ✯
      - ✡︎
      - ✩
      - ✪
      - ✫
      - ✬
      - ✭
      - ✮
      - ✶
      - ✷
      - ✵
      - ✸
      - ✹
      - →
      - ⇒
      - ⟹
      - ⇨
      - ⇾
      - ➾
      - ⇢
      - ☛
      - ☞
      - ➔
      - ➜
      - ➙
      - ➛
      - ➝
      - ➞
      - ♠︎
      - ♣︎
      - ♥︎
      - ♦︎
      - ♤
      - ♧
      - ♡
      - ♢
      - ♚
      - ♛
      - ♜
      - ♝
      - ♞
      - ♟
      - ♔
      - ♕
      - ♖
      - ♗
      - ♘
      - ♙
      - ⚀
      - ⚁
      - ⚂
      - ⚃
      - ⚄
      - ⚅
      - 🂠
      - ⚈
      - ⚉
      - ⚆
      - ⚇
      - 𓀀
      - 𓀁
      - 𓀂
      - 𓀃
      - 𓀄
      - 𓀅
      - 𓀆
      - 𓀇
      - 𓀈
      - 𓀉
      - 𓀊
      - 𓀋
      - 𓀌
      - 𓀍
      - 𓀎
      - 𓀏
      - 𓀐
      - 𓀑
      - 𓀒
      - 𓀓
      - 𓀔
      - 𓀕
      - 𓀖
      - 𓀗
      - 𓀘
      - 𓀙
      - 𓀚
      - 𓀛
      - 𓀜
      - 𓀝🏳️
      - 🏴
      - 🏁
      - 🚩
      - 🏳️‍🌈
      - 🏳️‍⚧️
      - 🏴‍☠️
      - 🇦🇫
      - 🇦🇽
      - 🇦🇱
      - 🇩🇿
      - 🇦🇸
      - 🇦🇩
      - 🇦🇴
      - 🇦🇮
      - 🇦🇶
      - 🇦🇬
      - 🇦🇷
      - 🇦🇲
      - 🇦🇼
      - 🇦🇺
      - 🇦🇹
      - 🇦🇿
      - 🇧🇸
      - 🇧🇭
      - 🇧🇩
      - 🇧🇧
      - 🇧🇾
      - 🇧🇪
      - 🇧🇿
      - 🇧🇯
      - 🇧🇲
      - 🇧🇹
      - 🇧🇴
      - 🇧🇦
      - 🇧🇼
      - 🇧🇷
      - 🇮🇴
      - 🇻🇬
      - 🇧🇳
      - 🇧🇬
      - 🇧🇫
      - 🇧🇮
      - 🇰🇭
      - 🇨🇲
      - 🇨🇦
      - 🇮🇨
      - 🇨🇻
      - 🇧🇶
      - 🇰🇾
      - 🇨🇫
      - 🇹🇩
      - 🇨🇱
      - 🇨🇳
      - 🇨🇽
      - 🇨🇨
      - 🇨🇴
      - 🇰🇲
      - 🇨🇬
      - 🇨🇩
      - 🇨🇰
      - 🇨🇷
      - 🇨🇮
      - 🇭🇷
      - 🇨🇺
      - 🇨🇼
      - 🇨🇾
      - 🇨🇿
      - 🇩🇰
      - 🇩🇯
      - 🇩🇲
      - 🇩🇴
      - 🇪🇨
      - 🇪🇬
      - 🇸🇻
      - 🇬🇶
      - 🇪🇷
      - 🇪🇪
      - 🇪🇹
      - 🇪🇺
      - 🇫🇰
      - 🇫🇴
      - 🇫🇯
      - 🇫🇮
      - 🇫🇷
      - 🇬🇫
      - 🇵🇫
      - 🇹🇫
      - 🇬🇦
      - 🇬🇲
      - 🇬🇪
      - 🇩🇪
      - 🇬🇭
      - 🇬🇮
      - 🇬🇷
      - 🇬🇱
      - 🇬🇩
      - 🇬🇵
      - 🇬🇺
      - 🇬🇹
      - 🇬🇬
      - 🇬🇳
      - 🇬🇼
      - 🇬🇾
      - 🇭🇹
      - 🇭🇳
      - 🇭🇰
      - 🇭🇺
      - 🇮🇸
      - 🇮🇳
      - 🇮🇩
      - 🇮🇷
      - 🇮🇶
      - 🇮🇪
      - 🇮🇲
      - 🇮🇱
      - 🇮🇹
      - 🇯🇲
      - 🇯🇵
      - 🎌
      - 🇯🇪
      - 🇯🇴
      - 🇰🇿
      - 🇰🇪
      - 🇰🇮
      - 🇽🇰
      - 🇰🇼
      - 🇰🇬
      - 🇱🇦
      - 🇱🇻
      - 🇱🇧
      - 🇱🇸
      - 🇱🇷
      - 🇱🇾
      - 🇱🇮
      - 🇱🇹
      - 🇱🇺
      - 🇲🇴
      - 🇲🇰
      - 🇲🇬
      - 🇲🇼
      - 🇲🇾
      - 🇲🇻
      - 🇲🇱
      - 🇲🇹
      - 🇲🇭
      - 🇲🇶
      - 🇲🇷
      - 🇲🇺
      - 🇾🇹
      - 🇲🇽
      - 🇫🇲
      - 🇲🇩
      - 🇲🇨
      - 🇲🇳
      - 🇲🇪
      - 🇲🇸
      - 🇲🇦
      - 🇲🇿
      - 🇲🇲
      - 🇳🇦
      - 🇳🇷
      - 🇳🇵
      - 🇳🇱
      - 🇳🇨
      - 🇳🇿
      - 🇳🇮
      - 🇳🇪
      - 🇳🇬
      - 🇳🇺
      - 🇳🇫
      - 🇰🇵
      - 🇲🇵
      - 🇳🇴
      - 🇴🇲
      - 🇵🇰
      - 🇵🇼
      - 🇵🇸
      - 🇵🇦
      - 🇵🇬
      - 🇵🇾
      - 🇵🇪
      - 🇵🇭
      - 🇵🇳
      - 🇵🇱
      - 🇵🇹
      - 🇵🇷
      - 🇶🇦
      - 🇷🇪
      - 🇷🇴
      - 🇷🇺
      - 🇷🇼
      - 🇼🇸
      - 🇸🇲
      - 🇸🇦
      - 🇸🇳
      - 🇷🇸
      - 🇸🇨
      - 🇸🇱
      - 🇸🇬
      - 🇸🇽
      - 🇸🇰
      - 🇸🇮
      - 🇬🇸
      - 🇸🇧
      - 🇸🇴
      - 🇿🇦
      - 🇰🇷
      - 🇸🇸
      - 🇪🇸
      - 🇱🇰
      - 🇧🇱
      - 🇸🇭
      - 🇰🇳
      - 🇱🇨
      - 🇵🇲
      - 🇻🇨
      - 🇸🇩
      - 🇸🇷
      - 🇸🇿
      - 🇸🇪
      - 🇨🇭
      - 🇸🇾
      - 🇹🇼
      - 🇹🇯
      - 🇹🇿
      - 🇹🇭
      - 🇹🇱
      - 🇹🇬
      - 🇹🇰
      - 🇹🇴
      - 🇹🇹
      - 🇹🇳
      - 🇹🇷
      - 🇹🇲
      - 🇹🇨
      - 🇹🇻
      - 🇻🇮
      - 🇺🇬
      - 🇺🇦
      - 🇦🇪
      - 🇬🇧
      - 🏴󠁧󠁢󠁥󠁮󠁧󠁿
      - 🏴󠁧󠁢󠁳󠁣󠁴󠁿
      - 🏴󠁧󠁢󠁷󠁬󠁳󠁿
      - 🇺🇳
      - 🇺🇸
      - 🇺🇾
      - 🇺🇿
      - 🇻🇺
      - 🇻🇦
      - 🇻🇪
      - 🇻🇳
      - 🇼🇫
      - 🇪🇭
      - 🇾🇪
      - 🇿🇲
      - 🇿🇼🫠
      - 🫢
      - 🫣
      - 🫡
      - 🫥
      - 🫤
      - 🥹
      - 🫱
      - 🫱🏻
      - 🫱🏼
      - 🫱🏽
      - 🫱🏾
      - 🫱🏿
      - 🫲
      - 🫲🏻
      - 🫲🏼
      - 🫲🏽
      - 🫲🏾
      - 🫲🏿
      - 🫳
      - 🫳🏻
      - 🫳🏼
      - 🫳🏽
      - 🫳🏾
      - 🫳🏿
      - 🫴
      - 🫴🏻
      - 🫴🏼
      - 🫴🏽
      - 🫴🏾
      - 🫴🏿
      - 🫰
      - 🫰🏻
      - 🫰🏼
      - 🫰🏽
      - 🫰🏾
      - 🫰🏿
      - 🫵
      - 🫵🏻
      - 🫵🏼
      - 🫵🏽
      - 🫵🏾
      - 🫵🏿
      - 🫶
      - 🫶🏻
      - 🫶🏼
      - 🫶🏽
      - 🫶🏾
      - 🫶🏿
      - 🤝🏻
      - 🤝🏼
      - 🤝🏽
      - 🤝🏾
      - 🤝🏿
      - 🫱🏻‍🫲🏼
      - 🫱🏻‍🫲🏽
      - 🫱🏻‍🫲🏾
      - 🫱🏻‍🫲🏿
      - 🫱🏼‍🫲🏻
      - 🫱🏼‍🫲🏽
      - 🫱🏼‍🫲🏾
      - 🫱🏼‍🫲🏿
      - 🫱🏽‍🫲🏻
      - 🫱🏽‍🫲🏼
      - 🫱🏽‍🫲🏾
      - 🫱🏽‍🫲🏿
      - 🫱🏾‍🫲🏻
      - 🫱🏾‍🫲🏼
      - 🫱🏾‍🫲🏽
      - 🫱🏾‍🫲🏿
      - 🫱🏿‍🫲🏻
      - 🫱🏿‍🫲🏼
      - 🫱🏿‍🫲🏽
      - 🫱🏿‍🫲🏾
      - 🫦
      - 🫅
      - 🫅🏻
      - 🫅🏼
      - 🫅🏽
      - 🫅🏾
      - 🫅🏿
      - 🫃
      - 🫃🏻
      - 🫃🏼
      - 🫃🏽
      - 🫃🏾
      - 🫃🏿
      - 🫄
      - 🫄🏻
      - 🫄🏼
      - 🫄🏽
      - 🫄🏾
      - 🫄🏿
      - 🧌
      - 🪸
      - 🪷
      - 🪹
      - 🪺
      - 🫘
      - 🫗
      - 🫙
      - 🛝
      - 🛞
      - 🛟
      - 🪬
      - 🪩
      - 🪫
      - 🩼
      - 🩻
      - 🫧
      - 🪪
      - 🟰
      - 😮‍💨
      - 😵‍💫
      - 😶‍🌫️
      - ❤️‍🔥
      - ❤️‍🩹
      - 🧔‍♀️
      - 🧔🏻‍♀️
      - 🧔🏼‍♀️
      - 🧔🏽‍♀️
      - 🧔🏾‍♀️
      - 🧔🏿‍♀️
      - 🧔‍♂️
      - 🧔🏻‍♂️
      - 🧔🏼‍♂️
      - 🧔🏽‍♂️
      - 🧔🏾‍♂️
      - 🧔🏿‍♂️
      - 💑🏻
      - 💑🏼
      - 💑🏽
      - 💑🏾
      - 💑🏿
      - 💏🏻
      - 💏🏼
      - 💏🏽
      - 💏🏾
      - 💏🏿
      - 👨🏻‍❤️‍👨🏻
      - 👨🏻‍❤️‍👨🏼
      - 👨🏻‍❤️‍👨🏽
      - 👨🏻‍❤️‍👨🏾
      - 👨🏻‍❤️‍👨🏿
      - 👨🏼‍❤️‍👨🏻
      - 👨🏼‍❤️‍👨🏼
      - 👨🏼‍❤️‍👨🏽
      - 👨🏼‍❤️‍👨🏾
      - 👨🏼‍❤️‍👨🏿
      - 👨🏽‍❤️‍👨🏻
      - 👨🏽‍❤️‍👨🏼
      - 👨🏽‍❤️‍👨🏽
      - 👨🏽‍❤️‍👨🏾
      - 👨🏽‍❤️‍👨🏿
      - 👨🏾‍❤️‍👨🏻
      - 👨🏾‍❤️‍👨🏼
      - 👨🏾‍❤️‍👨🏽
      - 👨🏾‍❤️‍👨🏾
      - 👨🏾‍❤️‍👨🏿
      - 👨🏿‍❤️‍👨🏻
      - 👨🏿‍❤️‍👨🏼
      - 👨🏿‍❤️‍👨🏽
      - 👨🏿‍❤️‍👨🏾
      - 👨🏿‍❤️‍👨🏿
      - 👩🏻‍❤️‍👨🏻
      - 👩🏻‍❤️‍👨🏼
      - 👩🏻‍❤️‍👨🏽
      - 👩🏻‍❤️‍👨🏾
      - 👩🏻‍❤️‍👨🏿
      - 👩🏻‍❤️‍👩🏻
      - 👩🏻‍❤️‍👩🏼
      - 👩🏻‍❤️‍👩🏽
      - 👩🏻‍❤️‍👩🏾
      - 👩🏻‍❤️‍👩🏿
      - 👩🏼‍❤️‍👨🏻
      - 👩🏼‍❤️‍👨🏼
      - 👩🏼‍❤️‍👨🏽
      - 👩🏼‍❤️‍👨🏾
      - 👩🏼‍❤️‍👨🏿
      - 👩🏼‍❤️‍👩🏻
      - 👩🏼‍❤️‍👩🏼
      - 👩🏼‍❤️‍👩🏽
      - 👩🏼‍❤️‍👩🏾
      - 👩🏼‍❤️‍👩🏿
      - 👩🏽‍❤️‍👨🏻
      - 👩🏽‍❤️‍👨🏼
      - 👩🏽‍❤️‍👨🏽
      - 👩🏽‍❤️‍👨🏾
      - 👩🏽‍❤️‍👨🏿
      - 👩🏽‍❤️‍👩🏻
      - 👩🏽‍❤️‍👩🏼
      - 👩🏽‍❤️‍👩🏽
      - 👩🏽‍❤️‍👩🏾
      - 👩🏽‍❤️‍👩🏿
      - 👩🏾‍❤️‍👨🏻
      - 👩🏾‍❤️‍👨🏼
      - 👩🏾‍❤️‍👨🏽
      - 👩🏾‍❤️‍👨🏾
      - 👩🏾‍❤️‍👨🏿
      - 👩🏾‍❤️‍👩🏻
      - 👩🏾‍❤️‍👩🏼
      - 👩🏾‍❤️‍👩🏽
      - 👩🏾‍❤️‍👩🏾
      - 👩🏾‍❤️‍👩🏿
      - 👩🏿‍❤️‍👨🏻
      - 👩🏿‍❤️‍👨🏼
      - 👩🏿‍❤️‍👨🏽
      - 👩🏿‍❤️‍👨🏾
      - 👩🏿‍❤️‍👨🏿
      - 👩🏿‍❤️‍👩🏻
      - 👩🏿‍❤️‍👩🏼
      - 👩🏿‍❤️‍👩🏽
      - 👩🏿‍❤️‍👩🏾
      - 👩🏿‍❤️‍👩🏿
      - 🧑🏻‍❤️‍🧑🏼
      - 🧑🏻‍❤️‍🧑🏽
      - 🧑🏻‍❤️‍🧑🏾
      - 🧑🏻‍❤️‍🧑🏿
      - 🧑🏼‍❤️‍🧑🏻
      - 🧑🏼‍❤️‍🧑🏽
      - 🧑🏼‍❤️‍🧑🏾
      - 🧑🏼‍❤️‍🧑🏿
      - 🧑🏽‍❤️‍🧑🏻
      - 🧑🏽‍❤️‍🧑🏼
      - 🧑🏽‍❤️‍🧑🏾
      - 🧑🏽‍❤️‍🧑🏿
      - 🧑🏾‍❤️‍🧑🏻
      - 🧑🏾‍❤️‍🧑🏼
      - 🧑🏾‍❤️‍🧑🏽
      - 🧑🏾‍❤️‍🧑🏿
      - 🧑🏿‍❤️‍🧑🏻
      - 🧑🏿‍❤️‍🧑🏼
      - 🧑🏿‍❤️‍🧑🏽
      - 🧑🏿‍❤️‍🧑🏾
      - 👨🏻‍❤️‍💋‍👨🏻
      - 👨🏻‍❤️‍💋‍👨🏼
      - 👨🏻‍❤️‍💋‍👨🏽
      - 👨🏻‍❤️‍💋‍👨🏾
      - 👨🏻‍❤️‍💋‍👨🏿
      - 👨🏼‍❤️‍💋‍👨🏻
      - 👨🏼‍❤️‍💋‍👨🏼
      - 👨🏼‍❤️‍💋‍👨🏽
      - 👨🏼‍❤️‍💋‍👨🏾
      - 👨🏼‍❤️‍💋‍👨🏿
      - 👨🏽‍❤️‍💋‍👨🏻
      - 👨🏽‍❤️‍💋‍👨🏼
      - 👨🏽‍❤️‍💋‍👨🏽
      - 👨🏽‍❤️‍💋‍👨🏾
      - 👨🏽‍❤️‍💋‍👨🏿
      - 👨🏾‍❤️‍💋‍👨🏻
      - 👨🏾‍❤️‍💋‍👨🏼
      - 👨🏾‍❤️‍💋‍👨🏽
      - 👨🏾‍❤️‍💋‍👨🏾
      - 👨🏾‍❤️‍💋‍👨🏿
      - 👨🏿‍❤️‍💋‍👨🏻
      - 👨🏿‍❤️‍💋‍👨🏼
      - 👨🏿‍❤️‍💋‍👨🏽
      - 👨🏿‍❤️‍💋‍👨🏾
      - 👨🏿‍❤️‍💋‍👨🏿
      - 👩🏻‍❤️‍💋‍👨🏻
      - 👩🏻‍❤️‍💋‍👨🏼
      - 👩🏻‍❤️‍💋‍👨🏽
      - 👩🏻‍❤️‍💋‍👨🏾
      - 👩🏻‍❤️‍💋‍👨🏿
      - 👩🏻‍❤️‍💋‍👩🏻
      - 👩🏻‍❤️‍💋‍👩🏼
      - 👩🏻‍❤️‍💋‍👩🏽
      - 👩🏻‍❤️‍💋‍👩🏾
      - 👩🏻‍❤️‍💋‍👩🏿
      - 👩🏼‍❤️‍💋‍👨🏻
      - 👩🏼‍❤️‍💋‍👨🏼
      - 👩🏼‍❤️‍💋‍👨🏽
      - 👩🏼‍❤️‍💋‍👨🏾
      - 👩🏼‍❤️‍💋‍👨🏿
      - 👩🏼‍❤️‍💋‍👩🏻
      - 👩🏼‍❤️‍💋‍👩🏼
      - 👩🏼‍❤️‍💋‍👩🏽
      - 👩🏼‍❤️‍💋‍👩🏾
      - 👩🏼‍❤️‍💋‍👩🏿
      - 👩🏽‍❤️‍💋‍👨🏻
      - 👩🏽‍❤️‍💋‍👨🏼
      - 👩🏽‍❤️‍💋‍👨🏽
      - 👩🏽‍❤️‍💋‍👨🏾
      - 👩🏽‍❤️‍💋‍👨🏿
      - 👩🏽‍❤️‍💋‍👩🏻
      - 👩🏽‍❤️‍💋‍👩🏼
      - 👩🏽‍❤️‍💋‍👩🏽
      - 👩🏽‍❤️‍💋‍👩🏾
      - 👩🏽‍❤️‍💋‍👩🏿
      - 👩🏾‍❤️‍💋‍👨🏻
      - 👩🏾‍❤️‍💋‍👨🏼
      - 👩🏾‍❤️‍💋‍👨🏽
      - 👩🏾‍❤️‍💋‍👨🏾
      - 👩🏾‍❤️‍💋‍👨🏿
      - 👩🏾‍❤️‍💋‍👩🏻
      - 👩🏾‍❤️‍💋‍👩🏼
      - 👩🏾‍❤️‍💋‍👩🏽
      - 👩🏾‍❤️‍💋‍👩🏾
      - 👩🏾‍❤️‍💋‍👩🏿
      - 👩🏿‍❤️‍💋‍👨🏻
      - 👩🏿‍❤️‍💋‍👨🏼
      - 👩🏿‍❤️‍💋‍👨🏽
      - 👩🏿‍❤️‍💋‍👨🏾
      - 👩🏿‍❤️‍💋‍👨🏿
      - 👩🏿‍❤️‍💋‍👩🏻
      - 👩🏿‍❤️‍💋‍👩🏼
      - 👩🏿‍❤️‍💋‍👩🏽
      - 👩🏿‍❤️‍💋‍👩🏾
      - 👩🏿‍❤️‍💋‍👩🏿
      - 🧑🏻‍❤️‍💋‍🧑🏼
      - 🧑🏻‍❤️‍💋‍🧑🏽
      - 🧑🏻‍❤️‍💋‍🧑🏾
      - 🧑🏻‍❤️‍💋‍🧑🏿
      - 🧑🏼‍❤️‍💋‍🧑🏻
      - 🧑🏼‍❤️‍💋‍🧑🏽
      - 🧑🏼‍❤️‍💋‍🧑🏾
      - 🧑🏼‍❤️‍💋‍🧑🏿
      - 🧑🏽‍❤️‍💋‍🧑🏻
      - 🧑🏽‍❤️‍💋‍🧑🏼
      - 🧑🏽‍❤️‍💋‍🧑🏾
      - 🧑🏽‍❤️‍💋‍🧑🏿
      - 🧑🏾‍❤️‍💋‍🧑🏻
      - 🧑🏾‍❤️‍💋‍🧑🏼
      - 🧑🏾‍❤️‍💋‍🧑🏽
      - 🧑🏾‍❤️‍💋‍🧑🏿
      - 🧑🏿‍❤️‍💋‍🧑🏻
      - 🧑🏿‍❤️‍💋‍🧑🏼
      - 🧑🏿‍❤️‍💋‍🧑🏽
      - 🧑🏿‍❤️‍💋‍🧑🏾
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 225274c4-8dd1-40db-9e09-71dff4f6fb3c
    type: derived