huntrule

Windows Process Creation Command-Line Contains Emoji Characters

Alerts on Windows executions whose command line includes emoji Unicode characters.

FreeReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
@Kostastsale, TheDFIRReport (SigmaHQ), DRL 1.1
Published
2022-12-05
Updated
2026-07-30
AnalysisDetection

What it detects

This rule flags Windows process creation events where the full command line contains one of many emoji characters. Attackers may use unusual Unicode characters to obscure intent or hinder simplistic string-based monitoring. It relies on process creation telemetry that includes the CommandLine field and matches against a predefined set of emoji strings.

Reporting behind it

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.