Windows Process Creation Command-Line Contains Emoji Characters
Alerts on Windows executions whose command line includes emoji Unicode characters.
FreeReviewedSigma · High · v1
- Product
- windows
- Category
- process_creation
- Author
- @Kostastsale, TheDFIRReport (SigmaHQ), DRL 1.1
- Published
- 2022-12-05
- Updated
- 2026-07-30
What it detects
This rule flags Windows process creation events where the full command line contains one of many emoji characters. Attackers may use unusual Unicode characters to obscure intent or hinder simplistic string-based monitoring. It relies on process creation telemetry that includes the CommandLine field and matches against a predefined set of emoji strings.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-process-creation-command-line-contains-emoji-characters-4a30ac0c
title: Windows Process Creation Command-Line Contains Emoji Characters
id: 58577584-98d5-45bd-affc-9c93ae2b01ed
status: test
description: This rule flags Windows process creation events where the full command line contains one of many emoji characters. Attackers may use unusual Unicode characters to obscure intent or hinder simplistic string-based monitoring. It relies on process creation telemetry that includes the CommandLine field and matches against a predefined set of emoji strings.
author: "@Kostastsale, TheDFIRReport, Huntrule Team"
references:
- Internal Research
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_emoji_usage_in_cli_1.yml
tags:
- attack.stealth
date: 2022-12-05
logsource:
product: windows
category: process_creation
detection:
selection:
CommandLine|contains:
- 😀
- 😃
- 😄
- 😁
- 😆
- 😅
- 😂
- 🤣
- 🥲
- 🥹
- ☺️
- 😊
- 😇
- 🙂
- 🙃
- 😉
- 😌
- 😍
- 🥰
- 😘
- 😗
- 😙
- 😚
- 😋
- 😛
- 😝
- 😜
- 🤪
- 🤨
- 🧐
- 🤓
- 😎
- 🥸
- 🤩
- 🥳
- 😏
- 😒
- 😞
- 😔
- 😟
- 😕
- 🙁
- ☹️
- 😣
- 😖
- 😫
- 😩
- 🥺
- 😢
- 😭
- 😮💨
- 😤
- 😠
- 😡
- 🤬
- 🤯
- 😳
- 🥵
- 🥶
- 😱
- 😨
- 😰
- 😥
- 😓
- 🫣
- 🤗
- 🫡
- 🤔
- 🫢
- 🤭
- 🤫
- 🤥
- 😶
- 😶🌫️
- 😐
- 😑
- 😬
- 🫠
- 🙄
- 😯
- 😦
- 😧
- 😮
- 😲
- 🥱
- 😴
- 🤤
- 😪
- 😵
- 😵💫
- 🫥
- 🤐
- 🥴
- 🤢
- 🤮
- 🤧
- 😷
- 🤒
- 🤕
- 🤑
- 🤠
- 😈
- 👿
- 👹
- 👺
- 🤡
- 💩
- 👻
- 💀
- ☠️
- 👽
- 👾
- 🤖
- 🎃
- 😺
- 😸
- 😹
- 😻
- 😼
- 😽
- 🙀
- 😿
- 😾
- 👋
- 🤚
- 🖐
- ✋
- 🖖
- 👌
- 🤌
- 🤏
- ✌️
- 🤞
- 🫰
- 🤟
- 🤘
- 🤙
- 🫵
- 🫱
- 🫲
- 🫳
- 🫴
- 👈
- 👉
- 👆
- 🖕
- 👇
- ☝️
- 👍
- 👎
- ✊
- 👊
- 🤛
- 🤜
- 👏
- 🫶
- 🙌
- 👐
- 🤲
- 🤝
- 🙏
- ✍️
- 💪
- 🦾
- 🦵
- 🦿
- 🦶
- 👣
- 👂
- 🦻
- 👃
- 🫀
- 🫁
- 🧠
- 🦷
- 🦴
- 👀
- 👁
- 👅
- 👄
- 🫦
- 💋
- 🩸
- 👶
- 👧
- 🧒
- 👦
- 👩
- 🧑
- 👨
- 👩🦱
- 🧑🦱
- 👨🦱
- 👩🦰
- 🧑🦰
- 👨🦰
- 👱♀️
- 👱
- 👱♂️
- 👩🦳
- 🧑🦳
- 👨🦳
- 👩🦲
- 🧑🦲
- 👨🦲
- 🧔♀️
- 🧔
- 🧔♂️
- 👵
- 🧓
- 👴
- 👲
- 👳♀️
- 👳
- 👳♂️
- 🧕
- 👮♀️
- 👮
- 👮♂️
- 👷♀️
- 👷
- 👷♂️
- 💂♀️
- 💂
- 💂♂️
- 🕵️♀️
- 🕵️
- 🕵️♂️
- 👩⚕️
- 🧑⚕️
- 👨⚕️
- 👩🌾
- 🧑🌾
- 👨🌾
- 👩🍳
- 🧑🍳
- 👨🍳
- 👩🎓
- 🧑🎓
- 👨🎓
- 👩🎤
- 🧑🎤
- 👨🎤
- 👩🏫
- 🧑🏫
- 👨🏫
- 👩🏭
- 🧑🏭
- 👨🏭
- 👩💻
- 🧑💻
- 👨💻
- 👩💼
- 🧑💼
- 👨💼
- 👩🔧
- 🧑🔧
- 👨🔧
- 👩🔬
- 🧑🔬
- 👨🔬
- 👩🎨
- 🧑🎨
- 👨🎨
- 👩🚒
- 🧑🚒
- 👨🚒
- 👩✈️
- 🧑✈️
- 👨✈️
- 👩🚀
- 🧑🚀
- 👨🚀
- 👩⚖️
- 🧑⚖️
- 👨⚖️
- 👰♀️
- 👰
- 👰♂️
- 🤵♀️
- 🤵
- 🤵♂️
- 👸
- 🫅
- 🤴
- 🥷
- 🦸♀️
- 🦸
- 🦸♂️
- 🦹♀️
- 🦹
- 🦹♂️
- 🤶
- 🧑🎄
- 🎅
- 🧙♀️
- 🧙
- 🧙♂️
- 🧝♀️
- 🧝
- 🧝♂️
- 🧛♀️
- 🧛
- 🧛♂️
- 🧟♀️
- 🧟
- 🧟♂️
- 🧞♀️
- 🧞
- 🧞♂️
- 🧜♀️
- 🧜
- 🧜♂️
- 🧚♀️
- 🧚
- 🧚♂️
- 🧌
- 👼
- 🤰
- 🫄
- 🫃
- 🤱
- 👩🍼
- 🧑🍼
- 👨🍼
- 🙇♀️
- 🙇
- 🙇♂️
- 💁♀️
- 💁
- 💁♂️
- 🙅♀️
- 🙅
- 🙅♂️
- 🙆♀️
- 🙆
- 🙆♂️
- 🙋♀️
- 🙋
- 🙋♂️
- 🧏♀️
- 🧏
- 🧏♂️
- 🤦♀️
- 🤦
- 🤦♂️
- 🤷♀️
- 🤷
- 🤷♂️
- 🙎♀️
- 🙎
- 🙎♂️
- 🙍♀️
- 🙍
- 🙍♂️
- 💇♀️
- 💇
- 💇♂️
- 💆♀️
- 💆
- 💆♂️
- 🧖♀️
- 🧖
- 🧖♂️
- 💅
- 💃
- 🕺
- 👯♀️
- 👯
- 👯♂️
- 🕴
- 👩🦽
- 🧑🦽
- 👨🦽
- 👩🦼
- 🧑🦼
- 👨🦼
- 🚶♀️
- 🚶
- 🚶♂️
- 👩🦯
- 🧑🦯
- 👨🦯
- 🧎♀️
- 🧎
- 🧎♂️
- 🏃♀️
- 🏃
- 🏃♂️
- 🧍♀️
- 🧍
- 🧍♂️
- 👭
- 🧑🤝🧑
- 👬
- 👫
- 👩❤️👩
- 💑
- 👨❤️👨
- 👩❤️👨
- 👩❤️💋👩
- 💏
- 👨❤️💋👨
- 👩❤️💋👨
- 👪
- 👨👩👦
- 👨👩👧
- 👨👩👧👦
- 👨👩👦👦
- 👨👩👧👧
- 👨👨👦
- 👨👨👧
- 👨👨👧👦
- 👨👨👦👦
- 👨👨👧👧
- 👩👩👦
- 👩👩👧
- 👩👩👧👦
- 👩👩👦👦
- 👩👩👧👧
- 👨👦
- 👨👦👦
- 👨👧
- 👨👧👦
- 👨👧👧
- 👩👦
- 👩👦👦
- 👩👧
- 👩👧👦
- 👩👧👧
- 🗣
- 👤
- 👥
- 🫂
- 🧳
- 🌂
- ☂️
- 🧵
- 🪡
- 🪢
- 🧶
- 👓
- 🕶
- 🥽
- 🥼
- 🦺
- 👔
- 👕
- 👖
- 🧣
- 🧤
- 🧥
- 🧦
- 👗
- 👘
- 🥻
- 🩴
- 🩱
- 🩲
- 🩳
- 👙
- 👚
- 👛
- 👜
- 👝
- 🎒
- 👞
- 👟
- 🥾
- 🥿
- 👠
- 👡
- 🩰
- 👢
- 👑
- 👒
- 🎩
- 🎓
- 🧢
- ⛑
- 🪖
- 💄
- 💍
- 💼
- 👋🏻
- 🤚🏻
- 🖐🏻
- ✋🏻
- 🖖🏻
- 👌🏻
- 🤌🏻
- 🤏🏻
- ✌🏻
- 🤞🏻
- 🫰🏻
- 🤟🏻
- 🤘🏻
- 🤙🏻
- 🫵🏻
- 🫱🏻
- 🫲🏻
- 🫳🏻
- 🫴🏻
- 👈🏻
- 👉🏻
- 👆🏻
- 🖕🏻
- 👇🏻
- ☝🏻
- 👍🏻
- 👎🏻
- ✊🏻
- 👊🏻
- 🤛🏻
- 🤜🏻
- 👏🏻
- 🫶🏻
- 🙌🏻
- 👐🏻
- 🤲🏻
- 🙏🏻
- ✍🏻
- 💪🏻
- 🦵🏻
- 🦶🏻
- 👂🏻
- 🦻🏻
- 👃🏻
- 👶🏻
- 👧🏻
- 🧒🏻
- 👦🏻
- 👩🏻
- 🧑🏻
- 👨🏻
- 👩🏻🦱
- 🧑🏻🦱
- 👨🏻🦱
- 👩🏻🦰
- 🧑🏻🦰
- 👨🏻🦰
- 👱🏻♀️
- 👱🏻
- 👱🏻♂️
- 👩🏻🦳
- 🧑🏻🦳
- 👨🏻🦳
- 👩🏻🦲
- 🧑🏻🦲
- 👨🏻🦲
- 🧔🏻♀️
- 🧔🏻
- 🧔🏻♂️
- 👵🏻
- 🧓🏻
- 👴🏻
- 👲🏻
- 👳🏻♀️
- 👳🏻
- 👳🏻♂️
- 🧕🏻
- 👮🏻♀️
- 👮🏻
- 👮🏻♂️
- 👷🏻♀️
- 👷🏻
- 👷🏻♂️
- 💂🏻♀️
- 💂🏻
- 💂🏻♂️
- 🕵🏻♀️
- 🕵🏻
- 🕵🏻♂️
- 👩🏻⚕️
- 🧑🏻⚕️
- 👨🏻⚕️
- 👩🏻🌾
- 🧑🏻🌾
- 👨🏻🌾
- 👩🏻🍳
- 🧑🏻🍳
- 👨🏻🍳
- 👩🏻🎓
- 🧑🏻🎓
- 👨🏻🎓
- 👩🏻🎤
- 🧑🏻🎤
- 👨🏻🎤
- 👩🏻🏫
- 🧑🏻🏫
- 👨🏻🏫
- 👩🏻🏭
- 🧑🏻🏭
- 👨🏻🏭
- 👩🏻💻
- 🧑🏻💻
- 👨🏻💻
- 👩🏻💼
- 🧑🏻💼
- 👨🏻💼
- 👩🏻🔧
- 🧑🏻🔧
- 👨🏻🔧
- 👩🏻🔬
- 🧑🏻🔬
- 👨🏻🔬
- 👩🏻🎨
- 🧑🏻🎨
- 👨🏻🎨
- 👩🏻🚒
- 🧑🏻🚒
- 👨🏻🚒
- 👩🏻✈️
- 🧑🏻✈️
- 👨🏻✈️
- 👩🏻🚀
- 🧑🏻🚀
- 👨🏻🚀
- 👩🏻⚖️
- 🧑🏻⚖️
- 👨🏻⚖️
- 👰🏻♀️
- 👰🏻
- 👰🏻♂️
- 🤵🏻♀️
- 🤵🏻
- 🤵🏻♂️
- 👸🏻
- 🫅🏻
- 🤴🏻
- 🥷🏻
- 🦸🏻♀️
- 🦸🏻
- 🦸🏻♂️
- 🦹🏻♀️
- 🦹🏻
- 🦹🏻♂️
- 🤶🏻
- 🧑🏻🎄
- 🎅🏻
- 🧙🏻♀️
- 🧙🏻
- 🧙🏻♂️
- 🧝🏻♀️
- 🧝🏻
- 🧝🏻♂️
- 🧛🏻♀️
- 🧛🏻
- 🧛🏻♂️
- 🧜🏻♀️
- 🧜🏻
- 🧜🏻♂️
- 🧚🏻♀️
- 🧚🏻
- 🧚🏻♂️
- 👼🏻
- 🤰🏻
- 🫄🏻
- 🫃🏻
- 🤱🏻
- 👩🏻🍼
- 🧑🏻🍼
- 👨🏻🍼
- 🙇🏻♀️
- 🙇🏻
- 🙇🏻♂️
- 💁🏻♀️
- 💁🏻
- 💁🏻♂️
- 🙅🏻♀️
- 🙅🏻
- 🙅🏻♂️
- 🙆🏻♀️
- 🙆🏻
- 🙆🏻♂️
- 🙋🏻♀️
- 🙋🏻
- 🙋🏻♂️
- 🧏🏻♀️
- 🧏🏻
- 🧏🏻♂️
- 🤦🏻♀️
- 🤦🏻
- 🤦🏻♂️
- 🤷🏻♀️
- 🤷🏻
- 🤷🏻♂️
- 🙎🏻♀️
- 🙎🏻
- 🙎🏻♂️
- 🙍🏻♀️
- 🙍🏻
- 🙍🏻♂️
- 💇🏻♀️
- 💇🏻
- 💇🏻♂️
- 💆🏻♀️
- 💆🏻
- 💆🏻♂️
- 🧖🏻♀️
- 🧖🏻
- 🧖🏻♂️
- 💃🏻
- 🕺🏻
- 🕴🏻
- 👩🏻🦽
- 🧑🏻🦽
- 👨🏻🦽
- 👩🏻🦼
- 🧑🏻🦼
- 👨🏻🦼
- 🚶🏻♀️
- 🚶🏻
- 🚶🏻♂️
- 👩🏻🦯
- 🧑🏻🦯
- 👨🏻🦯
- 🧎🏻♀️
- 🧎🏻
- 🧎🏻♂️
- 🏃🏻♀️
- 🏃🏻
- 🏃🏻♂️
- 🧍🏻♀️
- 🧍🏻
- 🧍🏻♂️
- 👭🏻
- 🧑🏻🤝🧑🏻
- 👬🏻
- 👫🏻
- 🧗🏻♀️
- 🧗🏻
- 🧗🏻♂️
- 🏇🏻
- 🏂🏻
- 🏌🏻♀️
- 🏌🏻
- 🏌🏻♂️
- 🏄🏻♀️
- 🏄🏻
- 🏄🏻♂️
- 🚣🏻♀️
- 🚣🏻
- 🚣🏻♂️
- 🏊🏻♀️
- 🏊🏻
- 🏊🏻♂️
- ⛹🏻♀️
- ⛹🏻
- ⛹🏻♂️
- 🏋🏻♀️
- 🏋🏻
- 🏋🏻♂️
- 🚴🏻♀️
- 🚴🏻
- 🚴🏻♂️
- 🚵🏻♀️
- 🚵🏻
- 🚵🏻♂️
- 🤸🏻♀️
- 🤸🏻
- 🤸🏻♂️
- 🤽🏻♀️
- 🤽🏻
- 🤽🏻♂️
- 🤾🏻♀️
- 🤾🏻
- 🤾🏻♂️
- 🤹🏻♀️
- 🤹🏻
- 🤹🏻♂️
- 🧘🏻♀️
- 🧘🏻
- 🧘🏻♂️
- 🛀🏻
- 🛌🏻
- 👋🏼
- 🤚🏼
- 🖐🏼
- ✋🏼
- 🖖🏼
- 👌🏼
- 🤌🏼
- 🤏🏼
- ✌🏼
- 🤞🏼
- 🫰🏼
- 🤟🏼
- 🤘🏼
- 🤙🏼
- 🫵🏼
- 🫱🏼
- 🫲🏼
- 🫳🏼
- 🫴🏼
- 👈🏼
- 👉🏼
- 👆🏼
- 🖕🏼
- 👇🏼
- ☝🏼
- 👍🏼
- 👎🏼
- ✊🏼
- 👊🏼
- 🤛🏼
- 🤜🏼
- 👏🏼
- 🫶🏼
- 🙌🏼
- 👐🏼
- 🤲🏼
- 🙏🏼
- ✍🏼
- 💪🏼
- 🦵🏼
- 🦶🏼
- 👂🏼
- 🦻🏼
- 👃🏼
- 👶🏼
- 👧🏼
- 🧒🏼
- 👦🏼
- 👩🏼
- 🧑🏼
- 👨🏼
- 👩🏼🦱
- 🧑🏼🦱
- 👨🏼🦱
- 👩🏼🦰
- 🧑🏼🦰
- 👨🏼🦰
- 👱🏼♀️
- 👱🏼
- 👱🏼♂️
- 👩🏼🦳
- 🧑🏼🦳
- 👨🏼🦳
- 👩🏼🦲
- 🧑🏼🦲
- 👨🏼🦲
- 🧔🏼♀️
- 🧔🏼
- 🧔🏼♂️
- 👵🏼
- 🧓🏼
- 👴🏼
- 👲🏼
- 👳🏼♀️
- 👳🏼
- 👳🏼♂️
- 🧕🏼
- 👮🏼♀️
- 👮🏼
- 👮🏼♂️
- 👷🏼♀️
- 👷🏼
- 👷🏼♂️
- 💂🏼♀️
- 💂🏼
- 💂🏼♂️
- 🕵🏼♀️
- 🕵🏼
- 🕵🏼♂️
- 👩🏼⚕️
- 🧑🏼⚕️
- 👨🏼⚕️
- 👩🏼🌾
- 🧑🏼🌾
- 👨🏼🌾
- 👩🏼🍳
- 🧑🏼🍳
- 👨🏼🍳
- 👩🏼🎓
- 🧑🏼🎓
- 👨🏼🎓
- 👩🏼🎤
- 🧑🏼🎤
- 👨🏼🎤
- 👩🏼🏫
- 🧑🏼🏫
- 👨🏼🏫
- 👩🏼🏭
- 🧑🏼🏭
- 👨🏼🏭
- 👩🏼💻
- 🧑🏼💻
- 👨🏼💻
- 👩🏼💼
- 🧑🏼💼
- 👨🏼💼
- 👩🏼🔧
- 🧑🏼🔧
- 👨🏼🔧
- 👩🏼🔬
- 🧑🏼🔬
- 👨🏼🔬
- 👩🏼🎨
- 🧑🏼🎨
- 👨🏼🎨
- 👩🏼🚒
- 🧑🏼🚒
- 👨🏼🚒
- 👩🏼✈️
- 🧑🏼✈️
- 👨🏼✈️
- 👩🏼🚀
- 🧑🏼🚀
- 👨🏼🚀
- 👩🏼⚖️
- 🧑🏼⚖️
- 👨🏼⚖️
- 👰🏼♀️
- 👰🏼
- 👰🏼♂️
- 🤵🏼♀️
- 🤵🏼
- 🤵🏼♂️
- 👸🏼
- 🫅🏼
- 🤴🏼
- 🥷🏼
- 🦸🏼♀️
- 🦸🏼
- 🦸🏼♂️
- 🦹🏼♀️
- 🦹🏼
- 🦹🏼♂️
- 🤶🏼
- 🧑🏼🎄
- 🎅🏼
- 🧙🏼♀️
- 🧙🏼
- 🧙🏼♂️
- 🧝🏼♀️
- 🧝🏼
- 🧝🏼♂️
- 🧛🏼♀️
- 🧛🏼
- 🧛🏼♂️
- 🧜🏼♀️
- 🧜🏼
- 🧜🏼♂️
- 🧚🏼♀️
- 🧚🏼
- 🧚🏼♂️
- 👼🏼
- 🤰🏼
- 🫄🏼
- 🫃🏼
- 🤱🏼
- 👩🏼🍼
- 🧑🏼🍼
- 👨🏼🍼
- 🙇🏼♀️
- 🙇🏼
- 🙇🏼♂️
- 💁🏼♀️
- 💁🏼
- 💁🏼♂️
- 🙅🏼♀️
- 🙅🏼
- 🙅🏼♂️
- 🙆🏼♀️
- 🙆🏼
- 🙆🏼♂️
- 🙋🏼♀️
- 🙋🏼
- 🙋🏼♂️
- 🧏🏼♀️
- 🧏🏼
- 🧏🏼♂️
- 🤦🏼♀️
- 🤦🏼
- 🤦🏼♂️
- 🤷🏼♀️
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 4a30ac0c-b9d6-4e01-b71a-5f851bbf4259
type: derived