Windows Process Creation: Command Line Contains Specific Emoji Characters
Alerts when a Windows process command line includes specific emoji Unicode characters that may be used for evasion or obfuscation.
FreeUnreviewedSigmahighv1
windows-process-creation-command-line-contains-specific-emoji-characters-c98f2a0d
title: "Windows Process Creation: Command Line Contains Specific Emoji Characters"
id: 93f17058-3c88-4da9-8b48-34ea70a154f1
status: test
description: This rule flags Windows process creation events where the command line contains one of many listed emoji characters. Attackers may use unusual Unicode characters in command lines to hinder log parsing, filtering, or analyst review during defense evasion. Telemetry required is Windows process creation with access to the full command line string.
author: "@Kostastsale, TheDFIRReport, Huntrule Team"
references:
- Internal Research
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_emoji_usage_in_cli_2.yml
tags:
- attack.stealth
date: 2022-12-05
logsource:
product: windows
category: process_creation
detection:
selection:
CommandLine|contains:
- 🤷🏼
- 🤷🏼♂️
- 🙎🏼♀️
- 🙎🏼
- 🙎🏼♂️
- 🙍🏼♀️
- 🙍🏼
- 🙍🏼♂️
- 💇🏼♀️
- 💇🏼
- 💇🏼♂️
- 💆🏼♀️
- 💆🏼
- 💆🏼♂️
- 🧖🏼♀️
- 🧖🏼
- 🧖🏼♂️
- 💃🏼
- 🕺🏼
- 🕴🏼
- 👩🏼🦽
- 🧑🏼🦽
- 👨🏼🦽
- 👩🏼🦼
- 🧑🏼🦼
- 👨🏼🦼
- 🚶🏼♀️
- 🚶🏼
- 🚶🏼♂️
- 👩🏼🦯
- 🧑🏼🦯
- 👨🏼🦯
- 🧎🏼♀️
- 🧎🏼
- 🧎🏼♂️
- 🏃🏼♀️
- 🏃🏼
- 🏃🏼♂️
- 🧍🏼♀️
- 🧍🏼
- 🧍🏼♂️
- 👭🏼
- 🧑🏼🤝🧑🏼
- 👬🏼
- 👫🏼
- 🧗🏼♀️
- 🧗🏼
- 🧗🏼♂️
- 🏇🏼
- 🏂🏼
- 🏌🏼♀️
- 🏌🏼
- 🏌🏼♂️
- 🏄🏼♀️
- 🏄🏼
- 🏄🏼♂️
- 🚣🏼♀️
- 🚣🏼
- 🚣🏼♂️
- 🏊🏼♀️
- 🏊🏼
- 🏊🏼♂️
- ⛹🏼♀️
- ⛹🏼
- ⛹🏼♂️
- 🏋🏼♀️
- 🏋🏼
- 🏋🏼♂️
- 🚴🏼♀️
- 🚴🏼
- 🚴🏼♂️
- 🚵🏼♀️
- 🚵🏼
- 🚵🏼♂️
- 🤸🏼♀️
- 🤸🏼
- 🤸🏼♂️
- 🤽🏼♀️
- 🤽🏼
- 🤽🏼♂️
- 🤾🏼♀️
- 🤾🏼
- 🤾🏼♂️
- 🤹🏼♀️
- 🤹🏼
- 🤹🏼♂️
- 🧘🏼♀️
- 🧘🏼
- 🧘🏼♂️
- 🛀🏼
- 🛌🏼
- 👋🏽
- 🤚🏽
- 🖐🏽
- ✋🏽
- 🖖🏽
- 👌🏽
- 🤌🏽
- 🤏🏽
- ✌🏽
- 🤞🏽
- 🫰🏽
- 🤟🏽
- 🤘🏽
- 🤙🏽
- 🫵🏽
- 🫱🏽
- 🫲🏽
- 🫳🏽
- 🫴🏽
- 👈🏽
- 👉🏽
- 👆🏽
- 🖕🏽
- 👇🏽
- ☝🏽
- 👍🏽
- 👎🏽
- ✊🏽
- 👊🏽
- 🤛🏽
- 🤜🏽
- 👏🏽
- 🫶🏽
- 🙌🏽
- 👐🏽
- 🤲🏽
- 🙏🏽
- ✍🏽
- 💪🏽
- 🦵🏽
- 🦶🏽
- 👂🏽
- 🦻🏽
- 👃🏽
- 👶🏽
- 👧🏽
- 🧒🏽
- 👦🏽
- 👩🏽
- 🧑🏽
- 👨🏽
- 👩🏽🦱
- 🧑🏽🦱
- 👨🏽🦱
- 👩🏽🦰
- 🧑🏽🦰
- 👨🏽🦰
- 👱🏽♀️
- 👱🏽
- 👱🏽♂️
- 👩🏽🦳
- 🧑🏽🦳
- 👨🏽🦳
- 👩🏽🦲
- 🧑🏽🦲
- 👨🏽🦲
- 🧔🏽♀️
- 🧔🏽
- 🧔🏽♂️
- 👵🏽
- 🧓🏽
- 👴🏽
- 👲🏽
- 👳🏽♀️
- 👳🏽
- 👳🏽♂️
- 🧕🏽
- 👮🏽♀️
- 👮🏽
- 👮🏽♂️
- 👷🏽♀️
- 👷🏽
- 👷🏽♂️
- 💂🏽♀️
- 💂🏽
- 💂🏽♂️
- 🕵🏽♀️
- 🕵🏽
- 🕵🏽♂️
- 👩🏽⚕️
- 🧑🏽⚕️
- 👨🏽⚕️
- 👩🏽🌾
- 🧑🏽🌾
- 👨🏽🌾
- 👩🏽🍳
- 🧑🏽🍳
- 👨🏽🍳
- 👩🏽🎓
- 🧑🏽🎓
- 👨🏽🎓
- 👩🏽🎤
- 🧑🏽🎤
- 👨🏽🎤
- 👩🏽🏫
- 🧑🏽🏫
- 👨🏽🏫
- 👩🏽🏭
- 🧑🏽🏭
- 👨🏽🏭
- 👩🏽💻
- 🧑🏽💻
- 👨🏽💻
- 👩🏽💼
- 🧑🏽💼
- 👨🏽💼
- 👩🏽🔧
- 🧑🏽🔧
- 👨🏽🔧
- 👩🏽🔬
- 🧑🏽🔬
- 👨🏽🔬
- 👩🏽🎨
- 🧑🏽🎨
- 👨🏽🎨
- 👩🏽🚒
- 🧑🏽🚒
- 👨🏽🚒
- 👩🏽✈️
- 🧑🏽✈️
- 👨🏽✈️
- 👩🏽🚀
- 🧑🏽🚀
- 👨🏽🚀
- 👩🏽⚖️
- 🧑🏽⚖️
- 👨🏽⚖️
- 👰🏽♀️
- 👰🏽
- 👰🏽♂️
- 🤵🏽♀️
- 🤵🏽
- 🤵🏽♂️
- 👸🏽
- 🫅🏽
- 🤴🏽
- 🥷🏽
- 🦸🏽♀️
- 🦸🏽
- 🦸🏽♂️
- 🦹🏽♀️
- 🦹🏽
- 🦹🏽♂️
- 🤶🏽
- 🧑🏽🎄
- 🎅🏽
- 🧙🏽♀️
- 🧙🏽
- 🧙🏽♂️
- 🧝🏽♀️
- 🧝🏽
- 🧝🏽♂️
- 🧛🏽♀️
- 🧛🏽
- 🧛🏽♂️
- 🧜🏽♀️
- 🧜🏽
- 🧜🏽♂️
- 🧚🏽♀️
- 🧚🏽
- 🧚🏽♂️
- 👼🏽
- 🤰🏽
- 🫄🏽
- 🫃🏽
- 🤱🏽
- 👩🏽🍼
- 🧑🏽🍼
- 👨🏽🍼
- 🙇🏽♀️
- 🙇🏽
- 🙇🏽♂️
- 💁🏽♀️
- 💁🏽
- 💁🏽♂️
- 🙅🏽♀️
- 🙅🏽
- 🙅🏽♂️
- 🙆🏽♀️
- 🙆🏽
- 🙆🏽♂️
- 🙋🏽♀️
- 🙋🏽
- 🙋🏽♂️
- 🧏🏽♀️
- 🧏🏽
- 🧏🏽♂️
- 🤦🏽♀️
- 🤦🏽
- 🤦🏽♂️
- 🤷🏽♀️
- 🤷🏽
- 🤷🏽♂️
- 🙎🏽♀️
- 🙎🏽
- 🙎🏽♂️
- 🙍🏽♀️
- 🙍🏽
- 🙍🏽♂️
- 💇🏽♀️
- 💇🏽
- 💇🏽♂️
- 💆🏽♀️
- 💆🏽
- 💆🏽♂️
- 🧖🏽♀️
- 🧖🏽
- 🧖🏽♂️
- 💃🏽
- 🕺🏽
- 🕴🏽
- 👩🏽🦽
- 🧑🏽🦽
- 👨🏽🦽
- 👩🏽🦼
- 🧑🏽🦼
- 👨🏽🦼
- 🚶🏽♀️
- 🚶🏽
- 🚶🏽♂️
- 👩🏽🦯
- 🧑🏽🦯
- 👨🏽🦯
- 🧎🏽♀️
- 🧎🏽
- 🧎🏽♂️
- 🏃🏽♀️
- 🏃🏽
- 🏃🏽♂️
- 🧍🏽♀️
- 🧍🏽
- 🧍🏽♂️
- 👭🏽
- 🧑🏽🤝🧑🏽
- 👬🏽
- 👫🏽
- 🧗🏽♀️
- 🧗🏽
- 🧗🏽♂️
- 🏇🏽
- 🏂🏽
- 🏌🏽♀️
- 🏌🏽
- 🏌🏽♂️
- 🏄🏽♀️
- 🏄🏽
- 🏄🏽♂️
- 🚣🏽♀️
- 🚣🏽
- 🚣🏽♂️
- 🏊🏽♀️
- 🏊🏽
- 🏊🏽♂️
- ⛹🏽♀️
- ⛹🏽
- ⛹🏽♂️
- 🏋🏽♀️
- 🏋🏽
- 🏋🏽♂️
- 🚴🏽♀️
- 🚴🏽
- 🚴🏽♂️
- 🚵🏽♀️
- 🚵🏽
- 🚵🏽♂️
- 🤸🏽♀️
- 🤸🏽
- 🤸🏽♂️
- 🤽🏽♀️
- 🤽🏽
- 🤽🏽♂️
- 🤾🏽♀️
- 🤾🏽
- 🤾🏽♂️
- 🤹🏽♀️
- 🤹🏽
- 🤹🏽♂️
- 🧘🏽♀️
- 🧘🏽
- 🧘🏽♂️
- 🛀🏽
- 🛌🏽
- 👋🏾
- 🤚🏾
- 🖐🏾
- ✋🏾
- 🖖🏾
- 👌🏾
- 🤌🏾
- 🤏🏾
- ✌🏾
- 🤞🏾
- 🫰🏾
- 🤟🏾
- 🤘🏾
- 🤙🏾
- 🫵🏾
- 🫱🏾
- 🫲🏾
- 🫳🏾
- 🫴🏾
- 👈🏾
- 👉🏾
- 👆🏾
- 🖕🏾
- 👇🏾
- ☝🏾
- 👍🏾
- 👎🏾
- ✊🏾
- 👊🏾
- 🤛🏾
- 🤜🏾
- 👏🏾
- 🫶🏾
- 🙌🏾
- 👐🏾
- 🤲🏾
- 🙏🏾
- ✍🏾
- 💪🏾
- 🦵🏾
- 🦶🏾
- 👂🏾
- 🦻🏾
- 👃🏾
- 👶🏾
- 👧🏾
- 🧒🏾
- 👦🏾
- 👩🏾
- 🧑🏾
- 👨🏾
- 👩🏾🦱
- 🧑🏾🦱
- 👨🏾🦱
- 👩🏾🦰
- 🧑🏾🦰
- 👨🏾🦰
- 👱🏾♀️
- 👱🏾
- 👱🏾♂️
- 👩🏾🦳
- 🧑🏾🦳
- 👨🏾🦳
- 👩🏾🦲
- 🧑🏾🦲
- 👨🏾🦲
- 🧔🏾♀️
- 🧔🏾
- 🧔🏾♂️
- 👵🏾
- 🧓🏾
- 👴🏾
- 👲🏾
- 👳🏾♀️
- 👳🏾
- 👳🏾♂️
- 🧕🏾
- 👮🏾♀️
- 👮🏾
- 👮🏾♂️
- 👷🏾♀️
- 👷🏾
- 👷🏾♂️
- 💂🏾♀️
- 💂🏾
- 💂🏾♂️
- 🕵🏾♀️
- 🕵🏾
- 🕵🏾♂️
- 👩🏾⚕️
- 🧑🏾⚕️
- 👨🏾⚕️
- 👩🏾🌾
- 🧑🏾🌾
- 👨🏾🌾
- 👩🏾🍳
- 🧑🏾🍳
- 👨🏾🍳
- 👩🏾🎓
- 🧑🏾🎓
- 👨🏾🎓
- 👩🏾🎤
- 🧑🏾🎤
- 👨🏾🎤
- 👩🏾🏫
- 🧑🏾🏫
- 👨🏾🏫
- 👩🏾🏭
- 🧑🏾🏭
- 👨🏾🏭
- 👩🏾💻
- 🧑🏾💻
- 👨🏾💻
- 👩🏾💼
- 🧑🏾💼
- 👨🏾💼
- 👩🏾🔧
- 🧑🏾🔧
- 👨🏾🔧
- 👩🏾🔬
- 🧑🏾🔬
- 👨🏾🔬
- 👩🏾🎨
- 🧑🏾🎨
- 👨🏾🎨
- 👩🏾🚒
- 🧑🏾🚒
- 👨🏾🚒
- 👩🏾✈️
- 🧑🏾✈️
- 👨🏾✈️
- 👩🏾🚀
- 🧑🏾🚀
- 👨🏾🚀
- 👩🏾⚖️
- 🧑🏾⚖️
- 👨🏾⚖️
- 👰🏾♀️
- 👰🏾
- 👰🏾♂️
- 🤵🏾♀️
- 🤵🏾
- 🤵🏾♂️
- 👸🏾
- 🫅🏾
- 🤴🏾
- 🥷🏾
- 🦸🏾♀️
- 🦸🏾
- 🦸🏾♂️
- 🦹🏾♀️
- 🦹🏾
- 🦹🏾♂️
- 🤶🏾
- 🧑🏾🎄
- 🎅🏾
- 🧙🏾♀️
- 🧙🏾
- 🧙🏾♂️
- 🧝🏾♀️
- 🧝🏾
- 🧝🏾♂️
- 🧛🏾♀️
- 🧛🏾
- 🧛🏾♂️
- 🧜🏾♀️
- 🧜🏾
- 🧜🏾♂️
- 🧚🏾♀️
- 🧚🏾
- 🧚🏾♂️
- 👼🏾
- 🤰🏾
- 🫄🏾
- 🫃🏾
- 🤱🏾
- 👩🏾🍼
- 🧑🏾🍼
- 👨🏾🍼
- 🙇🏾♀️
- 🙇🏾
- 🙇🏾♂️
- 💁🏾♀️
- 💁🏾
- 💁🏾♂️
- 🙅🏾♀️
- 🙅🏾
- 🙅🏾♂️
- 🙆🏾♀️
- 🙆🏾
- 🙆🏾♂️
- 🙋🏾♀️
- 🙋🏾
- 🙋🏾♂️
- 🧏🏾♀️
- 🧏🏾
- 🧏🏾♂️
- 🤦🏾♀️
- 🤦🏾
- 🤦🏾♂️
- 🤷🏾♀️
- 🤷🏾
- 🤷🏾♂️
- 🙎🏾♀️
- 🙎🏾
- 🙎🏾♂️
- 🙍🏾♀️
- 🙍🏾
- 🙍🏾♂️
- 💇🏾♀️
- 💇🏾
- 💇🏾♂️
- 💆🏾♀️
- 💆🏾
- 💆🏾♂️
- 🧖🏾♀️
- 🧖🏾
- 🧖🏾♂️
- 💃🏾
- 🕺🏾
- 👩🏾🦽
- 🧑🏾🦽
- 👨🏾🦽
- 👩🏾🦼
- 🧑🏾🦼
- 👨🏾🦼
- 🚶🏾♀️
- 🚶🏾
- 🚶🏾♂️
- 👩🏾🦯
- 🧑🏾🦯
- 👨🏾🦯
- 🧎🏾♀️
- 🧎🏾
- 🧎🏾♂️
- 🏃🏾♀️
- 🏃🏾
- 🏃🏾♂️
- 🧍🏾♀️
- 🧍🏾
- 🧍🏾♂️
- 👭🏾
- 🧑🏾🤝🧑🏾
- 👬🏾
- 👫🏾
- 🧗🏾♀️
- 🧗🏾
- 🧗🏾♂️
- 🏇🏾
- 🏂🏾
- 🏌🏾♀️
- 🏌🏾
- 🏌🏾♂️
- 🏄🏾♀️
- 🏄🏾
- 🏄🏾♂️
- 🚣🏾♀️
- 🚣🏾
- 🚣🏾♂️
- 🏊🏾♀️
- 🏊🏾
- 🏊🏾♂️
- ⛹🏾♀️
- ⛹🏾
- ⛹🏾♂️
- 🏋🏾♀️
- 🏋🏾
- 🏋🏾♂️
- 🚴🏾♀️
- 🚴🏾
- 🚴🏾♂️
- 🚵🏾♀️
- 🚵🏾
- 🚵🏾♂️
- 🤸🏾♀️
- 🤸🏾
- 🤸🏾♂️
- 🤽🏾♀️
- 🤽🏾
- 🤽🏾♂️
- 🤾🏾♀️
- 🤾🏾
- 🤾🏾♂️
- 🤹🏾♀️
- 🤹🏾
- 🤹🏾♂️
- 🧘🏾♀️
- 🧘🏾
- 🧘🏾♂️
- 🛀🏾
- 🛌🏾
- 👋🏿
- 🤚🏿
- 🖐🏿
- ✋🏿
- 🖖🏿
- 👌🏿
- 🤌🏿
- 🤏🏿
- ✌🏿
- 🤞🏿
- 🫰🏿
- 🤟🏿
- 🤘🏿
- 🤙🏿
- 🫵🏿
- 🫱🏿
- 🫲🏿
- 🫳🏿
- 🫴🏿
- 👈🏿
- 👉🏿
- 👆🏿
- 🖕🏿
- 👇🏿
- ☝🏿
- 👍🏿
- 👎🏿
- ✊🏿
- 👊🏿
- 🤛🏿
- 🤜🏿
- 👏🏿
- 🫶🏿
- 🙌🏿
- 👐🏿
- 🤲🏿
- 🙏🏿
- ✍🏿
- 🤳🏿
- 💪🏿
- 🦵🏿
- 🦶🏿
- 👂🏿
- 🦻🏿
- 👃🏿
- 👶🏿
- 👧🏿
- 🧒🏿
- 👦🏿
- 👩🏿
- 🧑🏿
- 👨🏿
- 👩🏿🦱
- 🧑🏿🦱
- 👨🏿🦱
- 👩🏿🦰
- 🧑🏿🦰
- 👨🏿🦰
- 👱🏿♀️
- 👱🏿
- 👱🏿♂️
- 👩🏿🦳
- 🧑🏿🦳
- 👨🏿🦳
- 👩🏿🦲
- 🧑🏿🦲
- 👨🏿🦲
- 🧔🏿♀️
- 🧔🏿
- 🧔🏿♂️
- 👵🏿
- 🧓🏿
- 👴🏿
- 👲🏿
- 👳🏿♀️
- 👳🏿
- 👳🏿♂️
- 🧕🏿
- 👮🏿♀️
- 👮🏿
- 👮🏿♂️
- 👷🏿♀️
- 👷🏿
- 👷🏿♂️
- 💂🏿♀️
- 💂🏿
- 💂🏿♂️
- 🕵🏿♀️
- 🕵🏿
- 🕵🏿♂️
- 👩🏿⚕️
- 🧑🏿⚕️
- 👨🏿⚕️
- 👩🏿🌾
- 🧑🏿🌾
- 👨🏿🌾
- 👩🏿🍳
- 🧑🏿🍳
- 👨🏿🍳
- 👩🏿🎓
- 🧑🏿🎓
- 👨🏿🎓
- 👩🏿🎤
- 🧑🏿🎤
- 👨🏿🎤
- 👩🏿🏫
- 🧑🏿🏫
- 👨🏿🏫
- 👩🏿🏭
- 🧑🏿🏭
- 👨🏿🏭
- 👩🏿💻
- 🧑🏿💻
- 👨🏿💻
- 👩🏿💼
- 🧑🏿💼
- 👨🏿💼
- 👩🏿🔧
- 🧑🏿🔧
- 👨🏿🔧
- 👩🏿🔬
- 🧑🏿🔬
- 👨🏿🔬
- 👩🏿🎨
- 🧑🏿🎨
- 👨🏿🎨
- 👩🏿🚒
- 🧑🏿🚒
- 👨🏿🚒
- 👩🏿✈️
- 🧑🏿✈️
- 👨🏿✈️
- 👩🏿🚀
- 🧑🏿🚀
- 👨🏿🚀
- 👩🏿⚖️
- 🧑🏿⚖️
- 👨🏿⚖️
- 👰🏿♀️
- 👰🏿
- 👰🏿♂️
- 🤵🏿♀️
- 🤵🏿
- 🤵🏿♂️
- 👸🏿
- 🫅🏿
- 🤴🏿
- 🥷🏿
- 🦸🏿♀️
- 🦸🏿
- 🦸🏿♂️
- 🦹🏿♀️
- 🦹🏿
- 🦹🏿♂️
- 🤶🏿
- 🧑🏿🎄
- 🎅🏿
- 🧙🏿♀️
- 🧙🏿
- 🧙🏿♂️
- 🧝🏿♀️
- 🧝🏿
- 🧝🏿♂️
- 🧛🏿♀️
- 🧛🏿
- 🧛🏿♂️
- 🧜🏿♀️
- 🧜🏿
- 🧜🏿♂️
- 🧚🏿♀️
- 🧚🏿
- 🧚🏿♂️
- 👼🏿
- 🤰🏿
- 🫄🏿
- 🫃🏿
- 🤱🏿
- 👩🏿🍼
- 🧑🏿🍼
- 👨🏿🍼
- 🙇🏿♀️
- 🙇🏿
- 🙇🏿♂️
- 💁🏿♀️
- 💁🏿
- 💁🏿♂️
- 🙅🏿♀️
- 🙅🏿
- 🙅🏿♂️
- 🙆🏿♀️
- 🙆🏿
- 🙆🏿♂️
- 🙋🏿♀️
- 🙋🏿
- 🙋🏿♂️
- 🧏🏿♀️
- 🧏🏿
- 🧏🏿♂️
- 🤦🏿♀️
- 🤦🏿
- 🤦🏿♂️
- 🤷🏿♀️
- 🤷🏿
- 🤷🏿♂️
- 🙎🏿♀️
- 🙎🏿
- 🙎🏿♂️
- 🙍🏿♀️
- 🙍🏿
- 🙍🏿♂️
- 💇🏿♀️
- 💇🏿
- 💇🏿♂️
- 💆🏿♀️
- 💆🏿
- 💆🏿♂️
- 🧖🏿♀️
- 🧖🏿
- 🧖🏿♂️
- 💃🏿
- 🕺🏿
- 🕴🏿
- 👩🏿🦽
- 🧑🏿🦽
- 👨🏿🦽
- 👩🏿🦼
- 🧑🏿🦼
- 👨🏿🦼
- 🚶🏿♀️
- 🚶🏿
- 🚶🏿♂️
- 👩🏿🦯
- 🧑🏿🦯
- 👨🏿🦯
- 🧎🏿♀️
- 🧎🏿
- 🧎🏿♂️
- 🏃🏿♀️
- 🏃🏿
- 🏃🏿♂️
- 🧍🏿♀️
- 🧍🏿
- 🧍🏿♂️
- 👭🏿
- 🧑🏿🤝🧑🏿
- 👬🏿
- 👫🏿
- 🧗🏿♀️
- 🧗🏿
- 🧗🏿♂️
- 🏇🏿
- 🏂🏿
- 🏌🏿♀️
- 🏌🏿
- 🏌🏿♂️
- 🏄🏿♀️
- 🏄🏿
- 🏄🏿♂️
- 🚣🏿♀️
- 🚣🏿
- 🚣🏿♂️
- 🏊🏿♀️
- 🏊🏿
- 🏊🏿♂️
- ⛹🏿♀️
- ⛹🏿
- ⛹🏿♂️
- 🏋🏿♀️
- 🏋🏿
- 🏋🏿♂️
- 🚴🏿♀️
- 🚴🏿
- 🚴🏿♂️
- 🚵🏿♀️
- 🚵🏿
- 🚵🏿♂️
- 🤸🏿♀️
- 🤸🏿
- 🤸🏿♂️
- 🤽🏿♀️
- 🤽🏿
- 🤽🏿♂️
- 🤾🏿♀️
- 🤾🏿
- 🤾🏿♂️
- 🤹🏿♀️
- 🤹🏿
- 🤹🏿♂️
- 🧘🏿♀️
- 🧘🏿
- 🧘🏿♂️
- 🛀🏿
- 🛌🏿
- 🐶
- 🐱
- 🐭
- 🐹
- 🐰
- 🦊
- 🐻
- 🐼
- 🐻❄️
- 🐨
- 🐯
- 🦁
- 🐮
- 🐷
- 🐽
- 🐸
- 🐵
- 🙈
- 🙉
- 🙊
- 🐒
- 🐔
- 🐧
- 🐦
- 🐤
- 🐣
- 🐥
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: c98f2a0d-e1b8-4f76-90d3-359caf88d6b9
type: derived
What it detects
This rule flags Windows process creation events where the command line contains one of many listed emoji characters. Attackers may use unusual Unicode characters in command lines to hinder log parsing, filtering, or analyst review during defense evasion. Telemetry required is Windows process creation with access to the full command line string.
Known false positives
- Unknown
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.