huntrule

Windows Process Creation: Command Line Contains Specific Emoji Characters

Alerts when a Windows process command line includes specific emoji Unicode characters that may be used for evasion or obfuscation.

FreeReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
@Kostastsale, TheDFIRReport (SigmaHQ), DRL 1.1
Published
2022-12-05
Updated
2026-07-30
AnalysisDetection

What it detects

This rule flags Windows process creation events where the command line contains one of many listed emoji characters. Attackers may use unusual Unicode characters in command lines to hinder log parsing, filtering, or analyst review during defense evasion. Telemetry required is Windows process creation with access to the full command line string.

Reporting behind it

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.