Query: detection rule: Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.
Matching passage: Sigma rule: Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.. Logsource: windows / process_creation. Rule: title: Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 4 id: 225274c4-8dd1-40db-9e09-71dff4f6fb3c status: test description: Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity. author: '@Kostastsale, TheDFIRReport' references: - Internal Research tags: - attack.stealth date: 2022-12-05 logsource: product: windows category: process_creation detection: selection: CommandLine|contains: - 🔸 - 🔹 - 🔶 - 🔷 - 🔳 - 🔲 - ▪️ - ▫️ - ◾️ - ◽️ - ◼️ - ◻️ - 🟥 - 🟧 - 🟨 - 🟩 - 🟦 - 🟪 - ⬛️ - ⬜️ - 🟫 - 🔈 - 🔇 - 🔉 - 🔊 - 🔔 - 🔕 - 📣 - 📢 - 👁‍🗨 - 💬 - 💭 - 🗯 - ♠️ - ♣️ - ♥️ - ♦️ - 🃏 - 🎴 - 🀄️ - 🕐 - 🕑 - 🕒 - 🕓 - 🕔 - 🕕 - 🕖 - 🕗 - 🕘 - 🕙 - 🕚 - 🕛 - 🕜 - 🕝 - 🕞 - 🕟 - 🕠 - 🕡 - 🕢 - 🕣 - 🕤 - 🕥 - 🕦 - 🕧✢ - ✣ - ✤ - ✥ - ✦ - ✧ - ★ - ☆ - ✯ - ✡︎ - ✩ - ✪ - ✫ - ✬ - ✭ - ✮ - ✶ - ✷ - ✵ - ✸ - ✹ - → - ⇒ - ⟹ - ⇨ - ⇾ - ➾ - ⇢ - ☛ - ☞ - ➔ - ➜ - ➙ - ➛ - ➝ - ➞ - ♠︎ - ♣︎ - ♥︎ - ♦︎ - ♤ - ♧ - ♡ - ♢ - ♚ - ♛ - ♜ - ♝ - ♞ - ♟ - ♔ - ♕ - ♖ - ♗ - ♘ - ♙ - ⚀ - ⚁ - ⚂ - ⚃ - ⚄ - ⚅ - 🂠 - ⚈ - ⚉ - ⚆ - ⚇ - 𓀀 - 𓀁 - 𓀂 - 𓀃 - 𓀄 - 𓀅 - 𓀆 - 𓀇 - 𓀈 - 𓀉 - 𓀊 - 𓀋 - 𓀌 - 𓀍 - 𓀎 - 𓀏 - 𓀐 - 𓀑 - 𓀒 - 𓀓 - 𓀔 - 𓀕 - 𓀖 - 𓀗 - 𓀘 - 𓀙 - 𓀚 - 𓀛 - 𓀜 - 𓀝🏳️ - 🏴 - 🏁 - 🚩 - 🏳️‍🌈 - 🏳️‍⚧️ - 🏴‍☠️ - 🇦🇫 - 🇦🇽 - 🇦🇱 - 🇩🇿 - 🇦🇸 - 🇦🇩 - 🇦🇴 - 🇦🇮 - 🇦🇶 - 🇦🇬 - 🇦🇷 - 🇦🇲 - 🇦🇼 - 🇦🇺 - 🇦🇹 - 🇦🇿 - 🇧🇸 - 🇧🇭 - 🇧🇩 - 🇧🇧 - 🇧🇾 - 🇧🇪 - 🇧🇿 - 🇧🇯 - 🇧🇲 - 🇧🇹 - 🇧🇴 - 🇧🇦 - 🇧🇼 - 🇧🇷 - 🇮🇴 - 🇻🇬 - 🇧🇳 - 🇧🇬 - 🇧🇫 - 🇧🇮 - 🇰🇭 - 🇨🇲 - 🇨🇦 - 🇮🇨 - 🇨🇻 - 🇧🇶 - 🇰🇾 - 🇨🇫 - 🇹🇩 - 🇨🇱 - 🇨🇳 - 🇨🇽 - 🇨🇨 - 🇨🇴 - 🇰🇲 - 🇨🇬 - 🇨🇩 - 🇨🇰 - 🇨🇷 - 🇨🇮 - 🇭🇷 - 🇨🇺 - 🇨🇼 - 🇨🇾 - 🇨🇿 - 🇩🇰 - 🇩🇯 - 🇩🇲 - 🇩🇴 - 🇪🇨 - 🇪🇬 - 🇸🇻 - 🇬🇶 - 🇪🇷 - 🇪🇪 - 🇪🇹 - 🇪🇺 - 🇫🇰 - 🇫🇴 - 🇫🇯 - 🇫🇮 - 🇫🇷 - 🇬🇫 - 🇵🇫 - 🇹🇫 - 🇬🇦 - 🇬🇲 - 🇬🇪 - 🇩🇪 - 🇬🇭 - 🇬🇮 - 🇬🇷 - 🇬🇱 - 🇬🇩 - 🇬🇵 - 🇬🇺 - 🇬🇹 - 🇬🇬 - 🇬🇳 - 🇬🇼 - 🇬🇾 - 🇭🇹 - 🇭🇳 - 🇭🇰 - 🇭🇺 - 🇮🇸 - 🇮🇳 - 🇮🇩 - 🇮🇷 - 🇮🇶 - 🇮🇪 - 🇮🇲 - 🇮🇱 - 🇮🇹 - 🇯🇲 - 🇯🇵 - 🎌 - 🇯🇪 - 🇯🇴 - 🇰🇿 - 🇰🇪 - 🇰🇮 - 🇽🇰 - 🇰🇼 - 🇰🇬 - 🇱🇦 - 🇱🇻 - 🇱🇧 - 🇱🇸 - 🇱🇷 - 🇱🇾 - 🇱🇮 - 🇱🇹 - 🇱🇺 - 🇲🇴 - 🇲🇰 - 🇲🇬 - 🇲🇼 - 🇲🇾 - 🇲🇻 - 🇲🇱 - 🇲🇹 - 🇲🇭 - 🇲🇶 - 🇲🇷 - 🇲🇺 - 🇾🇹 - 🇲🇽 - 🇫🇲 - 🇲🇩 - 🇲🇨 - 🇲🇳 - 🇲🇪 - 🇲🇸 - 🇲🇦 - 🇲🇿 - 🇲🇲 - 🇳🇦 - 🇳🇷 - 🇳🇵 - 🇳🇱 - 🇳🇨 - 🇳🇿 - 🇳🇮 - 🇳🇪 - 🇳🇬 - 🇳🇺 - 🇳🇫 - 🇰🇵 - 🇲🇵 - 🇳🇴 - 🇴🇲 - 🇵🇰 - 🇵🇼 - 🇵🇸 - 🇵🇦 - 🇵🇬 - 🇵🇾 - 🇵🇪 - 🇵🇭 - 🇵🇳 - 🇵🇱 - 🇵🇹 - 🇵🇷 - 🇶🇦 - 🇷🇪 - 🇷🇴 - 🇷🇺 - 🇷🇼 - 🇼🇸 - 🇸🇲 - 🇸🇦 - 🇸🇳 - 🇷🇸 - 🇸🇨 - 🇸🇱 - 🇸🇬 - 🇸🇽 - 🇸🇰 - 🇸🇮 - 🇬🇸 - 🇸🇧 - 🇸🇴 - 🇿🇦 - 🇰🇷 - 🇸🇸 - 🇪🇸 - 🇱🇰 - 🇧🇱 - 🇸🇭 - 🇰🇳 - 🇱🇨 - 🇵🇲 - 🇻🇨 - 🇸🇩 - 🇸🇷 - 🇸🇿 - 🇸🇪 - 🇨🇭 - 🇸🇾 - 🇹🇼 - 🇹🇯 - 🇹🇿 - 🇹🇭 - 🇹🇱 - 🇹🇬 - 🇹🇰 - 🇹🇴 - 🇹🇹 - 🇹🇳 - 🇹🇷 - 🇹🇲 - 🇹🇨 - 🇹🇻 - 🇻🇮 - 🇺🇬 - 🇺🇦 - 🇦🇪 - 🇬🇧 - 🏴󠁧󠁢󠁥󠁮󠁧󠁿 - 🏴󠁧󠁢󠁳󠁣󠁴󠁿 - 🏴󠁧󠁢󠁷󠁬󠁳󠁿 - 🇺🇳 - 🇺🇸 - 🇺🇾 - 🇺🇿 - 🇻🇺 - 🇻🇦 - 🇻🇪 - 🇻🇳 - 🇼🇫 - 🇪🇭 - 🇾🇪 - 🇿🇲 - 🇿🇼🫠 - 🫢 - 🫣 - 🫡 - 🫥 - 🫤 - 🥹 - 🫱 - 🫱🏻 - 🫱🏼 - 🫱🏽 - 🫱🏾 - 🫱🏿 - 🫲 - 🫲🏻 - 🫲🏼 - 🫲🏽
Near-miss passage: Sigma rule: Detects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by deleting. Logsource: windows / registry_delete. Rule: title: Windows Recall Feature Enabled - DisableAIDataAnalysis Value Deleted id: 5dfc1465-8f65-4fde-8eb5-6194380c6a62 related: - id: 75180c5f-4ea1-461a-a4f6-6e4700c065d4 type: similar - id: 817f252c-5143-4dae-b418-48c3e9f63728 type: similar status: test description: 'Detects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by deleting the existing "DisableAIDataAnalysis" registry value. Adversaries may enable Windows Recall as part of post-exploitation discovery and collection activities. This rule assumes that Recall is already explicitly disabled on the host, and subsequently enabled by the adversary. ' references: - https://learn.microsoft.com/en-us/windows/client-management/manage-recall - https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-windowsai#disableaidataanalysis author: Sajid Nawaz Khan date: 2024-06-02 tags: - attack.collection - attack.t1113 logsource: category: registry_delete product: windows detection: selection: EventType: DeleteValue TargetObject|endswith: \Microsoft\Windows\WindowsAI\DisableAIDataAnalysis condition: selection falsepositives: - Legitimate use/activation of Windows Recall level: medium