Query: alert when Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.
Matching passage: Sigma rule: Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.. Logsource: windows / process_creation. Rule: title: Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 4 id: 225274c4-8dd1-40db-9e09-71dff4f6fb3c status: test description: Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity. author: '@Kostastsale, TheDFIRReport' references: - Internal Research tags: - attack.stealth date: 2022-12-05 logsource: product: windows category: process_creation detection: selection: CommandLine|contains: - 🔸 - 🔹 - 🔶 - 🔷 - 🔳 - 🔲 - ▪️ - ▫️ - ◾️ - ◽️ - ◼️ - ◻️ - 🟥 - 🟧 - 🟨 - 🟩 - 🟦 - 🟪 - ⬛️ - ⬜️ - 🟫 - 🔈 - 🔇 - 🔉 - 🔊 - 🔔 - 🔕 - 📣 - 📢 - 👁‍🗨 - 💬 - 💭 - 🗯 - ♠️ - ♣️ - ♥️ - ♦️ - 🃏 - 🎴 - 🀄️ - 🕐 - 🕑 - 🕒 - 🕓 - 🕔 - 🕕 - 🕖 - 🕗 - 🕘 - 🕙 - 🕚 - 🕛 - 🕜 - 🕝 - 🕞 - 🕟 - 🕠 - 🕡 - 🕢 - 🕣 - 🕤 - 🕥 - 🕦 - 🕧✢ - ✣ - ✤ - ✥ - ✦ - ✧ - ★ - ☆ - ✯ - ✡︎ - ✩ - ✪ - ✫ - ✬ - ✭ - ✮ - ✶ - ✷ - ✵ - ✸ - ✹ - → - ⇒ - ⟹ - ⇨ - ⇾ - ➾ - ⇢ - ☛ - ☞ - ➔ - ➜ - ➙ - ➛ - ➝ - ➞ - ♠︎ - ♣︎ - ♥︎ - ♦︎ - ♤ - ♧ - ♡ - ♢ - ♚ - ♛ - ♜ - ♝ - ♞ - ♟ - ♔ - ♕ - ♖ - ♗ - ♘ - ♙ - ⚀ - ⚁ - ⚂ - ⚃ - ⚄ - ⚅ - 🂠 - ⚈ - ⚉ - ⚆ - ⚇ - 𓀀 - 𓀁 - 𓀂 - 𓀃 - 𓀄 - 𓀅 - 𓀆 - 𓀇 - 𓀈 - 𓀉 - 𓀊 - 𓀋 - 𓀌 - 𓀍 - 𓀎 - 𓀏 - 𓀐 - 𓀑 - 𓀒 - 𓀓 - 𓀔 - 𓀕 - 𓀖 - 𓀗 - 𓀘 - 𓀙 - 𓀚 - 𓀛 - 𓀜 - 𓀝🏳️ - 🏴 - 🏁 - 🚩 - 🏳️‍🌈 - 🏳️‍⚧️ - 🏴‍☠️ - 🇦🇫 - 🇦🇽 - 🇦🇱 - 🇩🇿 - 🇦🇸 - 🇦🇩 - 🇦🇴 - 🇦🇮 - 🇦🇶 - 🇦🇬 - 🇦🇷 - 🇦🇲 - 🇦🇼 - 🇦🇺 - 🇦🇹 - 🇦🇿 - 🇧🇸 - 🇧🇭 - 🇧🇩 - 🇧🇧 - 🇧🇾 - 🇧🇪 - 🇧🇿 - 🇧🇯 - 🇧🇲 - 🇧🇹 - 🇧🇴 - 🇧🇦 - 🇧🇼 - 🇧🇷 - 🇮🇴 - 🇻🇬 - 🇧🇳 - 🇧🇬 - 🇧🇫 - 🇧🇮 - 🇰🇭 - 🇨🇲 - 🇨🇦 - 🇮🇨 - 🇨🇻 - 🇧🇶 - 🇰🇾 - 🇨🇫 - 🇹🇩 - 🇨🇱 - 🇨🇳 - 🇨🇽 - 🇨🇨 - 🇨🇴 - 🇰🇲 - 🇨🇬 - 🇨🇩 - 🇨🇰 - 🇨🇷 - 🇨🇮 - 🇭🇷 - 🇨🇺 - 🇨🇼 - 🇨🇾 - 🇨🇿 - 🇩🇰 - 🇩🇯 - 🇩🇲 - 🇩🇴 - 🇪🇨 - 🇪🇬 - 🇸🇻 - 🇬🇶 - 🇪🇷 - 🇪🇪 - 🇪🇹 - 🇪🇺 - 🇫🇰 - 🇫🇴 - 🇫🇯 - 🇫🇮 - 🇫🇷 - 🇬🇫 - 🇵🇫 - 🇹🇫 - 🇬🇦 - 🇬🇲 - 🇬🇪 - 🇩🇪 - 🇬🇭 - 🇬🇮 - 🇬🇷 - 🇬🇱 - 🇬🇩 - 🇬🇵 - 🇬🇺 - 🇬🇹 - 🇬🇬 - 🇬🇳 - 🇬🇼 - 🇬🇾 - 🇭🇹 - 🇭🇳 - 🇭🇰 - 🇭🇺 - 🇮🇸 - 🇮🇳 - 🇮🇩 - 🇮🇷 - 🇮🇶 - 🇮🇪 - 🇮🇲 - 🇮🇱 - 🇮🇹 - 🇯🇲 - 🇯🇵 - 🎌 - 🇯🇪 - 🇯🇴 - 🇰🇿 - 🇰🇪 - 🇰🇮 - 🇽🇰 - 🇰🇼 - 🇰🇬 - 🇱🇦 - 🇱🇻 - 🇱🇧 - 🇱🇸 - 🇱🇷 - 🇱🇾 - 🇱🇮 - 🇱🇹 - 🇱🇺 - 🇲🇴 - 🇲🇰 - 🇲🇬 - 🇲🇼 - 🇲🇾 - 🇲🇻 - 🇲🇱 - 🇲🇹 - 🇲🇭 - 🇲🇶 - 🇲🇷 - 🇲🇺 - 🇾🇹 - 🇲🇽 - 🇫🇲 - 🇲🇩 - 🇲🇨 - 🇲🇳 - 🇲🇪 - 🇲🇸 - 🇲🇦 - 🇲🇿 - 🇲🇲 - 🇳🇦 - 🇳🇷 - 🇳🇵 - 🇳🇱 - 🇳🇨 - 🇳🇿 - 🇳🇮 - 🇳🇪 - 🇳🇬 - 🇳🇺 - 🇳🇫 - 🇰🇵 - 🇲🇵 - 🇳🇴 - 🇴🇲 - 🇵🇰 - 🇵🇼 - 🇵🇸 - 🇵🇦 - 🇵🇬 - 🇵🇾 - 🇵🇪 - 🇵🇭 - 🇵🇳 - 🇵🇱 - 🇵🇹 - 🇵🇷 - 🇶🇦 - 🇷🇪 - 🇷🇴 - 🇷🇺 - 🇷🇼 - 🇼🇸 - 🇸🇲 - 🇸🇦 - 🇸🇳 - 🇷🇸 - 🇸🇨 - 🇸🇱 - 🇸🇬 - 🇸🇽 - 🇸🇰 - 🇸🇮 - 🇬🇸 - 🇸🇧 - 🇸🇴 - 🇿🇦 - 🇰🇷 - 🇸🇸 - 🇪🇸 - 🇱🇰 - 🇧🇱 - 🇸🇭 - 🇰🇳 - 🇱🇨 - 🇵🇲 - 🇻🇨 - 🇸🇩 - 🇸🇷 - 🇸🇿 - 🇸🇪 - 🇨🇭 - 🇸🇾 - 🇹🇼 - 🇹🇯 - 🇹🇿 - 🇹🇭 - 🇹🇱 - 🇹🇬 - 🇹🇰 - 🇹🇴 - 🇹🇹 - 🇹🇳 - 🇹🇷 - 🇹🇲 - 🇹🇨 - 🇹🇻 - 🇻🇮 - 🇺🇬 - 🇺🇦 - 🇦🇪 - 🇬🇧 - 🏴󠁧󠁢󠁥󠁮󠁧󠁿 - 🏴󠁧󠁢󠁳󠁣󠁴󠁿 - 🏴󠁧󠁢󠁷󠁬󠁳󠁿 - 🇺🇳 - 🇺🇸 - 🇺🇾 - 🇺🇿 - 🇻🇺 - 🇻🇦 - 🇻🇪 - 🇻🇳 - 🇼🇫 - 🇪🇭 - 🇾🇪 - 🇿🇲 - 🇿🇼🫠 - 🫢 - 🫣 - 🫡 - 🫥 - 🫤 - 🥹 - 🫱 - 🫱🏻 - 🫱🏼 - 🫱🏽 - 🫱🏾 - 🫱🏿 - 🫲 - 🫲🏻 - 🫲🏼 - 🫲🏽
Near-miss passage: Sigma rule: Detects changes to the "DisableRestrictedAdmin" registry value in order to disable or enable RestrictedAdmin mode. Restr. Logsource: windows / registry_set. Rule: title: RestrictedAdminMode Registry Value Tampering id: d6ce7ebd-260b-4323-9768-a9631c8d4db2 related: - id: 28ac00d6-22d9-4a3c-927f-bbd770104573 type: similar status: test description: 'Detects changes to the "DisableRestrictedAdmin" registry value in order to disable or enable RestrictedAdmin mode. RestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop. This prevents your credentials from being harvested during the initial connection process if the remote server has been compromise ' references: - https://github.com/redcanaryco/atomic-red-team/blob/a8e3cf63e97b973a25903d3df9fd55da6252e564/atomics/T1112/T1112.md - https://social.technet.microsoft.com/wiki/contents/articles/32905.remote-desktop-services-enable-restricted-admin-mode.aspx author: frack113 date: 2023-01-13 modified: 2024-08-23 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: product: windows category: registry_set detection: selection: TargetObject|endswith: System\CurrentControlSet\Control\Lsa\DisableRestrictedAdmin condition: selection falsepositives: - Unknown level: high