Query: detect Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity. in logs
Matching passage: Sigma rule: Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.. Logsource: windows / process_creation. Rule: title: Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 2 id: c98f2a0d-e1b8-4f76-90d3-359caf88d6b9 status: test description: Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity. author: '@Kostastsale, TheDFIRReport' references: - Internal Research tags: - attack.stealth date: 2022-12-05 logsource: product: windows category: process_creation detection: selection: CommandLine|contains: - 🤷🏼 - 🤷🏼‍♂️ - 🙎🏼‍♀️ - 🙎🏼 - 🙎🏼‍♂️ - 🙍🏼‍♀️ - 🙍🏼 - 🙍🏼‍♂️ - 💇🏼‍♀️ - 💇🏼 - 💇🏼‍♂️ - 💆🏼‍♀️ - 💆🏼 - 💆🏼‍♂️ - 🧖🏼‍♀️ - 🧖🏼 - 🧖🏼‍♂️ - 💃🏼 - 🕺🏼 - 🕴🏼 - 👩🏼‍🦽 - 🧑🏼‍🦽 - 👨🏼‍🦽 - 👩🏼‍🦼 - 🧑🏼‍🦼 - 👨🏼‍🦼 - 🚶🏼‍♀️ - 🚶🏼 - 🚶🏼‍♂️ - 👩🏼‍🦯 - 🧑🏼‍🦯 - 👨🏼‍🦯 - 🧎🏼‍♀️ - 🧎🏼 - 🧎🏼‍♂️ - 🏃🏼‍♀️ - 🏃🏼 - 🏃🏼‍♂️ - 🧍🏼‍♀️ - 🧍🏼 - 🧍🏼‍♂️ - 👭🏼 - 🧑🏼‍🤝‍🧑🏼 - 👬🏼 - 👫🏼 - 🧗🏼‍♀️ - 🧗🏼 - 🧗🏼‍♂️ - 🏇🏼 - 🏂🏼 - 🏌🏼‍♀️ - 🏌🏼 - 🏌🏼‍♂️ - 🏄🏼‍♀️ - 🏄🏼 - 🏄🏼‍♂️ - 🚣🏼‍♀️ - 🚣🏼 - 🚣🏼‍♂️ - 🏊🏼‍♀️ - 🏊🏼 - 🏊🏼‍♂️ - ⛹🏼‍♀️ - ⛹🏼 - ⛹🏼‍♂️ - 🏋🏼‍♀️ - 🏋🏼 - 🏋🏼‍♂️ - 🚴🏼‍♀️ - 🚴🏼 - 🚴🏼‍♂️ - 🚵🏼‍♀️ - 🚵🏼 - 🚵🏼‍♂️ - 🤸🏼‍♀️ - 🤸🏼 - 🤸🏼‍♂️ - 🤽🏼‍♀️ - 🤽🏼 - 🤽🏼‍♂️ - 🤾🏼‍♀️ - 🤾🏼 - 🤾🏼‍♂️ - 🤹🏼‍♀️ - 🤹🏼 - 🤹🏼‍♂️ - 🧘🏼‍♀️ - 🧘🏼 - 🧘🏼‍♂️ - 🛀🏼 - 🛌🏼 - 👋🏽 - 🤚🏽 - 🖐🏽 - ✋🏽 - 🖖🏽 - 👌🏽 - 🤌🏽 - 🤏🏽 - ✌🏽 - 🤞🏽 - 🫰🏽 - 🤟🏽 - 🤘🏽 - 🤙🏽 - 🫵🏽 - 🫱🏽 - 🫲🏽 - 🫳🏽 - 🫴🏽 - 👈🏽 - 👉🏽 - 👆🏽 - 🖕🏽 - 👇🏽 - ☝🏽 - 👍🏽 - 👎🏽 - ✊🏽 - 👊🏽 - 🤛🏽 - 🤜🏽 - 👏🏽 - 🫶🏽 - 🙌🏽 - 👐🏽 - 🤲🏽 - 🙏🏽 - ✍🏽 - 💪🏽 - 🦵🏽 - 🦶🏽 - 👂🏽 - 🦻🏽 - 👃🏽 - 👶🏽 - 👧🏽 - 🧒🏽 - 👦🏽 - 👩🏽 - 🧑🏽 - 👨🏽 - 👩🏽‍🦱 - 🧑🏽‍🦱 - 👨🏽‍🦱 - 👩🏽‍🦰 - 🧑🏽‍🦰 - 👨🏽‍🦰 - 👱🏽‍♀️ - 👱🏽 - 👱🏽‍♂️ - 👩🏽‍🦳 - 🧑🏽‍🦳 - 👨🏽‍🦳 - 👩🏽‍🦲 - 🧑🏽‍🦲 - 👨🏽‍🦲 - 🧔🏽‍♀️ - 🧔🏽 - 🧔🏽‍♂️ - 👵🏽 - 🧓🏽 - 👴🏽 - 👲🏽 - 👳🏽‍♀️ - 👳🏽 - 👳🏽‍♂️ - 🧕🏽 - 👮🏽‍♀️ - 👮🏽 - 👮🏽‍♂️ - 👷🏽‍♀️ - 👷🏽 - 👷🏽‍♂️ - 💂🏽‍♀️ - 💂🏽 - 💂🏽‍♂️ - 🕵🏽‍♀️ - 🕵🏽 - 🕵🏽‍♂️ - 👩🏽‍⚕️ - 🧑🏽‍⚕️ - 👨🏽‍⚕️ - 👩🏽‍🌾 - 🧑🏽‍🌾 - 👨🏽‍🌾 - 👩🏽‍🍳 - 🧑🏽‍🍳 - 👨🏽‍🍳 - 👩🏽‍🎓 - 🧑🏽‍🎓 - 👨🏽‍🎓 - 👩🏽‍🎤 - 🧑🏽‍🎤 - 👨🏽‍🎤 - 👩🏽‍🏫 - 🧑🏽‍🏫 - 👨🏽‍🏫 - 👩🏽‍🏭 - 🧑🏽‍🏭 - 👨🏽‍🏭 - 👩🏽‍💻 - 🧑🏽‍💻 - 👨🏽‍💻 - 👩🏽‍💼 - 🧑🏽‍💼 - 👨🏽‍💼 - 👩🏽‍🔧 - 🧑🏽‍🔧 - 👨🏽‍🔧 - 👩🏽‍🔬 - 🧑🏽‍🔬 - 👨🏽‍🔬 - 👩🏽‍🎨 - 🧑🏽‍🎨 - 👨🏽‍🎨 - 👩🏽‍🚒 - 🧑🏽‍🚒 - 👨🏽‍🚒 - 👩🏽‍✈️ - 🧑🏽‍✈️ - 👨🏽‍✈️ - 👩🏽‍🚀 - 🧑🏽‍🚀 - 👨🏽‍🚀 - 👩🏽‍⚖️ - 🧑🏽‍⚖️ - 👨🏽‍⚖️ - 👰🏽‍♀️ - 👰🏽 - 👰🏽‍♂️ - 🤵🏽‍♀️ - 🤵🏽 - 🤵🏽‍♂️ - 👸🏽 - 🫅🏽 - 🤴🏽 - 🥷🏽 - 🦸🏽‍♀️ - 🦸🏽 - 🦸🏽‍♂️ - 🦹🏽‍♀️ - 🦹🏽 - 🦹🏽‍♂️ - 🤶🏽 - 🧑🏽‍🎄 - 🎅🏽 - 🧙🏽‍♀️ - 🧙🏽 - 🧙🏽‍♂️ - 🧝🏽‍♀️ - 🧝🏽 - 🧝🏽‍♂️ - 🧛🏽‍♀️ - 🧛🏽 - 🧛🏽‍♂️ - 🧜🏽‍♀️ - 🧜🏽 - 🧜🏽‍♂️ - 🧚🏽‍♀️ - 🧚🏽 - 🧚🏽‍♂️ - 👼🏽 - 🤰🏽 - 🫄🏽 - 🫃🏽 - 🤱🏽 - 👩🏽‍🍼 - 🧑🏽‍🍼 - 👨🏽‍🍼 - 🙇🏽‍♀️ - 🙇🏽 - 🙇🏽‍♂️ - 💁🏽‍♀️ - 💁🏽 - 💁🏽‍♂️ - 🙅🏽‍♀️ - 🙅🏽 - 🙅🏽‍♂️ - 🙆🏽‍♀️ - 🙆🏽 - 🙆🏽‍♂️ - 🙋🏽‍♀️ - 🙋🏽 - 🙋🏽‍♂️ - 🧏🏽‍♀️ - 🧏🏽 - 🧏🏽‍♂️ - 🤦🏽‍♀️ - 🤦🏽 - 🤦🏽‍♂️ - 🤷🏽‍♀️ - 🤷🏽 - 🤷🏽‍♂️ - 🙎🏽‍♀️ - 🙎🏽 - 🙎🏽‍♂️ - 🙍🏽‍♀️ - 🙍🏽 - 🙍🏽‍♂️ - 💇🏽‍♀️ - 💇🏽 - 💇🏽‍♂️ - 💆🏽‍♀️ - 💆🏽 - 💆🏽‍♂️ - 🧖🏽‍♀️ - 🧖🏽 - 🧖🏽‍♂️ - 💃🏽 - 🕺🏽 - 🕴🏽 - 👩
Near-miss passage: Sigma rule: Identifies when a key vault is modified or deleted.. Logsource: azure / activitylogs. Rule: title: Azure Key Vault Modified or Deleted id: 459a2970-bb84-4e6a-a32e-ff0fbd99448d status: test description: Identifies when a key vault is modified or deleted. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations author: Austin Songer @austinsonger date: 2021-08-16 modified: 2022-08-23 tags: - attack.impact - attack.credential-access - attack.t1552 - attack.t1552.001 logsource: product: azure service: activitylogs detection: selection: operationName: - MICROSOFT.KEYVAULT/VAULTS/WRITE - MICROSOFT.KEYVAULT/VAULTS/DELETE - MICROSOFT.KEYVAULT/VAULTS/DEPLOY/ACTION - MICROSOFT.KEYVAULT/VAULTS/ACCESSPOLICIES/WRITE condition: selection falsepositives: - Key Vault being modified or deleted may be performed by a system administrator. - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Key Vault modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium