Query: alert when Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.
Matching passage: Sigma rule: Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.. Logsource: windows / process_creation. Rule: title: Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 2 id: c98f2a0d-e1b8-4f76-90d3-359caf88d6b9 status: test description: Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity. author: '@Kostastsale, TheDFIRReport' references: - Internal Research tags: - attack.stealth date: 2022-12-05 logsource: product: windows category: process_creation detection: selection: CommandLine|contains: - 🤷🏼 - 🤷🏼‍♂️ - 🙎🏼‍♀️ - 🙎🏼 - 🙎🏼‍♂️ - 🙍🏼‍♀️ - 🙍🏼 - 🙍🏼‍♂️ - 💇🏼‍♀️ - 💇🏼 - 💇🏼‍♂️ - 💆🏼‍♀️ - 💆🏼 - 💆🏼‍♂️ - 🧖🏼‍♀️ - 🧖🏼 - 🧖🏼‍♂️ - 💃🏼 - 🕺🏼 - 🕴🏼 - 👩🏼‍🦽 - 🧑🏼‍🦽 - 👨🏼‍🦽 - 👩🏼‍🦼 - 🧑🏼‍🦼 - 👨🏼‍🦼 - 🚶🏼‍♀️ - 🚶🏼 - 🚶🏼‍♂️ - 👩🏼‍🦯 - 🧑🏼‍🦯 - 👨🏼‍🦯 - 🧎🏼‍♀️ - 🧎🏼 - 🧎🏼‍♂️ - 🏃🏼‍♀️ - 🏃🏼 - 🏃🏼‍♂️ - 🧍🏼‍♀️ - 🧍🏼 - 🧍🏼‍♂️ - 👭🏼 - 🧑🏼‍🤝‍🧑🏼 - 👬🏼 - 👫🏼 - 🧗🏼‍♀️ - 🧗🏼 - 🧗🏼‍♂️ - 🏇🏼 - 🏂🏼 - 🏌🏼‍♀️ - 🏌🏼 - 🏌🏼‍♂️ - 🏄🏼‍♀️ - 🏄🏼 - 🏄🏼‍♂️ - 🚣🏼‍♀️ - 🚣🏼 - 🚣🏼‍♂️ - 🏊🏼‍♀️ - 🏊🏼 - 🏊🏼‍♂️ - ⛹🏼‍♀️ - ⛹🏼 - ⛹🏼‍♂️ - 🏋🏼‍♀️ - 🏋🏼 - 🏋🏼‍♂️ - 🚴🏼‍♀️ - 🚴🏼 - 🚴🏼‍♂️ - 🚵🏼‍♀️ - 🚵🏼 - 🚵🏼‍♂️ - 🤸🏼‍♀️ - 🤸🏼 - 🤸🏼‍♂️ - 🤽🏼‍♀️ - 🤽🏼 - 🤽🏼‍♂️ - 🤾🏼‍♀️ - 🤾🏼 - 🤾🏼‍♂️ - 🤹🏼‍♀️ - 🤹🏼 - 🤹🏼‍♂️ - 🧘🏼‍♀️ - 🧘🏼 - 🧘🏼‍♂️ - 🛀🏼 - 🛌🏼 - 👋🏽 - 🤚🏽 - 🖐🏽 - ✋🏽 - 🖖🏽 - 👌🏽 - 🤌🏽 - 🤏🏽 - ✌🏽 - 🤞🏽 - 🫰🏽 - 🤟🏽 - 🤘🏽 - 🤙🏽 - 🫵🏽 - 🫱🏽 - 🫲🏽 - 🫳🏽 - 🫴🏽 - 👈🏽 - 👉🏽 - 👆🏽 - 🖕🏽 - 👇🏽 - ☝🏽 - 👍🏽 - 👎🏽 - ✊🏽 - 👊🏽 - 🤛🏽 - 🤜🏽 - 👏🏽 - 🫶🏽 - 🙌🏽 - 👐🏽 - 🤲🏽 - 🙏🏽 - ✍🏽 - 💪🏽 - 🦵🏽 - 🦶🏽 - 👂🏽 - 🦻🏽 - 👃🏽 - 👶🏽 - 👧🏽 - 🧒🏽 - 👦🏽 - 👩🏽 - 🧑🏽 - 👨🏽 - 👩🏽‍🦱 - 🧑🏽‍🦱 - 👨🏽‍🦱 - 👩🏽‍🦰 - 🧑🏽‍🦰 - 👨🏽‍🦰 - 👱🏽‍♀️ - 👱🏽 - 👱🏽‍♂️ - 👩🏽‍🦳 - 🧑🏽‍🦳 - 👨🏽‍🦳 - 👩🏽‍🦲 - 🧑🏽‍🦲 - 👨🏽‍🦲 - 🧔🏽‍♀️ - 🧔🏽 - 🧔🏽‍♂️ - 👵🏽 - 🧓🏽 - 👴🏽 - 👲🏽 - 👳🏽‍♀️ - 👳🏽 - 👳🏽‍♂️ - 🧕🏽 - 👮🏽‍♀️ - 👮🏽 - 👮🏽‍♂️ - 👷🏽‍♀️ - 👷🏽 - 👷🏽‍♂️ - 💂🏽‍♀️ - 💂🏽 - 💂🏽‍♂️ - 🕵🏽‍♀️ - 🕵🏽 - 🕵🏽‍♂️ - 👩🏽‍⚕️ - 🧑🏽‍⚕️ - 👨🏽‍⚕️ - 👩🏽‍🌾 - 🧑🏽‍🌾 - 👨🏽‍🌾 - 👩🏽‍🍳 - 🧑🏽‍🍳 - 👨🏽‍🍳 - 👩🏽‍🎓 - 🧑🏽‍🎓 - 👨🏽‍🎓 - 👩🏽‍🎤 - 🧑🏽‍🎤 - 👨🏽‍🎤 - 👩🏽‍🏫 - 🧑🏽‍🏫 - 👨🏽‍🏫 - 👩🏽‍🏭 - 🧑🏽‍🏭 - 👨🏽‍🏭 - 👩🏽‍💻 - 🧑🏽‍💻 - 👨🏽‍💻 - 👩🏽‍💼 - 🧑🏽‍💼 - 👨🏽‍💼 - 👩🏽‍🔧 - 🧑🏽‍🔧 - 👨🏽‍🔧 - 👩🏽‍🔬 - 🧑🏽‍🔬 - 👨🏽‍🔬 - 👩🏽‍🎨 - 🧑🏽‍🎨 - 👨🏽‍🎨 - 👩🏽‍🚒 - 🧑🏽‍🚒 - 👨🏽‍🚒 - 👩🏽‍✈️ - 🧑🏽‍✈️ - 👨🏽‍✈️ - 👩🏽‍🚀 - 🧑🏽‍🚀 - 👨🏽‍🚀 - 👩🏽‍⚖️ - 🧑🏽‍⚖️ - 👨🏽‍⚖️ - 👰🏽‍♀️ - 👰🏽 - 👰🏽‍♂️ - 🤵🏽‍♀️ - 🤵🏽 - 🤵🏽‍♂️ - 👸🏽 - 🫅🏽 - 🤴🏽 - 🥷🏽 - 🦸🏽‍♀️ - 🦸🏽 - 🦸🏽‍♂️ - 🦹🏽‍♀️ - 🦹🏽 - 🦹🏽‍♂️ - 🤶🏽 - 🧑🏽‍🎄 - 🎅🏽 - 🧙🏽‍♀️ - 🧙🏽 - 🧙🏽‍♂️ - 🧝🏽‍♀️ - 🧝🏽 - 🧝🏽‍♂️ - 🧛🏽‍♀️ - 🧛🏽 - 🧛🏽‍♂️ - 🧜🏽‍♀️ - 🧜🏽 - 🧜🏽‍♂️ - 🧚🏽‍♀️ - 🧚🏽 - 🧚🏽‍♂️ - 👼🏽 - 🤰🏽 - 🫄🏽 - 🫃🏽 - 🤱🏽 - 👩🏽‍🍼 - 🧑🏽‍🍼 - 👨🏽‍🍼 - 🙇🏽‍♀️ - 🙇🏽 - 🙇🏽‍♂️ - 💁🏽‍♀️ - 💁🏽 - 💁🏽‍♂️ - 🙅🏽‍♀️ - 🙅🏽 - 🙅🏽‍♂️ - 🙆🏽‍♀️ - 🙆🏽 - 🙆🏽‍♂️ - 🙋🏽‍♀️ - 🙋🏽 - 🙋🏽‍♂️ - 🧏🏽‍♀️ - 🧏🏽 - 🧏🏽‍♂️ - 🤦🏽‍♀️ - 🤦🏽 - 🤦🏽‍♂️ - 🤷🏽‍♀️ - 🤷🏽 - 🤷🏽‍♂️ - 🙎🏽‍♀️ - 🙎🏽 - 🙎🏽‍♂️ - 🙍🏽‍♀️ - 🙍🏽 - 🙍🏽‍♂️ - 💇🏽‍♀️ - 💇🏽 - 💇🏽‍♂️ - 💆🏽‍♀️ - 💆🏽 - 💆🏽‍♂️ - 🧖🏽‍♀️ - 🧖🏽 - 🧖🏽‍♂️ - 💃🏽 - 🕺🏽 - 🕴🏽 - 👩
Near-miss passage: Sigma rule: Detects when 'DllRegisterServer' is called in the commandline and the image is not rundll32. This could mean that the 'r. Logsource: windows / process_creation. Rule: title: Potential Renamed Rundll32 Execution id: 2569ed8c-1147-498a-9b8c-2ad3656b10ed related: - id: 0ba1da6d-b6ce-4366-828c-18826c9de23e type: derived status: test description: Detects when 'DllRegisterServer' is called in the commandline and the image is not rundll32. This could mean that the 'rundll32' utility has been renamed in order to avoid detection references: - https://twitter.com/swisscom_csirt/status/1331634525722521602?s=20 - https://app.any.run/tasks/f74c5157-8508-4ac6-9805-d63fe7b0d399/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-22 modified: 2023-02-03 tags: - attack.execution logsource: category: process_creation product: windows detection: selection: CommandLine|contains: DllRegisterServer filter: Image|endswith: \rundll32.exe condition: selection and not filter falsepositives: - Unlikely level: high