Query: alert when Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.
Matching passage: Sigma rule: Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.. Logsource: windows / process_creation. Rule: title: Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 3 id: f9578658-9e71-4711-b634-3f9b50cd3c06 status: test description: Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity. author: '@Kostastsale, TheDFIRReport' references: - Internal Research tags: - attack.stealth date: 2022-12-05 logsource: product: windows category: process_creation detection: selection: CommandLine|contains: - 🦆 - 🦅 - 🦉 - 🦇 - 🐺 - 🐗 - 🐴 - 🦄 - 🐝 - 🪱 - 🐛 - 🦋 - 🐌 - 🐞 - 🐜 - 🪰 - 🪲 - 🪳 - 🦟 - 🦗 - 🕷 - 🕸 - 🦂 - 🐢 - 🐍 - 🦎 - 🦖 - 🦕 - 🐙 - 🦑 - 🦐 - 🦞 - 🦀 - 🪸 - 🐡 - 🐠 - 🐟 - 🐬 - 🐳 - 🐋 - 🦈 - 🐊 - 🐅 - 🐆 - 🦓 - 🦍 - 🦧 - 🦣 - 🐘 - 🦛 - 🦏 - 🐪 - 🐫 - 🦒 - 🦘 - 🦬 - 🐃 - 🐂 - 🐄 - 🐎 - 🐖 - 🐏 - 🐑 - 🦙 - 🐐 - 🦌 - 🐕 - 🐩 - 🦮 - 🐕‍🦺 - 🐈 - 🐈‍⬛ - 🪶 - 🐓 - 🦃 - 🦤 - 🦚 - 🦜 - 🦢 - 🦩 - 🕊 - 🐇 - 🦝 - 🦨 - 🦡 - 🦫 - 🦦 - 🦥 - 🐁 - 🐀 - 🐿 - 🦔 - 🐾 - 🐉 - 🐲 - 🌵 - 🎄 - 🌲 - 🌳 - 🌴 - 🪹 - 🪺 - 🪵 - 🌱 - 🌿 - ☘️ - 🍀 - 🎍 - 🪴 - 🎋 - 🍃 - 🍂 - 🍁 - 🍄 - 🐚 - 🪨 - 🌾 - 💐 - 🌷 - 🪷 - 🌹 - 🥀 - 🌺 - 🌸 - 🌼 - 🌻 - 🌞 - 🌝 - 🌛 - 🌜 - 🌚 - 🌕 - 🌖 - 🌗 - 🌘 - 🌑 - 🌒 - 🌓 - 🌔 - 🌙 - 🌎 - 🌍 - 🌏 - 🪐 - 💫 - ⭐️ - 🌟 - ✨ - ⚡️ - ☄️ - 💥 - 🔥 - 🌪 - 🌈 - ☀️ - 🌤 - ⛅️ - 🌥 - ☁️ - 🌦 - 🌧 - ⛈ - 🌩 - 🌨 - ❄️ - ☃️ - ⛄️ - 🌬 - 💨 - 💧 - 💦 - 🫧 - ☔️ - ☂️ - 🌊 - 🌫🍏 - 🍎 - 🍐 - 🍊 - 🍋 - 🍌 - 🍉 - 🍇 - 🍓 - 🫐 - 🍈 - 🍒 - 🍑 - 🥭 - 🍍 - 🥥 - 🥝 - 🍅 - 🍆 - 🥑 - 🥦 - 🥬 - 🥒 - 🌶 - 🫑 - 🌽 - 🥕 - 🫒 - 🧄 - 🧅 - 🥔 - 🍠 - 🫘 - 🥐 - 🥯 - 🍞 - 🥖 - 🥨 - 🧀 - 🥚 - 🍳 - 🧈 - 🥞 - 🧇 - 🥓 - 🥩 - 🍗 - 🍖 - 🦴 - 🌭 - 🍔 - 🍟 - 🍕 - 🫓 - 🥪 - 🥙 - 🧆 - 🌮 - 🌯 - 🫔 - 🥗 - 🥘 - 🫕 - 🥫 - 🍝 - 🍜 - 🍲 - 🍛 - 🍣 - 🍱 - 🥟 - 🦪 - 🍤 - 🍙 - 🍚 - 🍘 - 🍥 - 🥠 - 🥮 - 🍢 - 🍡 - 🍧 - 🍨 - 🍦 - 🥧 - 🧁 - 🍰 - 🎂 - 🍮 - 🍭 - 🍬 - 🍫 - 🍿 - 🍩 - 🍪 - 🌰 - 🥜 - 🍯 - 🥛 - 🍼 - 🫖 - ☕️ - 🍵 - 🧃 - 🥤 - 🧋 - 🫙 - 🍶 - 🍺 - 🍻 - 🥂 - 🍷 - 🫗 - 🥃 - 🍸 - 🍹 - 🧉 - 🍾 - 🧊 - 🥄 - 🍴 - 🍽 - 🥣 - 🥡 - 🥢 - 🧂 - ⚽️ - 🏀 - 🏈 - ⚾️ - 🥎 - 🎾 - 🏐 - 🏉 - 🥏 - 🎱 - 🪀 - 🏓 - 🏸 - 🏒 - 🏑 - 🥍 - 🏏 - 🪃 - 🥅 - ⛳️ - 🪁 - 🏹 - 🎣 - 🤿 - 🥊 - 🥋 - 🎽 - 🛹 - 🛼 - 🛷 - ⛸ - 🥌 - 🎿 - ⛷ - 🏂 - 🪂 - 🏋️‍♀️ - 🏋️ - 🏋️‍♂️ - 🤼‍♀️ - 🤼 - 🤼‍♂️ - 🤸‍♀️ - 🤸 - 🤸‍♂️ - ⛹️‍♀️ - ⛹️ - ⛹️‍♂️ - 🤺 - 🤾‍♀️ - 🤾 - 🤾‍♂️ - 🏌️‍♀️ - 🏌️ - 🏌️‍♂️ - 🏇 - 🧘‍♀️ - 🧘 - 🧘‍♂️ - 🏄‍♀️ - 🏄 - 🏄‍♂️ - 🏊‍♀️ - 🏊 - 🏊‍♂️ - 🤽‍♀️ - 🤽 - 🤽‍♂️ - 🚣‍♀️ - 🚣 - 🚣‍♂️ - 🧗‍♀️ - 🧗 - 🧗‍♂️ - 🚵‍♀️ - 🚵 - 🚵‍♂️ - 🚴‍♀️ - 🚴 - 🚴‍♂️ - 🏆 - 🥇 - 🥈 - 🥉 - 🏅 - 🎖 - 🏵 - 🎗 - 🎫 - 🎟 - 🎪 - 🤹 - 🤹‍♂️ - 🤹‍♀️ - 🎭 - 🩰 - 🎨 - 🎬 - 🎤 - 🎧 - 🎼 - 🎹 - 🥁 - 🪘 - 🎷 - 🎺 - 🪗 - 🎸 - 🪕 - 🎻 - 🎲 - ♟ - 🎯 - 🎳 - 🎮 - 🎰 - 🧩 - 🚗 - 🚕 - 🚙 - 🚌 - 🚎 - 🏎 - 🚓 - 🚑 - 🚒 - 🚐 - 🛻 - 🚚 - 🚛 - 🚜 - 🦯 - 🦽 - 🦼 - 🛴 - 🚲 - 🛵 - 🏍 - 🛺 - 🚨 - 🚔 - 🚍 - 🚘 - 🚖 - 🛞 - 🚡 - 🚠 - 🚟 - 🚃 - 🚋 - 🚞 - 🚝 - 🚄 - 🚅 - 🚈 - 🚂 - 🚆 - 🚇 - 🚊 - 🚉 - ✈️ - 🛫 - 🛬 - 🛩 - 💺 - 🛰 - 🚀 - 🛸 - 🚁 - 🛶 - ⛵️ - 🚤 - 🛥 - 🛳 - ⛴ - 🚢 - ⚓️ - 🛟
Near-miss passage: Sigma rule: Detects external IP address lookups by non-browser processes via services such as "api.ipify.org". This could be indicat. Logsource: windows / network_connection. Rule: title: Suspicious Network Connection to IP Lookup Service APIs id: edf3485d-dac4-4d50-90e4-b0e5813f7e60 related: - id: ec82e2a5-81ea-4211-a1f8-37a0286df2c2 type: derived status: test description: Detects external IP address lookups by non-browser processes via services such as "api.ipify.org". This could be indicative of potential post compromise internet test activity. references: - https://github.com/rsp/scripts/blob/c8bb272d68164a9836e4f273d8f924927f39b8c6/externalip-benchmark.md - https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-302a - https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/ - https://www.trendmicro.com/en_us/research/23/e/managed-xdr-investigation-of-ducktail-in-trend-micro-vision-one.html author: Janantha Marasinghe, Nasreddine Bencherchali (Nextron Systems) date: 2023-04-24 modified: 2024-03-22 tags: - attack.discovery - attack.t1016 logsource: category: network_connection product: windows detection: selection: - DestinationHostname: - www.ip.cn - l2.io - DestinationHostname|contains: - api.2ip.ua - api.bigdatacloud.net - api.ipify.org - bot.whatismyipaddress.com - canireachthe.net - checkip.amazonaws.com - checkip.dyndns.org - curlmyip.com - db-ip.com - edns.ip-api.com - eth0.me - freegeoip.app - geoipy.com - getip.pro - icanhazip.com - ident.me - ifconfig.io - ifconfig.me - ip-api.com - ip.360.cn - ip.anysrc.net - ip.taobao.com - ip.tyk.nu - ipaddressworld.com - ipapi.co - ipconfig.io - ipecho.net - ipinfo.io - ipip.net - ipof.in - ipv4.icanhazip.com - ipv4bot.whatismyipaddress.com - ipv6-test.com - ipwho.is - jsonip.com - myexternalip.com - seeip.org - wgetip.com - whatismyip.akamai.com - whois.pconline.com.cn - wtfismyip.com filter_optional_brave: Image|endswith: \brave.exe filter_optional_chrome: Image: - C:\Program Files\Google\Chrome\Application\chrome.exe - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe filter_optional_firefox: Image: - C:\Program Files\Mozilla Firefox\firefox.exe - C:\Program Files (x86)\Mozilla Firefox\firefox.exe filter_optional_ie: Image: - C:\Program Files (x86)\Internet Explorer\iexplore.exe - C:\Program Files\Internet Explorer\iexplore.exe filter_optional_maxthon: Image|endswith: \maxthon.exe filter_optional_edge_1: - Image|startswith: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\ - Image|endswith: \WindowsApps\MicrosoftEdge.exe - Image: - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe - C:\Program Files\Mi