Query: write Sigma for Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.
Matching passage: Sigma rule: Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.. Logsource: windows / process_creation. Rule: title: Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 4 id: 225274c4-8dd1-40db-9e09-71dff4f6fb3c status: test description: Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity. author: '@Kostastsale, TheDFIRReport' references: - Internal Research tags: - attack.stealth date: 2022-12-05 logsource: product: windows category: process_creation detection: selection: CommandLine|contains: - 🔸 - 🔹 - 🔶 - 🔷 - 🔳 - 🔲 - ▪️ - ▫️ - ◾️ - ◽️ - ◼️ - ◻️ - 🟥 - 🟧 - 🟨 - 🟩 - 🟦 - 🟪 - ⬛️ - ⬜️ - 🟫 - 🔈 - 🔇 - 🔉 - 🔊 - 🔔 - 🔕 - 📣 - 📢 - 👁‍🗨 - 💬 - 💭 - 🗯 - ♠️ - ♣️ - ♥️ - ♦️ - 🃏 - 🎴 - 🀄️ - 🕐 - 🕑 - 🕒 - 🕓 - 🕔 - 🕕 - 🕖 - 🕗 - 🕘 - 🕙 - 🕚 - 🕛 - 🕜 - 🕝 - 🕞 - 🕟 - 🕠 - 🕡 - 🕢 - 🕣 - 🕤 - 🕥 - 🕦 - 🕧✢ - ✣ - ✤ - ✥ - ✦ - ✧ - ★ - ☆ - ✯ - ✡︎ - ✩ - ✪ - ✫ - ✬ - ✭ - ✮ - ✶ - ✷ - ✵ - ✸ - ✹ - → - ⇒ - ⟹ - ⇨ - ⇾ - ➾ - ⇢ - ☛ - ☞ - ➔ - ➜ - ➙ - ➛ - ➝ - ➞ - ♠︎ - ♣︎ - ♥︎ - ♦︎ - ♤ - ♧ - ♡ - ♢ - ♚ - ♛ - ♜ - ♝ - ♞ - ♟ - ♔ - ♕ - ♖ - ♗ - ♘ - ♙ - ⚀ - ⚁ - ⚂ - ⚃ - ⚄ - ⚅ - 🂠 - ⚈ - ⚉ - ⚆ - ⚇ - 𓀀 - 𓀁 - 𓀂 - 𓀃 - 𓀄 - 𓀅 - 𓀆 - 𓀇 - 𓀈 - 𓀉 - 𓀊 - 𓀋 - 𓀌 - 𓀍 - 𓀎 - 𓀏 - 𓀐 - 𓀑 - 𓀒 - 𓀓 - 𓀔 - 𓀕 - 𓀖 - 𓀗 - 𓀘 - 𓀙 - 𓀚 - 𓀛 - 𓀜 - 𓀝🏳️ - 🏴 - 🏁 - 🚩 - 🏳️‍🌈 - 🏳️‍⚧️ - 🏴‍☠️ - 🇦🇫 - 🇦🇽 - 🇦🇱 - 🇩🇿 - 🇦🇸 - 🇦🇩 - 🇦🇴 - 🇦🇮 - 🇦🇶 - 🇦🇬 - 🇦🇷 - 🇦🇲 - 🇦🇼 - 🇦🇺 - 🇦🇹 - 🇦🇿 - 🇧🇸 - 🇧🇭 - 🇧🇩 - 🇧🇧 - 🇧🇾 - 🇧🇪 - 🇧🇿 - 🇧🇯 - 🇧🇲 - 🇧🇹 - 🇧🇴 - 🇧🇦 - 🇧🇼 - 🇧🇷 - 🇮🇴 - 🇻🇬 - 🇧🇳 - 🇧🇬 - 🇧🇫 - 🇧🇮 - 🇰🇭 - 🇨🇲 - 🇨🇦 - 🇮🇨 - 🇨🇻 - 🇧🇶 - 🇰🇾 - 🇨🇫 - 🇹🇩 - 🇨🇱 - 🇨🇳 - 🇨🇽 - 🇨🇨 - 🇨🇴 - 🇰🇲 - 🇨🇬 - 🇨🇩 - 🇨🇰 - 🇨🇷 - 🇨🇮 - 🇭🇷 - 🇨🇺 - 🇨🇼 - 🇨🇾 - 🇨🇿 - 🇩🇰 - 🇩🇯 - 🇩🇲 - 🇩🇴 - 🇪🇨 - 🇪🇬 - 🇸🇻 - 🇬🇶 - 🇪🇷 - 🇪🇪 - 🇪🇹 - 🇪🇺 - 🇫🇰 - 🇫🇴 - 🇫🇯 - 🇫🇮 - 🇫🇷 - 🇬🇫 - 🇵🇫 - 🇹🇫 - 🇬🇦 - 🇬🇲 - 🇬🇪 - 🇩🇪 - 🇬🇭 - 🇬🇮 - 🇬🇷 - 🇬🇱 - 🇬🇩 - 🇬🇵 - 🇬🇺 - 🇬🇹 - 🇬🇬 - 🇬🇳 - 🇬🇼 - 🇬🇾 - 🇭🇹 - 🇭🇳 - 🇭🇰 - 🇭🇺 - 🇮🇸 - 🇮🇳 - 🇮🇩 - 🇮🇷 - 🇮🇶 - 🇮🇪 - 🇮🇲 - 🇮🇱 - 🇮🇹 - 🇯🇲 - 🇯🇵 - 🎌 - 🇯🇪 - 🇯🇴 - 🇰🇿 - 🇰🇪 - 🇰🇮 - 🇽🇰 - 🇰🇼 - 🇰🇬 - 🇱🇦 - 🇱🇻 - 🇱🇧 - 🇱🇸 - 🇱🇷 - 🇱🇾 - 🇱🇮 - 🇱🇹 - 🇱🇺 - 🇲🇴 - 🇲🇰 - 🇲🇬 - 🇲🇼 - 🇲🇾 - 🇲🇻 - 🇲🇱 - 🇲🇹 - 🇲🇭 - 🇲🇶 - 🇲🇷 - 🇲🇺 - 🇾🇹 - 🇲🇽 - 🇫🇲 - 🇲🇩 - 🇲🇨 - 🇲🇳 - 🇲🇪 - 🇲🇸 - 🇲🇦 - 🇲🇿 - 🇲🇲 - 🇳🇦 - 🇳🇷 - 🇳🇵 - 🇳🇱 - 🇳🇨 - 🇳🇿 - 🇳🇮 - 🇳🇪 - 🇳🇬 - 🇳🇺 - 🇳🇫 - 🇰🇵 - 🇲🇵 - 🇳🇴 - 🇴🇲 - 🇵🇰 - 🇵🇼 - 🇵🇸 - 🇵🇦 - 🇵🇬 - 🇵🇾 - 🇵🇪 - 🇵🇭 - 🇵🇳 - 🇵🇱 - 🇵🇹 - 🇵🇷 - 🇶🇦 - 🇷🇪 - 🇷🇴 - 🇷🇺 - 🇷🇼 - 🇼🇸 - 🇸🇲 - 🇸🇦 - 🇸🇳 - 🇷🇸 - 🇸🇨 - 🇸🇱 - 🇸🇬 - 🇸🇽 - 🇸🇰 - 🇸🇮 - 🇬🇸 - 🇸🇧 - 🇸🇴 - 🇿🇦 - 🇰🇷 - 🇸🇸 - 🇪🇸 - 🇱🇰 - 🇧🇱 - 🇸🇭 - 🇰🇳 - 🇱🇨 - 🇵🇲 - 🇻🇨 - 🇸🇩 - 🇸🇷 - 🇸🇿 - 🇸🇪 - 🇨🇭 - 🇸🇾 - 🇹🇼 - 🇹🇯 - 🇹🇿 - 🇹🇭 - 🇹🇱 - 🇹🇬 - 🇹🇰 - 🇹🇴 - 🇹🇹 - 🇹🇳 - 🇹🇷 - 🇹🇲 - 🇹🇨 - 🇹🇻 - 🇻🇮 - 🇺🇬 - 🇺🇦 - 🇦🇪 - 🇬🇧 - 🏴󠁧󠁢󠁥󠁮󠁧󠁿 - 🏴󠁧󠁢󠁳󠁣󠁴󠁿 - 🏴󠁧󠁢󠁷󠁬󠁳󠁿 - 🇺🇳 - 🇺🇸 - 🇺🇾 - 🇺🇿 - 🇻🇺 - 🇻🇦 - 🇻🇪 - 🇻🇳 - 🇼🇫 - 🇪🇭 - 🇾🇪 - 🇿🇲 - 🇿🇼🫠 - 🫢 - 🫣 - 🫡 - 🫥 - 🫤 - 🥹 - 🫱 - 🫱🏻 - 🫱🏼 - 🫱🏽 - 🫱🏾 - 🫱🏿 - 🫲 - 🫲🏻 - 🫲🏼 - 🫲🏽
Near-miss passage: Sigma rule: Detects execution of the Add-In deployment cache updating utility (AddInutil.exe) from a non-standard directory.. Logsource: windows / process_creation. Rule: title: AddinUtil.EXE Execution From Uncommon Directory id: 6120ac2a-a34b-42c0-a9bd-1fb9f459f348 status: test description: Detects execution of the Add-In deployment cache updating utility (AddInutil.exe) from a non-standard directory. references: - https://www.blue-prints.blog/content/blog/posts/lolbin/addinutil-lolbas.html author: Michael McKinley (@McKinleyMike), Tony Latteri (@TheLatteri) date: 2023-09-18 modified: 2025-02-24 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \addinutil.exe - OriginalFileName: AddInUtil.exe filter_main_legit_location: Image|contains: - :\Windows\Microsoft.NET\Framework\ - :\Windows\Microsoft.NET\Framework64\ - :\Windows\Microsoft.NET\FrameworkArm\ - :\Windows\Microsoft.NET\FrameworkArm64\ - :\Windows\WinSxS\ condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium