Query: Sigma rule for Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.
Matching passage: Sigma rule: Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.. Logsource: windows / process_creation. Rule: title: Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 3 id: f9578658-9e71-4711-b634-3f9b50cd3c06 status: test description: Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity. author: '@Kostastsale, TheDFIRReport' references: - Internal Research tags: - attack.stealth date: 2022-12-05 logsource: product: windows category: process_creation detection: selection: CommandLine|contains: - 🦆 - 🦅 - 🦉 - 🦇 - 🐺 - 🐗 - 🐴 - 🦄 - 🐝 - 🪱 - 🐛 - 🦋 - 🐌 - 🐞 - 🐜 - 🪰 - 🪲 - 🪳 - 🦟 - 🦗 - 🕷 - 🕸 - 🦂 - 🐢 - 🐍 - 🦎 - 🦖 - 🦕 - 🐙 - 🦑 - 🦐 - 🦞 - 🦀 - 🪸 - 🐡 - 🐠 - 🐟 - 🐬 - 🐳 - 🐋 - 🦈 - 🐊 - 🐅 - 🐆 - 🦓 - 🦍 - 🦧 - 🦣 - 🐘 - 🦛 - 🦏 - 🐪 - 🐫 - 🦒 - 🦘 - 🦬 - 🐃 - 🐂 - 🐄 - 🐎 - 🐖 - 🐏 - 🐑 - 🦙 - 🐐 - 🦌 - 🐕 - 🐩 - 🦮 - 🐕‍🦺 - 🐈 - 🐈‍⬛ - 🪶 - 🐓 - 🦃 - 🦤 - 🦚 - 🦜 - 🦢 - 🦩 - 🕊 - 🐇 - 🦝 - 🦨 - 🦡 - 🦫 - 🦦 - 🦥 - 🐁 - 🐀 - 🐿 - 🦔 - 🐾 - 🐉 - 🐲 - 🌵 - 🎄 - 🌲 - 🌳 - 🌴 - 🪹 - 🪺 - 🪵 - 🌱 - 🌿 - ☘️ - 🍀 - 🎍 - 🪴 - 🎋 - 🍃 - 🍂 - 🍁 - 🍄 - 🐚 - 🪨 - 🌾 - 💐 - 🌷 - 🪷 - 🌹 - 🥀 - 🌺 - 🌸 - 🌼 - 🌻 - 🌞 - 🌝 - 🌛 - 🌜 - 🌚 - 🌕 - 🌖 - 🌗 - 🌘 - 🌑 - 🌒 - 🌓 - 🌔 - 🌙 - 🌎 - 🌍 - 🌏 - 🪐 - 💫 - ⭐️ - 🌟 - ✨ - ⚡️ - ☄️ - 💥 - 🔥 - 🌪 - 🌈 - ☀️ - 🌤 - ⛅️ - 🌥 - ☁️ - 🌦 - 🌧 - ⛈ - 🌩 - 🌨 - ❄️ - ☃️ - ⛄️ - 🌬 - 💨 - 💧 - 💦 - 🫧 - ☔️ - ☂️ - 🌊 - 🌫🍏 - 🍎 - 🍐 - 🍊 - 🍋 - 🍌 - 🍉 - 🍇 - 🍓 - 🫐 - 🍈 - 🍒 - 🍑 - 🥭 - 🍍 - 🥥 - 🥝 - 🍅 - 🍆 - 🥑 - 🥦 - 🥬 - 🥒 - 🌶 - 🫑 - 🌽 - 🥕 - 🫒 - 🧄 - 🧅 - 🥔 - 🍠 - 🫘 - 🥐 - 🥯 - 🍞 - 🥖 - 🥨 - 🧀 - 🥚 - 🍳 - 🧈 - 🥞 - 🧇 - 🥓 - 🥩 - 🍗 - 🍖 - 🦴 - 🌭 - 🍔 - 🍟 - 🍕 - 🫓 - 🥪 - 🥙 - 🧆 - 🌮 - 🌯 - 🫔 - 🥗 - 🥘 - 🫕 - 🥫 - 🍝 - 🍜 - 🍲 - 🍛 - 🍣 - 🍱 - 🥟 - 🦪 - 🍤 - 🍙 - 🍚 - 🍘 - 🍥 - 🥠 - 🥮 - 🍢 - 🍡 - 🍧 - 🍨 - 🍦 - 🥧 - 🧁 - 🍰 - 🎂 - 🍮 - 🍭 - 🍬 - 🍫 - 🍿 - 🍩 - 🍪 - 🌰 - 🥜 - 🍯 - 🥛 - 🍼 - 🫖 - ☕️ - 🍵 - 🧃 - 🥤 - 🧋 - 🫙 - 🍶 - 🍺 - 🍻 - 🥂 - 🍷 - 🫗 - 🥃 - 🍸 - 🍹 - 🧉 - 🍾 - 🧊 - 🥄 - 🍴 - 🍽 - 🥣 - 🥡 - 🥢 - 🧂 - ⚽️ - 🏀 - 🏈 - ⚾️ - 🥎 - 🎾 - 🏐 - 🏉 - 🥏 - 🎱 - 🪀 - 🏓 - 🏸 - 🏒 - 🏑 - 🥍 - 🏏 - 🪃 - 🥅 - ⛳️ - 🪁 - 🏹 - 🎣 - 🤿 - 🥊 - 🥋 - 🎽 - 🛹 - 🛼 - 🛷 - ⛸ - 🥌 - 🎿 - ⛷ - 🏂 - 🪂 - 🏋️‍♀️ - 🏋️ - 🏋️‍♂️ - 🤼‍♀️ - 🤼 - 🤼‍♂️ - 🤸‍♀️ - 🤸 - 🤸‍♂️ - ⛹️‍♀️ - ⛹️ - ⛹️‍♂️ - 🤺 - 🤾‍♀️ - 🤾 - 🤾‍♂️ - 🏌️‍♀️ - 🏌️ - 🏌️‍♂️ - 🏇 - 🧘‍♀️ - 🧘 - 🧘‍♂️ - 🏄‍♀️ - 🏄 - 🏄‍♂️ - 🏊‍♀️ - 🏊 - 🏊‍♂️ - 🤽‍♀️ - 🤽 - 🤽‍♂️ - 🚣‍♀️ - 🚣 - 🚣‍♂️ - 🧗‍♀️ - 🧗 - 🧗‍♂️ - 🚵‍♀️ - 🚵 - 🚵‍♂️ - 🚴‍♀️ - 🚴 - 🚴‍♂️ - 🏆 - 🥇 - 🥈 - 🥉 - 🏅 - 🎖 - 🏵 - 🎗 - 🎫 - 🎟 - 🎪 - 🤹 - 🤹‍♂️ - 🤹‍♀️ - 🎭 - 🩰 - 🎨 - 🎬 - 🎤 - 🎧 - 🎼 - 🎹 - 🥁 - 🪘 - 🎷 - 🎺 - 🪗 - 🎸 - 🪕 - 🎻 - 🎲 - ♟ - 🎯 - 🎳 - 🎮 - 🎰 - 🧩 - 🚗 - 🚕 - 🚙 - 🚌 - 🚎 - 🏎 - 🚓 - 🚑 - 🚒 - 🚐 - 🛻 - 🚚 - 🚛 - 🚜 - 🦯 - 🦽 - 🦼 - 🛴 - 🚲 - 🛵 - 🏍 - 🛺 - 🚨 - 🚔 - 🚍 - 🚘 - 🚖 - 🛞 - 🚡 - 🚠 - 🚟 - 🚃 - 🚋 - 🚞 - 🚝 - 🚄 - 🚅 - 🚈 - 🚂 - 🚆 - 🚇 - 🚊 - 🚉 - ✈️ - 🛫 - 🛬 - 🛩 - 💺 - 🛰 - 🚀 - 🛸 - 🚁 - 🛶 - ⛵️ - 🚤 - 🛥 - 🛳 - ⛴ - 🚢 - ⚓️ - 🛟
Near-miss passage: Sigma rule: Detects sdiagnhost.exe calling a suspicious child process (e.g. used in exploits for Follina / CVE-2022-30190). Logsource: windows / process_creation. Rule: title: Sdiagnhost Calling Suspicious Child Process id: f3d39c45-de1a-4486-a687-ab126124f744 status: test description: Detects sdiagnhost.exe calling a suspicious child process (e.g. used in exploits for Follina / CVE-2022-30190) references: - https://twitter.com/nao_sec/status/1530196847679401984 - https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e - https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/ - https://app.any.run/tasks/f420d295-0457-4e9b-9b9e-6732be227583/ - https://app.any.run/tasks/c4117d9a-f463-461a-b90f-4cd258746798/ author: Nextron Systems, @Kostastsale date: 2022-06-01 modified: 2024-08-23 tags: - attack.stealth - attack.t1036 - attack.t1218 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \sdiagnhost.exe Image|endswith: - \powershell.exe - \pwsh.exe - \cmd.exe - \mshta.exe - \cscript.exe - \wscript.exe - \taskkill.exe - \regsvr32.exe - \rundll32.exe - \calc.exe filter_main_cmd_bits: Image|endswith: \cmd.exe CommandLine|contains: bits filter_main_powershell_noprofile: Image|endswith: \powershell.exe CommandLine|endswith: - -noprofile - - -noprofile condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high