Query: write Sigma for Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.
Matching passage: Sigma rule: Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.. Logsource: windows / process_creation. Rule: title: Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 1 id: 4a30ac0c-b9d6-4e01-b71a-5f851bbf4259 status: test description: Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity. author: '@Kostastsale, TheDFIRReport' references: - Internal Research tags: - attack.stealth date: 2022-12-05 logsource: product: windows category: process_creation detection: selection: CommandLine|contains: - 😀 - 😃 - 😄 - 😁 - 😆 - 😅 - 😂 - 🤣 - 🥲 - 🥹 - ☺️ - 😊 - 😇 - 🙂 - 🙃 - 😉 - 😌 - 😍 - 🥰 - 😘 - 😗 - 😙 - 😚 - 😋 - 😛 - 😝 - 😜 - 🤪 - 🤨 - 🧐 - 🤓 - 😎 - 🥸 - 🤩 - 🥳 - 😏 - 😒 - 😞 - 😔 - 😟 - 😕 - 🙁 - ☹️ - 😣 - 😖 - 😫 - 😩 - 🥺 - 😢 - 😭 - 😮‍💨 - 😤 - 😠 - 😡 - 🤬 - 🤯 - 😳 - 🥵 - 🥶 - 😱 - 😨 - 😰 - 😥 - 😓 - 🫣 - 🤗 - 🫡 - 🤔 - 🫢 - 🤭 - 🤫 - 🤥 - 😶 - 😶‍🌫️ - 😐 - 😑 - 😬 - 🫠 - 🙄 - 😯 - 😦 - 😧 - 😮 - 😲 - 🥱 - 😴 - 🤤 - 😪 - 😵 - 😵‍💫 - 🫥 - 🤐 - 🥴 - 🤢 - 🤮 - 🤧 - 😷 - 🤒 - 🤕 - 🤑 - 🤠 - 😈 - 👿 - 👹 - 👺 - 🤡 - 💩 - 👻 - 💀 - ☠️ - 👽 - 👾 - 🤖 - 🎃 - 😺 - 😸 - 😹 - 😻 - 😼 - 😽 - 🙀 - 😿 - 😾 - 👋 - 🤚 - 🖐 - ✋ - 🖖 - 👌 - 🤌 - 🤏 - ✌️ - 🤞 - 🫰 - 🤟 - 🤘 - 🤙 - 🫵 - 🫱 - 🫲 - 🫳 - 🫴 - 👈 - 👉 - 👆 - 🖕 - 👇 - ☝️ - 👍 - 👎 - ✊ - 👊 - 🤛 - 🤜 - 👏 - 🫶 - 🙌 - 👐 - 🤲 - 🤝 - 🙏 - ✍️ - 💪 - 🦾 - 🦵 - 🦿 - 🦶 - 👣 - 👂 - 🦻 - 👃 - 🫀 - 🫁 - 🧠 - 🦷 - 🦴 - 👀 - 👁 - 👅 - 👄 - 🫦 - 💋 - 🩸 - 👶 - 👧 - 🧒 - 👦 - 👩 - 🧑 - 👨 - 👩‍🦱 - 🧑‍🦱 - 👨‍🦱 - 👩‍🦰 - 🧑‍🦰 - 👨‍🦰 - 👱‍♀️ - 👱 - 👱‍♂️ - 👩‍🦳 - 🧑‍🦳 - 👨‍🦳 - 👩‍🦲 - 🧑‍🦲 - 👨‍🦲 - 🧔‍♀️ - 🧔 - 🧔‍♂️ - 👵 - 🧓 - 👴 - 👲 - 👳‍♀️ - 👳 - 👳‍♂️ - 🧕 - 👮‍♀️ - 👮 - 👮‍♂️ - 👷‍♀️ - 👷 - 👷‍♂️ - 💂‍♀️ - 💂 - 💂‍♂️ - 🕵️‍♀️ - 🕵️ - 🕵️‍♂️ - 👩‍⚕️ - 🧑‍⚕️ - 👨‍⚕️ - 👩‍🌾 - 🧑‍🌾 - 👨‍🌾 - 👩‍🍳 - 🧑‍🍳 - 👨‍🍳 - 👩‍🎓 - 🧑‍🎓 - 👨‍🎓 - 👩‍🎤 - 🧑‍🎤 - 👨‍🎤 - 👩‍🏫 - 🧑‍🏫 - 👨‍🏫 - 👩‍🏭 - 🧑‍🏭 - 👨‍🏭 - 👩‍💻 - 🧑‍💻 - 👨‍💻 - 👩‍💼 - 🧑‍💼 - 👨‍💼 - 👩‍🔧 - 🧑‍🔧 - 👨‍🔧 - 👩‍🔬 - 🧑‍🔬 - 👨‍🔬 - 👩‍🎨 - 🧑‍🎨 - 👨‍🎨 - 👩‍🚒 - 🧑‍🚒 - 👨‍🚒 - 👩‍✈️ - 🧑‍✈️ - 👨‍✈️ - 👩‍🚀 - 🧑‍🚀 - 👨‍🚀 - 👩‍⚖️ - 🧑‍⚖️ - 👨‍⚖️ - 👰‍♀️ - 👰 - 👰‍♂️ - 🤵‍♀️ - 🤵 - 🤵‍♂️ - 👸 - 🫅 - 🤴 - 🥷 - 🦸‍♀️ - 🦸 - 🦸‍♂️ - 🦹‍♀️ - 🦹 - 🦹‍♂️ - 🤶 - 🧑‍🎄 - 🎅 - 🧙‍♀️ - 🧙 - 🧙‍♂️ - 🧝‍♀️ - 🧝 - 🧝‍♂️ - 🧛‍♀️ - 🧛 - 🧛‍♂️ - 🧟‍♀️ - 🧟 - 🧟‍♂️ - 🧞‍♀️ - 🧞 - 🧞‍♂️ - 🧜‍♀️ - 🧜 - 🧜‍♂️ - 🧚‍♀️ - 🧚 - 🧚‍♂️ - 🧌 - 👼 - 🤰 - 🫄 - 🫃 - 🤱 - 👩‍🍼 - 🧑‍🍼 - 👨‍🍼 - 🙇‍♀️ - 🙇 - 🙇‍♂️ - 💁‍♀️ - 💁 - 💁‍♂️ - 🙅‍♀️ - 🙅 - 🙅‍♂️ - 🙆‍♀️ - 🙆 - 🙆‍♂️ - 🙋‍♀️ - 🙋 - 🙋‍♂️ - 🧏‍♀️ - 🧏 - 🧏‍♂️ - 🤦‍♀️ - 🤦 - 🤦‍♂️ - 🤷‍♀️ - 🤷 - 🤷‍♂️ - 🙎‍♀️ - 🙎 - 🙎‍♂️ - 🙍‍♀️ - 🙍 - 🙍‍♂️ - 💇‍♀️ - 💇 - 💇‍♂️ - 💆‍♀️ - 💆 - 💆‍♂️ - 🧖‍♀️ - 🧖 - 🧖‍♂️ - 💅 - 💃 - 🕺 - 👯‍♀️ - 👯 - 👯‍♂️ - 🕴 - 👩‍🦽 - 🧑‍🦽 - 👨‍🦽 - 👩‍🦼 - 🧑‍🦼 - 👨‍🦼 - 🚶‍♀️ - 🚶 - 🚶‍♂️ - 👩‍🦯 - 🧑‍🦯 - 👨‍🦯 - 🧎‍♀️ - 🧎 - 🧎‍♂️ - 🏃‍♀️ - 🏃 - 🏃‍♂️ - 🧍‍♀️ - 🧍 - 🧍‍♂️ - 👭 - 🧑‍🤝‍🧑 - 👬 - 👫 - 👩‍❤️‍👩 - 💑 - 👨‍❤️‍👨 - 👩‍❤️‍👨 - 👩‍❤️‍💋‍👩 - 💏 - 👨‍❤️‍💋‍👨 - 👩‍❤️
Near-miss passage: Sigma rule: Detects potential credential dumping via Windows Error Reporting LSASS Shtinkering technique which uses the Windows Erro. Logsource: windows / process_creation. Rule: title: Potential Credential Dumping Via WER id: 9a4ccd1a-3526-4d99-b980-9f9c5d3a6ff3 status: test description: Detects potential credential dumping via Windows Error Reporting LSASS Shtinkering technique which uses the Windows Error Reporting to dump lsass references: - https://github.com/deepinstinct/Lsass-Shtinkering - https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Asaf%20Gilboa%20-%20LSASS%20Shtinkering%20Abusing%20Windows%20Error%20Reporting%20to%20Dump%20LSASS.pdf author: '@pbssubhash , Nasreddine Bencherchali' date: 2022-12-08 modified: 2022-12-09 tags: - attack.credential-access - attack.t1003.001 logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \Werfault.exe - OriginalFileName: WerFault.exe selection_cli: ParentUser|contains: - AUTHORI - AUTORI User|contains: - AUTHORI - AUTORI CommandLine|contains|all: - ' -u -p ' - ' -ip ' - ' -s ' filter_lsass: ParentImage: C:\Windows\System32\lsass.exe condition: all of selection_* and not 1 of filter_* falsepositives: - Windows Error Reporting might produce similar behavior. In that case, check the PID associated with the "-p" parameter in the CommandLine. level: high