Sigma rule: Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 3

A detection rule from the SigmaHQ repository, shown as its author published it. Dataset version ref-22529eb4b9d2, updated 2022-12-05T00:00:00.000Z.

Rule

Title: Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 3
Status: test
Level: high
Author: @Kostastsale, TheDFIRReport
Date: 2022-12-05
File: rules/windows/process_creation/proc_creation_win_susp_emoji_usage_in_cli_3.yml
Commit: ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.

Log source

product: windows
category: process_creation

Detection

selection:
    CommandLine|contains:
        - '🦆'
        - '🦅'
        - '🦉'
        - '🦇'
        - '🐺'
        - '🐗'
        - '🐴'
        - '🦄'
        - '🐝'
        - '🪱'
        - '🐛'
        - '🦋'
        - '🐌'
        - '🐞'
        - '🐜'
        - '🪰'
        - '🪲'
        - '🪳'
        - '🦟'
        - '🦗'
        - '🕷'
        - '🕸'
        - '🦂'
        - '🐢'
        - '🐍'
        - '🦎'
        - '🦖'
        - '🦕'
        - '🐙'
        - '🦑'
        - '🦐'
        - '🦞'
        - '🦀'
        - '🪸'
        - '🐡'
        - '🐠'
        - '🐟'
        - '🐬'
        - '🐳'
        - '🐋'
        - '🦈'
        - '🐊'
        - '🐅'
        - '🐆'
        - '🦓'
        - '🦍'
        - '🦧'
        - '🦣'
        - '🐘'
        - '🦛'
        - '🦏'
        - '🐪'
        - '🐫'
        - '🦒'
        - '🦘'
        - '🦬'
        - '🐃'
        - '🐂'
        - '🐄'
        - '🐎'
        - '🐖'
        - '🐏'
        - '🐑'
        - '🦙'
        - '🐐'
        - '🦌'
        - '🐕'
        - '🐩'
        - '🦮'
        - '🐕‍🦺'
        - '🐈'
        - '🐈‍⬛'
        - '🪶'
        - '🐓'
        - '🦃'
        - '🦤'
        - '🦚'
        - '🦜'
        - '🦢'
        - '🦩'
        - '🕊'
        - '🐇'
        - '🦝'
        - '🦨'
        - '🦡'
        - '🦫'
        - '🦦'
        - '🦥'
        - '🐁'
        - '🐀'
        - '🐿'
        - '🦔'
        - '🐾'
        - '🐉'
        - '🐲'
        - '🌵'
        - '🎄'
        - '🌲'
        - '🌳'
        - '🌴'
        - '🪹'
        - '🪺'
        - '🪵'
        - '🌱'
        - '🌿'
        - '☘️'
        - '🍀'
        - '🎍'
        - '🪴'
        - '🎋'
        - '🍃'
        - '🍂'
        - '🍁'
        - '🍄'
        - '🐚'
        - '🪨'
        - '🌾'
        - '💐'
        - '🌷'
        - '🪷'
        - '🌹'
        - '🥀'
        - '🌺'
        - '🌸'
        - '🌼'
        - '🌻'
        - '🌞'
        - '🌝'
        - '🌛'
        - '🌜'
        - '🌚'
        - '🌕'
        - '🌖'
        - '🌗'
        - '🌘'
        - '🌑'
        - '🌒'
        - '🌓'
        - '🌔'
        - '🌙'
        - '🌎'
        - '🌍'
        - '🌏'
        - '🪐'
        - '💫'
        - '⭐️'
        - '🌟'
        - '✨'
        - '⚡️'
        - '☄️'
        - '💥'
        - '🔥'
        - '🌪'
        - '🌈'
        - '☀️'
        - '🌤'
        - '⛅️'
        - '🌥'
        - '☁️'
        - '🌦'
        - '🌧'
        - '⛈'
        - '🌩'
        - '🌨'
        - '❄️'
        - '☃️'
        - '⛄️'
        - '🌬'
        - '💨'
        - '💧'
        - '💦'
        - '🫧'
        - '☔️'
        - '☂️'
        - '🌊'
        - '🌫🍏'
        - '🍎'
        - '🍐'
        - '🍊'
        - '🍋'
        - '🍌'
        - '🍉'
        - '🍇'
        - '🍓'
        - '🫐'
        - '🍈'
        - '🍒'
        - '🍑'
        - '🥭'
        - '🍍'
        - '🥥'
        - '🥝'
        - '🍅'
        - '🍆'
        - '🥑'
        - '🥦'
        - '🥬'
        - '🥒'
        - '🌶'
        - '🫑'
        - '🌽'
        - '🥕'
        - '🫒'
        - '🧄'
        - '🧅'
        - '🥔'
        - '🍠'
        - '🫘'
        - '🥐'
        - '🥯'
        - '🍞'
        - '🥖'
        - '🥨'
        - '🧀'
        - '🥚'
        - '🍳'
        - '🧈'
        - '🥞'
        - '🧇'
        - '🥓'
        - '🥩'
        - '🍗'
        - '🍖'
        - '🦴'
        - '🌭'
        - '🍔'
        - '🍟'
        - '🍕'
        - '🫓'
        - '🥪'
        - '🥙'
        - '🧆'
        - '🌮'
        - '🌯'
        - '🫔'
        - '🥗'
        - '🥘'
        - '🫕'
        - '🥫'
        - '🍝'
        - '🍜'
        - '🍲'
        - '🍛'
        - '🍣'
        - '🍱'
        - '🥟'
        - '🦪'
        - '🍤'
        - '🍙'
        - '🍚'
        - '🍘'
        - '🍥'
        - '🥠'
        - '🥮'
        - '🍢'
        - '🍡'
        - '🍧'
        - '🍨'
        - '🍦'
        - '🥧'
        - '🧁'
        - '🍰'
        - '🎂'
        - '🍮'
        - '🍭'
        - '🍬'
        - '🍫'
        - '🍿'
        - '🍩'
        - '🍪'
        - '🌰'
        - '🥜'
        - '🍯'
        - '🥛'
        - '🍼'
        - '🫖'
        - '☕️'
        - '🍵'
        - '🧃'
        - '🥤'
        - '🧋'
        - '🫙'
        - '🍶'
        - '🍺'
        - '🍻'
        - '🥂'
        - '🍷'
        - '🫗'
        - '🥃'
        - '🍸'
        - '🍹'
        - '🧉'
        - '🍾'
        - '🧊'
        - '🥄'
        - '🍴'
        - '🍽'
        - '🥣'
        - '🥡'
        - '🥢'
        - '🧂'
        - '⚽️'
        - '🏀'
        - '🏈'
        - '⚾️'
        - '🥎'
        - '🎾'
        - '🏐'
        - '🏉'
        - '🥏'
        - '🎱'
        - '🪀'
        - '🏓'
        - '🏸'
        - '🏒'
        - '🏑'
        - '🥍'
        - '🏏'
        - '🪃'
        - '🥅'
        - '⛳️'
        - '🪁'
        - '🏹'
        - '🎣'
        - '🤿'
        - '🥊'
        - '🥋'
        - '🎽'
        - '🛹'
        - '🛼'
        - '🛷'
        - '⛸'
        - '🥌'
        - '🎿'
        - '⛷'
        - '🏂'
        - '🪂'
        - '🏋️‍♀️'
        - '🏋️'
        - '🏋️‍♂️'
        - '🤼‍♀️'
        - '🤼'
        - '🤼‍♂️'
        - '🤸‍♀️'
        - '🤸'
        - '🤸‍♂️'
        - '⛹️‍♀️'
        - '⛹️'
        - '⛹️‍♂️'
        - '🤺'
        - '🤾‍♀️'
        - '🤾'
        - '🤾‍♂️'
        - '🏌️‍♀️'
        - '🏌️'
        - '🏌️‍♂️'
        - '🏇'
        - '🧘‍♀️'
        - '🧘'
        - '🧘‍♂️'
        - '🏄‍♀️'
        - '🏄'
        - '🏄‍♂️'
        - '🏊‍♀️'
        - '🏊'
        - '🏊‍♂️'
        - '🤽‍♀️'
        - '🤽'
        - '🤽‍♂️'
        - '🚣‍♀️'
        - '🚣'
        - '🚣‍♂️'
        - '🧗‍♀️'
        - '🧗'
        - '🧗‍♂️'
        - '🚵‍♀️'
        - '🚵'
        - '🚵‍♂️'
        - '🚴‍♀️'
        - '🚴'
        - '🚴‍♂️'
        - '🏆'
        - '🥇'
        - '🥈'
        - '🥉'
        - '🏅'
        - '🎖'
        - '🏵'
        - '🎗'
        - '🎫'
        - '🎟'
        - '🎪'
        - '🤹'
        - '🤹‍♂️'
        - '🤹‍♀️'
        - '🎭'
        - '🩰'
        - '🎨'
        - '🎬'
        - '🎤'
        - '🎧'
        - '🎼'
        - '🎹'
        - '🥁'
        - '🪘'
        - '🎷'
        - '🎺'
        - '🪗'
        - '🎸'
        - '🪕'
        - '🎻'
        - '🎲'
        - '♟'
        - '🎯'
        - '🎳'
        - '🎮'
        - '🎰'
        - '🧩'
        - '🚗'
        - '🚕'
        - '🚙'
        - '🚌'
        - '🚎'
        - '🏎'
        - '🚓'
        - '🚑'
        - '🚒'
        - '🚐'
        - '🛻'
        - '🚚'
        - '🚛'
        - '🚜'
        - '🦯'
        - '🦽'
        - '🦼'
        - '🛴'
        - '🚲'
        - '🛵'
        - '🏍'
        - '🛺'
        - '🚨'
        - '🚔'
        - '🚍'
        - '🚘'
        - '🚖'
        - '🛞'
        - '🚡'
        - '🚠'
        - '🚟'
        - '🚃'
        - '🚋'
        - '🚞'
        - '🚝'
        - '🚄'
        - '🚅'
        - '🚈'
        - '🚂'
        - '🚆'
        - '🚇'
        - '🚊'
        - '🚉'
        - '✈️'
        - '🛫'
        - '🛬'
        - '🛩'
        - '💺'
        - '🛰'
        - '🚀'
        - '🛸'
        - '🚁'
        - '🛶'
        - '⛵️'
        - '🚤'
        - '🛥'
        - '🛳'
        - '⛴'
        - '🚢'
        - '⚓️'
        - '🛟'
        - '🪝'
        - '⛽️'
        - '🚧'
        - '🚦'
        - '🚥'
        - '🚏'
        - '🗺'
        - '🗿'
        - '🗽'
        - '🗼'
        - '🏰'
        - '🏯'
        - '🏟'
        - '🎡'
        - '🎢'
        - '🛝'
        - '🎠'
        - '⛲️'
        - '⛱'
        - '🏖'
        - '🏝'
        - '🏜'
        - '🌋'
        - '⛰'
        - '🏔'
        - '🗻'
        - '🏕'
        - '⛺️'
        - '🛖'
        - '🏠'
        - '🏡'
        - '🏘'
        - '🏚'
        - '🏗'
        - '🏭'
        - '🏢'
        - '🏬'
        - '🏣'
        - '🏤'
        - '🏥'
        - '🏦'
        - '🏨'
        - '🏪'
        - '🏫'
        - '🏩'
        - '💒'
        - '🏛'
        - '⛪️'
        - '🕌'
        - '🕍'
        - '🛕'
        - '🕋'
        - '⛩'
        - '🛤'
        - '🛣'
        - '🗾'
        - '🎑'
        - '🏞'
        - '🌅'
        - '🌄'
        - '🌠'
        - '🎇'
        - '🎆'
        - '🌇'
        - '🌆'
        - '🏙'
        - '🌃'
        - '🌌'
        - '🌉'
        - '🌁'
        - '⌚️'
        - '📱'
        - '📲'
        - '💻'
        - '⌨️'
        - '🖥'
        - '🖨'
        - '🖱'
        - '🖲'
        - '🕹'
        - '🗜'
        - '💽'
        - '💾'
        - '💿'
        - '📀'
        - '📼'
        - '📷'
        - '📸'
        - '📹'
        - '🎥'
        - '📽'
        - '🎞'
        - '📞'
        - '☎️'
        - '📟'
        - '📠'
        - '📺'
        - '📻'
        - '🎙'
        - '🎚'
        - '🎛'
        - '🧭'
        - '⏱'
        - '⏲'
        - '⏰'
        - '🕰'
        - '⌛️'
        - '⏳'
        - '📡'
        - '🔋'
        - '🪫'
        - '🔌'
        - '💡'
        - '🔦'
        - '🕯'
        - '🪔'
        - '🧯'
        - '🛢'
        - '💸'
        - '💵'
        - '💴'
        - '💶'
        - '💷'
        - '🪙'
        - '💰'
        - '💳'
        - '💎'
        - '⚖️'
        - '🪜'
        - '🧰'
        - '🪛'
        - '🔧'
        - '🔨'
        - '⚒'
        - '🛠'
        - '⛏'
        - '🪚'
        - '🔩'
        - '⚙️'
        - '🪤'
        - '🧱'
        - '⛓'
        - '🧲'
        - '🔫'
        - '💣'
        - '🧨'
        - '🪓'
        - '🔪'
        - '🗡'
        - '⚔️'
        - '🛡'
        - '🚬'
        - '⚰️'
        - '🪦'
        - '⚱️'
        - '🏺'
        - '🔮'
        - '📿'
        - '🧿'
        - '🪬'
        - '💈'
        - '⚗️'
        - '🔭'
        - '🔬'
        - '🕳'
        - '🩹'
        - '🩺'
        - '🩻'
        - '🩼'
        - '💊'
        - '💉'
        - '🩸'
        - '🧬'
        - '🦠'
        - '🧫'
        - '🧪'
        - '🌡'
        - '🧹'
        - '🪠'
        - '🧺'
        - '🧻'
        - '🚽'
        - '🚰'
        - '🚿'
        - '🛁'
        - '🛀'
        - '🧼'
        - '🪥'
        - '🪒'
        - '🧽'
        - '🪣'
        - '🧴'
        - '🛎'
        - '🔑'
        - '🗝'
        - '🚪'
        - '🪑'
        - '🛋'
        - '🛏'
        - '🛌'
        - '🧸'
        - '🪆'
        - '🖼'
        - '🪞'
        - '🪟'
        - '🛍'
        - '🛒'
        - '🎁'
        - '🎈'
        - '🎏'
        - '🎀'
        - '🪄'
        - '🪅'
        - '🎊'
        - '🎉'
        - '🪩'
        - '🎎'
        - '🏮'
        - '🎐'
        - '🧧'
        - '✉️'
        - '📩'
        - '📨'
        - '📧'
        - '💌'
        - '📥'
        - '📤'
        - '📦'
        - '🏷'
        - '🪧'
        - '📪'
        - '📫'
        - '📬'
        - '📭'
        - '📮'
        - '📯'
        - '📜'
        - '📃'
        - '📄'
        - '📑'
        - '🧾'
        - '📊'
        - '📈'
        - '📉'
        - '🗒'
        - '🗓'
        - '📆'
        - '📅'
        - '🗑'
        - '🪪'
        - '📇'
        - '🗃'
        - '🗳'
        - '🗄'
        - '📋'
        - '📁'
        - '📂'
        - '🗂'
        - '🗞'
        - '📰'
        - '📓'
        - '📔'
        - '📒'
        - '📕'
        - '📗'
        - '📘'
        - '📙'
        - '📚'
        - '📖'
        - '🔖'
        - '🧷'
        - '🔗'
        - '📎'
        - '🖇'
        - '📐'
        - '📏'
        - '🧮'
        - '📌'
        - '📍'
        - '✂️'
        - '🖊'
        - '🖋'
        - '✒️'
        - '🖌'
        - '🖍'
        - '📝'
        - '✏️'
        - '🔍'
        - '🔎'
        - '🔏'
        - '🔐'
        - '🔒'
        - '🔓❤️'
        - '🧡'
        - '💛'
        - '💚'
        - '💙'
        - '💜'
        - '🖤'
        - '🤍'
        - '🤎'
        - '❤️‍🔥'
        - '❤️‍🩹'
        - '💔'
        - '❣️'
        - '💕'
        - '💞'
        - '💓'
        - '💗'
        - '💖'
        - '💘'
        - '💝'
        - '💟'
        - '☮️'
        - '✝️'
        - '☪️'
        - '🕉'
        - '☸️'
        - '✡️'
        - '🔯'
        - '🕎'
        - '☯️'
        - '☦️'
        - '🛐'
        - '⛎'
        - '♈️'
        - '♉️'
        - '♊️'
        - '♋️'
        - '♌️'
        - '♍️'
        - '♎️'
        - '♏️'
        - '♐️'
        - '♑️'
        - '♒️'
        - '♓️'
        - '🆔'
        - '⚛️'
        - '🉑'
        - '☢️'
        - '☣️'
        - '📴'
        - '📳'
        - '🈶'
        - '🈚️'
        - '🈸'
        - '🈺'
        - '🈷️'
        - '✴️'
        - '🆚'
        - '💮'
        - '🉐'
        - '㊙️'
        - '㊗️'
        - '🈴'
        - '🈵'
        - '🈹'
        - '🈲'
        - '🅰️'
        - '🅱️'
        - '🆎'
        - '🆑'
        - '🅾️'
        - '🆘'
        - '❌'
        - '⭕️'
        - '🛑'
        - '⛔️'
        - '📛'
        - '🚫'
        - '💯'
        - '💢'
        - '♨️'
        - '🚷'
        - '🚯'
        - '🚳'
        - '🚱'
        - '🔞'
        - '📵'
        - '🚭'
        - '❗️'
        - '❕'
        - '❓'
        - '❔'
        - '‼️'
        - '⁉️'
        - '🔅'
        - '🔆'
        - '〽️'
        - '⚠️'
        - '🚸'
        - '🔱'
        - '⚜️'
        - '🔰'
        - '♻️'
        - '✅'
        - '🈯️'
        - '💹'
        - '❇️'
        - '✳️'
        - '❎'
        - '🌐'
        - '💠'
        - 'Ⓜ️'
        - '🌀'
        - '💤'
        - '🏧'
        - '🚾'
        - '♿️'
        - '🅿️'
        - '🛗'
        - '🈳'
        - '🈂️'
        - '🛂'
        - '🛃'
        - '🛄'
        - '🛅'
        - '🚹'
        - '🚺'
        - '🚼'
        - '⚧'
        - '🚻'
        - '🚮'
        - '🎦'
        - '📶'
        - '🈁'
        - '🔣'
        - 'ℹ️'
        - '🔤'
        - '🔡'
        - '🔠'
        - '🆖'
        - '🆗'
        - '🆙'
        - '🆒'
        - '🆕'
        - '🆓'
        - '0️⃣'
        - '1️⃣'
        - '2️⃣'
        - '3️⃣'
        - '4️⃣'
        - '5️⃣'
        - '6️⃣'
        - '7️⃣'
        - '8️⃣'
        - '9️⃣'
        - '🔟'
        - '🔢'
        - '#️⃣'
        - '*️⃣'
        - '⏏️'
        - '▶️'
        - '⏸'
        - '⏯'
        - '⏹'
        - '⏺'
        - '⏭'
        - '⏮'
        - '⏩'
        - '⏪'
        - '⏫'
        - '⏬'
        - '◀️'
        - '🔼'
        - '🔽'
        - '➡️'
        - '⬅️'
        - '⬆️'
        - '⬇️'
        - '↗️'
        - '↘️'
        - '↙️'
        - '↖️'
        - '↕️'
        - '↔️'
        - '↪️'
        - '↩️'
        - '⤴️'
        - '⤵️'
        - '🔀'
        - '🔁'
        - '🔂'
        - '🔄'
        - '🔃'
        - '🎵'
        - '🎶'
        - '➕'
        - '➖'
        - '➗'
        - '✖️'
        - '🟰'
        - '♾'
        - '💲'
        - '💱'
        - '™️'
        - '©️'
        - '®️'
        - '〰️'
        - '➰'
        - '➿'
        - '🔚'
        - '🔙'
        - '🔛'
        - '🔝'
        - '🔜'
        - '✔️'
        - '☑️'
        - '🔘'
        - '🔴'
        - '🟠'
        - '🟡'
        - '🟢'
        - '🔵'
        - '🟣'
        - '⚫️'
        - '⚪️'
        - '🟤'
        - '🔺'
        - '🔻'
condition: selection

False positives (as the rule lists them)

Unknown

References

Internal Research

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_susp_emoji_usage_in_cli_3.yml

Sources and licences

SigmaHQ
"Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 3" by @Kostastsale, TheDFIRReport (SigmaHQ). Rule: https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_susp_emoji_usage_in_cli_3.yml.
Licensed under the Detection Rule License (DRL) 1.1: https://github.com/SigmaHQ/Detection-Rule-License
Detection Rule License (DRL) 1.1

Cite this page

Dragons Eye Ransomware Tracker, "Sigma rule: Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 3",
entity page, dataset version ref-22529eb4b9d2, updated 2022-12-05T00:00:00.000Z,
https://ransomware-tracker.com/detections/sigma/f9578658-9e71-4711-b634-3f9b50cd3c06 (accessed 2026-11-03).
Underlying source: SigmaHQ rule f9578658-9e71-4711-b634-3f9b50cd3c06, commit ccbb0369507f796db0b0ae6854c8a2be471b9d84.

Pages change. The dataset version identifies the data, but no archive of old versions is kept, so this citation cannot be replayed later.