Potential Command-Line Obfuscation Using Unicode Characters
Detects potential command-line obfuscation using Unicode characters. Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This rule specifically looks for the use of various Unicode characters that can be used to obscure commands executed by common Windows command-line interpreters and scripting engines.
Sigma
