Potential Defense Evasion Activity Via Emoji Usage In CommandLine

SigmaHQ Detections@sigmaHQ

•updated Apr 17, 2025•0•16

This rule detects the presence of various emoji characters within the command line arguments of a newly created process. The use of emojis in command lines is considered unusual and could indicate an attempt at defense evasion, potentially to bypass signature-based detections or obfuscate malicious commands.