Potential Defense Evasion via Emoji Usage in Command Line
This rule detects the presence of specific emoji characters within the command line arguments of a newly created process. The use of emojis in command lines is highly unusual and could indicate an attempt by an adversary to evade detection by security tools that may not be configured to parse or analyze non-standard characters, or to obfuscate malicious commands. The rule specifically targets a wide range of human-like and animal emojis with various skin tones.
Sigma
