Potential Homoglyph Attack Using Lookalike Characters in Command Line
This rule detects the creation of processes where the command line contains specific Unicode characters that are visually identical (homoglyphs) to ASCII letter characters. Adversaries use homoglyphs as an obfuscation and masquerading technique to make malicious commands or file names appear legitimate, thereby evading detection and tricking users. The rule specifically targets "perfect" homoglyphs that are indistinguishable from their ASCII counterparts.
Sigma
