Hub configuration

Name: Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 1
Author: sigmahq

More info

1type: trigger

2name: sigmahq/proc_creation_win_susp_emoji_usage_in_cli_1

3description: |

4 Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.

5filter: |

6 (evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1') && (evt.Parsed.CommandLine contains '😀' || evt.Parsed.CommandLine contains '😃' || evt.Parsed.CommandLine contains '😄' || evt.Parsed.CommandLine contains '😁' || evt.Parsed.CommandLine contains '😆' || evt.Parsed.CommandLine contains '😅' || evt.Parsed.CommandLine contains '😂' || evt.Parsed.CommandLine contains '🤣' || evt.Parsed.CommandLine contains '🥲' || evt.Parsed.CommandLine contains '🥹' || evt.Parsed.CommandLine contains '☺️' || evt.Parsed.CommandLine contains '😊' || evt.Parsed.CommandLine contains '😇' || evt.Parsed.CommandLine contains '🙂' || evt.Parsed.CommandLine contains '🙃' || evt.Parsed.CommandLine contains '😉' || evt.Parsed.CommandLine contains '😌' || evt.Parsed.CommandLine contains '😍' || evt.Parsed.CommandLine contains '🥰' || evt.Parsed.CommandLine contains '😘' || evt.Parsed.CommandLine contains '😗' || evt.Parsed.CommandLine contains '😙' || evt.Parsed.CommandLine contains '😚' || evt.Parsed.CommandLine contains '😋' || evt.Parsed.CommandLine contains '😛' || evt.Parsed.CommandLine contains '😝' || evt.Parsed.CommandLine contains '😜' || evt.Parsed.CommandLine contains '🤪' || evt.Parsed.CommandLine contains '🤨' || evt.Parsed.CommandLine contains '🧐' || evt.Parsed.CommandLine contains '🤓' || evt.Parsed.CommandLine contains '😎' || evt.Parsed.CommandLine contains '🥸' || evt.Parsed.CommandLine contains '🤩' || evt.Parsed.CommandLine contains '🥳' || evt.Parsed.CommandLine contains '😏' || evt.Parsed.CommandLine contains '😒' || evt.Parsed.CommandLine contains '😞' || evt.Parsed.CommandLine contains '😔' || evt.Parsed.CommandLine contains '😟' || evt.Parsed.CommandLine contains '😕' || evt.Parsed.CommandLine contains '🙁' || evt.Parsed.CommandLine contains '☹️' || evt.Parsed.CommandLine contains '😣' || evt.Parsed.CommandLine contains '😖' || evt.Parsed.CommandLine contains '😫' || evt.Parsed.CommandLine contains '😩' || evt.Parsed.CommandLine contains '🥺' || evt.Parsed.CommandLine contains '😢' || evt.Parsed.CommandLine contains '😭' || evt.Parsed.CommandLine contains '😮‍💨' || evt.Parsed.CommandLine contains '😤' || evt.Parsed.CommandLine contains '😠' || evt.Parsed.CommandLine contains '😡' || evt.Parsed.CommandLine contains '🤬' || evt.Parsed.CommandLine contains '🤯' || evt.Parsed.CommandLine contains '😳' || evt.Parsed.CommandLine contains '🥵' || evt.Parsed.CommandLine contains '🥶' || evt.Parsed.CommandLine contains '😱' || evt.Parsed.CommandLine contains '😨' || evt.Parsed.CommandLine contains '😰' || evt.Parsed.CommandLine contains '😥' || evt.Parsed.CommandLine contains '😓' || evt.Parsed.CommandLine contains '🫣' || evt.Parsed.CommandLine contains '🤗' || evt.Parsed.CommandLine contains '🫡' || evt.Parsed.CommandLine contains '🤔' || evt.Parsed.CommandLine contains '🫢' || evt.Parsed.CommandLine contains '🤭' || evt.Parsed.CommandLine contains '🤫' || evt.Parsed.CommandLine contains '🤥' || evt.Parsed.CommandLine contains '😶' || evt.Parsed.CommandLine contains '😶‍🌫️' || evt.Parsed.CommandLine contains '😐' || evt.Parsed.CommandLine contains '😑' || evt.Parsed.CommandLine contains '😬' || evt.Parsed.CommandLine contains '🫠' || evt.Parsed.CommandLine contains '🙄' || evt.Parsed.CommandLine contains '😯' || evt.Parsed.CommandLine contains '😦' || evt.Parsed.CommandLine contains '😧' || evt.Parsed.CommandLine contains '😮' || evt.Parsed.CommandLine contains '😲' || evt.Parsed.CommandLine contains '🥱' || evt.Parsed.CommandLine contains '😴' || evt.Parsed.CommandLine contains '🤤' || evt.Parsed.CommandLine contains '😪' || evt.Parsed.CommandLine contains '😵' || evt.Parsed.CommandLine contains '😵‍💫' || evt.Parsed.CommandLine contains '🫥' || evt.Parsed.CommandLine contains '🤐' || evt.Parsed.CommandLine contains '🥴' || evt.Parsed.CommandLine contains '🤢' || evt.Parsed.CommandLine contains '🤮' || evt.Parsed.CommandLine contains '🤧' || evt.Parsed.CommandLine contains '😷' || evt.Parsed.CommandLine contains '🤒' || evt.Parsed.CommandLine contains '🤕' || evt.Parsed.CommandLine contains '🤑' || evt.Parsed.CommandLine contains '🤠' || evt.Parsed.CommandLine contains '😈' || evt.Parsed.CommandLine contains '👿' || evt.Parsed.CommandLine contains '👹' || evt.Parsed.CommandLine contains '👺' || evt.Parsed.CommandLine contains '🤡' || evt.Parsed.CommandLine contains '💩' || evt.Parsed.CommandLine contains '👻' || evt.Parsed.CommandLine contains '💀' || evt.Parsed.CommandLine contains '☠️' || evt.Parsed.CommandLine contains '👽' || evt.Parsed.CommandLine contains '👾' || evt.Parsed.CommandLine contains '🤖' || evt.Parsed.CommandLine contains '🎃' || evt.Parsed.CommandLine contains '😺' || evt.Parsed.CommandLine contains '😸' || evt.Parsed.CommandLine contains '😹' || evt.Parsed.CommandLine contains '😻' || evt.Parsed.CommandLine contains '😼' || evt.Parsed.CommandLine contains '😽' || evt.Parsed.CommandLine contains '🙀' || evt.Parsed.CommandLine contains '😿' || evt.Parsed.CommandLine contains '😾' || evt.Parsed.CommandLine contains '👋' || evt.Parsed.CommandLine contains '🤚' || evt.Parsed.CommandLine contains '🖐' || evt.Parsed.CommandLine contains '✋' || evt.Parsed.CommandLine contains '🖖' || evt.Parsed.CommandLine contains '👌' || evt.Parsed.CommandLine contains '🤌' || evt.Parsed.CommandLine contains '🤏' || evt.Parsed.CommandLine contains '✌️' || evt.Parsed.CommandLine contains '🤞' || evt.Parsed.CommandLine contains '🫰' || evt.Parsed.CommandLine contains '🤟' || evt.Parsed.CommandLine contains '🤘' || evt.Parsed.CommandLine contains '🤙' || evt.Parsed.CommandLine contains '🫵' || evt.Parsed.CommandLine contains '🫱' || evt.Parsed.CommandLine contains '🫲' || evt.Parsed.CommandLine contains '🫳' || evt.Parsed.CommandLine contains '🫴' || evt.Parsed.CommandLine contains '👈' || evt.Parsed.CommandLine contains '👉' || evt.Parsed.CommandLine contains '👆' || evt.Parsed.CommandLine contains '🖕' || evt.Parsed.CommandLine contains '👇' || evt.Parsed.CommandLine contains '☝️' || evt.Parsed.CommandLine contains '👍' || evt.Parsed.CommandLine contains '👎' || evt.Parsed.CommandLine contains '✊' || evt.Parsed.CommandLine contains '👊' || evt.Parsed.CommandLine contains '🤛' || evt.Parsed.CommandLine contains '🤜' || evt.Parsed.CommandLine contains '👏' || evt.Parsed.CommandLine contains '🫶' || evt.Parsed.CommandLine contains '🙌' || evt.Parsed.CommandLine contains '👐' || evt.Parsed.CommandLine contains '🤲' || evt.Parsed.CommandLine contains '🤝' || evt.Parsed.CommandLine contains '🙏' || evt.Parsed.CommandLine contains '✍️' || evt.Parsed.CommandLine contains '💪' || evt.Parsed.CommandLine contains '🦾' || evt.Parsed.CommandLine contains '🦵' || evt.Parsed.CommandLine contains '🦿' || evt.Parsed.CommandLine contains '🦶' || evt.Parsed.CommandLine contains '👣' || evt.Parsed.CommandLine contains '👂' || evt.Parsed.CommandLine contains '🦻' || evt.Parsed.CommandLine contains '👃' || evt.Parsed.CommandLine contains '🫀' || evt.Parsed.CommandLine contains '🫁' || evt.Parsed.CommandLine contains '🧠' || evt.Parsed.CommandLine contains '🦷' || evt.Parsed.CommandLine contains '🦴' || evt.Parsed.CommandLine contains '👀' || evt.Parsed.CommandLine contains '👁' || evt.Parsed.CommandLine contains '👅' || evt.Parsed.CommandLine contains '👄' || evt.Parsed.CommandLine contains '🫦' || evt.Parsed.CommandLine contains '💋' || evt.Parsed.CommandLine contains '🩸' || evt.Parsed.CommandLine contains '👶' || evt.Parsed.CommandLine contains '👧' || evt.Parsed.CommandLine contains '🧒' || evt.Parsed.CommandLine contains '👦' || evt.Parsed.CommandLine contains '👩' || evt.Parsed.CommandLine contains '🧑' || evt.Parsed.CommandLine contains '👨' || evt.Parsed.CommandLine contains '👩‍🦱' || evt.Parsed.CommandLine contains '🧑‍🦱' || evt.Parsed.CommandLine contains '👨‍🦱' || evt.Parsed.CommandLine contains '👩‍🦰' || evt.Parsed.CommandLine contains '🧑‍🦰' || evt.Parsed.CommandLine contains '👨‍🦰' || evt.Parsed.CommandLine contains '👱‍♀️' || evt.Parsed.CommandLine contains '👱' || evt.Parsed.CommandLine contains '👱‍♂️' || evt.Parsed.CommandLine contains '👩‍🦳' || evt.Parsed.CommandLine contains '🧑‍🦳' || evt.Parsed.CommandLine contains '👨‍🦳' || evt.Parsed.CommandLine contains '👩‍🦲' || evt.Parsed.CommandLine contains '🧑‍🦲' || evt.Parsed.CommandLine contains '👨‍🦲' || evt.Parsed.CommandLine contains '🧔‍♀️' || evt.Parsed.CommandLine contains '🧔' || evt.Parsed.CommandLine contains '🧔‍♂️' || evt.Parsed.CommandLine contains '👵' || evt.Parsed.CommandLine contains '🧓' || evt.Parsed.CommandLine contains '👴' || evt.Parsed.CommandLine contains '👲' || evt.Parsed.CommandLine contains '👳‍♀️' || evt.Parsed.CommandLine contains '👳' || evt.Parsed.CommandLine contains '👳‍♂️' || evt.Parsed.CommandLine contains '🧕' || evt.Parsed.CommandLine contains '👮‍♀️' || evt.Parsed.CommandLine contains '👮' || evt.Parsed.CommandLine contains '👮‍♂️' || evt.Parsed.CommandLine contains '👷‍♀️' || evt.Parsed.CommandLine contains '👷' || evt.Parsed.CommandLine contains '👷‍♂️' || evt.Parsed.CommandLine contains '💂‍♀️' || evt.Parsed.CommandLine contains '💂' || evt.Parsed.CommandLine contains '💂‍♂️' || evt.Parsed.CommandLine contains '🕵️‍♀️' || evt.Parsed.CommandLine contains '🕵️' || evt.Parsed.CommandLine contains '🕵️‍♂️' || evt.Parsed.CommandLine contains '👩‍⚕️' || evt.Parsed.CommandLine contains '🧑‍⚕️' || evt.Parsed.CommandLine contains '👨‍⚕️' || evt.Parsed.CommandLine contains '👩‍🌾' || evt.Parsed.CommandLine contains '🧑‍🌾' || evt.Parsed.CommandLine contains '👨‍🌾' || evt.Parsed.CommandLine contains '👩‍🍳' || evt.Parsed.CommandLine contains '🧑‍🍳' || evt.Parsed.CommandLine contains '👨‍🍳' || evt.Parsed.CommandLine contains '👩‍🎓' || evt.Parsed.CommandLine contains '🧑‍🎓' || evt.Parsed.CommandLine contains '👨‍🎓' || evt.Parsed.CommandLine contains '👩‍🎤' || evt.Parsed.CommandLine contains '🧑‍🎤' || evt.Parsed.CommandLine contains '👨‍🎤' || evt.Parsed.CommandLine contains '👩‍🏫' || evt.Parsed.CommandLine contains '🧑‍🏫' || evt.Parsed.CommandLine contains '👨‍🏫' || evt.Parsed.CommandLine contains '👩‍🏭' || evt.Parsed.CommandLine contains '🧑‍🏭' || evt.Parsed.CommandLine contains '👨‍🏭' || evt.Parsed.CommandLine contains '👩‍💻' || evt.Parsed.CommandLine contains '🧑‍💻' || evt.Parsed.CommandLine contains '👨‍💻' || evt.Parsed.CommandLine contains '👩‍💼' || evt.Parsed.CommandLine contains '🧑‍💼' || evt.Parsed.CommandLine contains '👨‍💼' || evt.Parsed.CommandLine contains '👩‍🔧' || evt.Parsed.CommandLine contains '🧑‍🔧' || evt.Parsed.CommandLine contains '👨‍🔧' || evt.Parsed.CommandLine contains '👩‍🔬' || evt.Parsed.CommandLine contains '🧑‍🔬' || evt.Parsed.CommandLine contains '👨‍🔬' || evt.Parsed.CommandLine contains '👩‍🎨' || evt.Parsed.CommandLine contains '🧑‍🎨' || evt.Parsed.CommandLine contains '👨‍🎨' || evt.Parsed.CommandLine contains '👩‍🚒' || evt.Parsed.CommandLine contains '🧑‍🚒' || evt.Parsed.CommandLine contains '👨‍🚒' || evt.Parsed.CommandLine contains '👩‍✈️' || evt.Parsed.CommandLine contains '🧑‍✈️' || evt.Parsed.CommandLine contains '👨‍✈️' || evt.Parsed.CommandLine contains '👩‍🚀' || evt.Parsed.CommandLine contains '🧑‍🚀' || evt.Parsed.CommandLine contains '👨‍🚀' || evt.Parsed.CommandLine contains '👩‍⚖️' || evt.Parsed.CommandLine contains '🧑‍⚖️' || evt.Parsed.CommandLine contains '👨‍⚖️' || evt.Parsed.CommandLine contains '👰‍♀️' || evt.Parsed.CommandLine contains '👰' || evt.Parsed.CommandLine contains '👰‍♂️' || evt.Parsed.CommandLine contains '🤵‍♀️' || evt.Parsed.CommandLine contains '🤵' || evt.Parsed.CommandLine contains '🤵‍♂️' || evt.Parsed.CommandLine contains '👸' || evt.Parsed.CommandLine contains '🫅' || evt.Parsed.CommandLine contains '🤴' || evt.Parsed.CommandLine contains '🥷' || evt.Parsed.CommandLine contains '🦸‍♀️' || evt.Parsed.CommandLine contains '🦸' || evt.Parsed.CommandLine contains '🦸‍♂️' || evt.Parsed.CommandLine contains '🦹‍♀️' || evt.Parsed.CommandLine contains '🦹' || evt.Parsed.CommandLine contains '🦹‍♂️' || evt.Parsed.CommandLine contains '🤶' || evt.Parsed.CommandLine contains '🧑‍🎄' || evt.Parsed.CommandLine contains '🎅' || evt.Parsed.CommandLine contains '🧙‍♀️' || evt.Parsed.CommandLine contains '🧙' || evt.Parsed.CommandLine contains '🧙‍♂️' || evt.Parsed.CommandLine contains '🧝‍♀️' || evt.Parsed.CommandLine contains '🧝' || evt.Parsed.CommandLine contains '🧝‍♂️' || evt.Parsed.CommandLine contains '🧛‍♀️' || evt.Parsed.CommandLine contains '🧛' || evt.Parsed.CommandLine contains '🧛‍♂️' || evt.Parsed.CommandLine contains '🧟‍♀️' || evt.Parsed.CommandLine contains '🧟' || evt.Parsed.CommandLine contains '🧟‍♂️' || evt.Parsed.CommandLine contains '🧞‍♀️' || evt.Parsed.CommandLine contains '🧞' || evt.Parsed.CommandLine contains '🧞‍♂️' || evt.Parsed.CommandLine contains '🧜‍♀️' || evt.Parsed.CommandLine contains '🧜' || evt.Parsed.CommandLine contains '🧜‍♂️' || evt.Parsed.CommandLine contains '🧚‍♀️' || evt.Parsed.CommandLine contains '🧚' || evt.Parsed.CommandLine contains '🧚‍♂️' || evt.Parsed.CommandLine contains '🧌' || evt.Parsed.CommandLine contains '👼' || evt.Parsed.CommandLine contains '🤰' || evt.Parsed.CommandLine contains '🫄' || evt.Parsed.CommandLine contains '🫃' || evt.Parsed.CommandLine contains '🤱' || evt.Parsed.CommandLine contains '👩‍🍼' || evt.Parsed.CommandLine contains '🧑‍🍼' || evt.Parsed.CommandLine contains '👨‍🍼' || evt.Parsed.CommandLine contains '🙇‍♀️' || evt.Parsed.CommandLine contains '🙇' || evt.Parsed.CommandLine contains '🙇‍♂️' || evt.Parsed.CommandLine contains '💁‍♀️' || evt.Parsed.CommandLine contains '💁' || evt.Parsed.CommandLine contains '💁‍♂️' || evt.Parsed.CommandLine contains '🙅‍♀️' || evt.Parsed.CommandLine contains '🙅' || evt.Parsed.CommandLine contains '🙅‍♂️' || evt.Parsed.CommandLine contains '🙆‍♀️' || evt.Parsed.CommandLine contains '🙆' || evt.Parsed.CommandLine contains '🙆‍♂️' || evt.Parsed.CommandLine contains '🙋‍♀️' || evt.Parsed.CommandLine contains '🙋' || evt.Parsed.CommandLine contains '🙋‍♂️' || evt.Parsed.CommandLine contains '🧏‍♀️' || evt.Parsed.CommandLine contains '🧏' || evt.Parsed.CommandLine contains '🧏‍♂️' || evt.Parsed.CommandLine contains '🤦‍♀️' || evt.Parsed.CommandLine contains '🤦' || evt.Parsed.CommandLine contains '🤦‍♂️' || evt.Parsed.CommandLine contains '🤷‍♀️' || evt.Parsed.CommandLine contains '🤷' || evt.Parsed.CommandLine contains '🤷‍♂️' || evt.Parsed.CommandLine contains '🙎‍♀️' || evt.Parsed.CommandLine contains '🙎' || evt.Parsed.CommandLine contains '🙎‍♂️' || evt.Parsed.CommandLine contains '🙍‍♀️' || evt.Parsed.CommandLine contains '🙍' || evt.Parsed.CommandLine contains '🙍‍♂️' || evt.Parsed.CommandLine contains '💇‍♀️' || evt.Parsed.CommandLine contains '💇' || evt.Parsed.CommandLine contains '💇‍♂️' || evt.Parsed.CommandLine contains '💆‍♀️' || evt.Parsed.CommandLine contains '💆' || evt.Parsed.CommandLine contains '💆‍♂️' || evt.Parsed.CommandLine contains '🧖‍♀️' || evt.Parsed.CommandLine contains '🧖' || evt.Parsed.CommandLine contains '🧖‍♂️' || evt.Parsed.CommandLine contains '💅' || evt.Parsed.CommandLine contains '💃' || evt.Parsed.CommandLine contains '🕺' || evt.Parsed.CommandLine contains '👯‍♀️' || evt.Parsed.CommandLine contains '👯' || evt.Parsed.CommandLine contains '👯‍♂️' || evt.Parsed.CommandLine contains '🕴' || evt.Parsed.CommandLine contains '👩‍🦽' || evt.Parsed.CommandLine contains '🧑‍🦽' || evt.Parsed.CommandLine contains '👨‍🦽' || evt.Parsed.CommandLine contains '👩‍🦼' || evt.Parsed.CommandLine contains '🧑‍🦼' || evt.Parsed.CommandLine contains '👨‍🦼' || evt.Parsed.CommandLine contains '🚶‍♀️' || evt.Parsed.CommandLine contains '🚶' || evt.Parsed.CommandLine contains '🚶‍♂️' || evt.Parsed.CommandLine contains '👩‍🦯' || evt.Parsed.CommandLine contains '🧑‍🦯' || evt.Parsed.CommandLine contains '👨‍🦯' || evt.Parsed.CommandLine contains '🧎‍♀️' || evt.Parsed.CommandLine contains '🧎' || evt.Parsed.CommandLine contains '🧎‍♂️' || evt.Parsed.CommandLine contains '🏃‍♀️' || evt.Parsed.CommandLine contains '🏃' || evt.Parsed.CommandLine contains '🏃‍♂️' || evt.Parsed.CommandLine contains '🧍‍♀️' || evt.Parsed.CommandLine contains '🧍' || evt.Parsed.CommandLine contains '🧍‍♂️' || evt.Parsed.CommandLine contains '👭' || evt.Parsed.CommandLine contains '🧑‍🤝‍🧑' || evt.Parsed.CommandLine contains '👬' || evt.Parsed.CommandLine contains '👫' || evt.Parsed.CommandLine contains '👩‍❤️‍👩' || evt.Parsed.CommandLine contains '💑' || evt.Parsed.CommandLine contains '👨‍❤️‍👨' || evt.Parsed.CommandLine contains '👩‍❤️‍👨' || evt.Parsed.CommandLine contains '👩‍❤️‍💋‍👩' || evt.Parsed.CommandLine contains '💏' || evt.Parsed.CommandLine contains '👨‍❤️‍💋‍👨' || evt.Parsed.CommandLine contains '👩‍❤️‍💋‍👨' || evt.Parsed.CommandLine contains '👪' || evt.Parsed.CommandLine contains '👨‍👩‍👦' || evt.Parsed.CommandLine contains '👨‍👩‍👧' || evt.Parsed.CommandLine contains '👨‍👩‍👧‍👦' || evt.Parsed.CommandLine contains '👨‍👩‍👦‍👦' || evt.Parsed.CommandLine contains '👨‍👩‍👧‍👧' || evt.Parsed.CommandLine contains '👨‍👨‍👦' || evt.Parsed.CommandLine contains '👨‍👨‍👧' || evt.Parsed.CommandLine contains '👨‍👨‍👧‍👦' || evt.Parsed.CommandLine contains '👨‍👨‍👦‍👦' || evt.Parsed.CommandLine contains '👨‍👨‍👧‍👧' || evt.Parsed.CommandLine contains '👩‍👩‍👦' || evt.Parsed.CommandLine contains '👩‍👩‍👧' || evt.Parsed.CommandLine contains '👩‍👩‍👧‍👦' || evt.Parsed.CommandLine contains '👩‍👩‍👦‍👦' || evt.Parsed.CommandLine contains '👩‍👩‍👧‍👧' || evt.Parsed.CommandLine contains '👨‍👦' || evt.Parsed.CommandLine contains '👨‍👦‍👦' || evt.Parsed.CommandLine contains '👨‍👧' || evt.Parsed.CommandLine contains '👨‍👧‍👦' || evt.Parsed.CommandLine contains '👨‍👧‍👧' || evt.Parsed.CommandLine contains '👩‍👦' || evt.Parsed.CommandLine contains '👩‍👦‍👦' || evt.Parsed.CommandLine contains '👩‍👧' || evt.Parsed.CommandLine contains '👩‍👧‍👦' || evt.Parsed.CommandLine contains '👩‍👧‍👧' || evt.Parsed.CommandLine contains '🗣' || evt.Parsed.CommandLine contains '👤' || evt.Parsed.CommandLine contains '👥' || evt.Parsed.CommandLine contains '🫂' || evt.Parsed.CommandLine contains '🧳' || evt.Parsed.CommandLine contains '🌂' || evt.Parsed.CommandLine contains '☂️' || evt.Parsed.CommandLine contains '🧵' || evt.Parsed.CommandLine contains '🪡' || evt.Parsed.CommandLine contains '🪢' || evt.Parsed.CommandLine contains '🧶' || evt.Parsed.CommandLine contains '👓' || evt.Parsed.CommandLine contains '🕶' || evt.Parsed.CommandLine contains '🥽' || evt.Parsed.CommandLine contains '🥼' || evt.Parsed.CommandLine contains '🦺' || evt.Parsed.CommandLine contains '👔' || evt.Parsed.CommandLine contains '👕' || evt.Parsed.CommandLine contains '👖' || evt.Parsed.CommandLine contains '🧣' || evt.Parsed.CommandLine contains '🧤' || evt.Parsed.CommandLine contains '🧥' || evt.Parsed.CommandLine contains '🧦' || evt.Parsed.CommandLine contains '👗' || evt.Parsed.CommandLine contains '👘' || evt.Parsed.CommandLine contains '🥻' || evt.Parsed.CommandLine contains '🩴' || evt.Parsed.CommandLine contains '🩱' || evt.Parsed.CommandLine contains '🩲' || evt.Parsed.CommandLine contains '🩳' || evt.Parsed.CommandLine contains '👙' || evt.Parsed.CommandLine contains '👚' || evt.Parsed.CommandLine contains '👛' || evt.Parsed.CommandLine contains '👜' || evt.Parsed.CommandLine contains '👝' || evt.Parsed.CommandLine contains '🎒' || evt.Parsed.CommandLine contains '👞' || evt.Parsed.CommandLine contains '👟' || evt.Parsed.CommandLine contains '🥾' || evt.Parsed.CommandLine contains '🥿' || evt.Parsed.CommandLine contains '👠' || evt.Parsed.CommandLine contains '👡' || evt.Parsed.CommandLine contains '🩰' || evt.Parsed.CommandLine contains '👢' || evt.Parsed.CommandLine contains '👑' || evt.Parsed.CommandLine contains '👒' || evt.Parsed.CommandLine contains '🎩' || evt.Parsed.CommandLine contains '🎓' || evt.Parsed.CommandLine contains '🧢' || evt.Parsed.CommandLine contains '⛑' || evt.Parsed.CommandLine contains '🪖' || evt.Parsed.CommandLine contains '💄' || evt.Parsed.CommandLine contains '💍' || evt.Parsed.CommandLine contains '💼' || evt.Parsed.CommandLine contains '👋🏻' || evt.Parsed.CommandLine contains '🤚🏻' || evt.Parsed.CommandLine contains '🖐🏻' || evt.Parsed.CommandLine contains '✋🏻' || evt.Parsed.CommandLine contains '🖖🏻' || evt.Parsed.CommandLine contains '👌🏻' || evt.Parsed.CommandLine contains '🤌🏻' || evt.Parsed.CommandLine contains '🤏🏻' || evt.Parsed.CommandLine contains '✌🏻' || evt.Parsed.CommandLine contains '🤞🏻' || evt.Parsed.CommandLine contains '🫰🏻' || evt.Parsed.CommandLine contains '🤟🏻' || evt.Parsed.CommandLine contains '🤘🏻' || evt.Parsed.CommandLine contains '🤙🏻' || evt.Parsed.CommandLine contains '🫵🏻' || evt.Parsed.CommandLine contains '🫱🏻' || evt.Parsed.CommandLine contains '🫲🏻' || evt.Parsed.CommandLine contains '🫳🏻' || evt.Parsed.CommandLine contains '🫴🏻' || evt.Parsed.CommandLine contains '👈🏻' || evt.Parsed.CommandLine contains '👉🏻' || evt.Parsed.CommandLine contains '👆🏻' || evt.Parsed.CommandLine contains '🖕🏻' || evt.Parsed.CommandLine contains '👇🏻' || evt.Parsed.CommandLine contains '☝🏻' || evt.Parsed.CommandLine contains '👍🏻' || evt.Parsed.CommandLine contains '👎🏻' || evt.Parsed.CommandLine contains '✊🏻' || evt.Parsed.CommandLine contains '👊🏻' || evt.Parsed.CommandLine contains '🤛🏻' || evt.Parsed.CommandLine contains '🤜🏻' || evt.Parsed.CommandLine contains '👏🏻' || evt.Parsed.CommandLine contains '🫶🏻' || evt.Parsed.CommandLine contains '🙌🏻' || evt.Parsed.CommandLine contains '👐🏻' || evt.Parsed.CommandLine contains '🤲🏻' || evt.Parsed.CommandLine contains '🙏🏻' || evt.Parsed.CommandLine contains '✍🏻' || evt.Parsed.CommandLine contains '💪🏻' || evt.Parsed.CommandLine contains '🦵🏻' || evt.Parsed.CommandLine contains '🦶🏻' || evt.Parsed.CommandLine contains '👂🏻' || evt.Parsed.CommandLine contains '🦻🏻' || evt.Parsed.CommandLine contains '👃🏻' || evt.Parsed.CommandLine contains '👶🏻' || evt.Parsed.CommandLine contains '👧🏻' || evt.Parsed.CommandLine contains '🧒🏻' || evt.Parsed.CommandLine contains '👦🏻' || evt.Parsed.CommandLine contains '👩🏻' || evt.Parsed.CommandLine contains '🧑🏻' || evt.Parsed.CommandLine contains '👨🏻' || evt.Parsed.CommandLine contains '👩🏻‍🦱' || evt.Parsed.CommandLine contains '🧑🏻‍🦱' || evt.Parsed.CommandLine contains '👨🏻‍🦱' || evt.Parsed.CommandLine contains '👩🏻‍🦰' || evt.Parsed.CommandLine contains '🧑🏻‍🦰' || evt.Parsed.CommandLine contains '👨🏻‍🦰' || evt.Parsed.CommandLine contains '👱🏻‍♀️' || evt.Parsed.CommandLine contains '👱🏻' || evt.Parsed.CommandLine contains '👱🏻‍♂️' || evt.Parsed.CommandLine contains '👩🏻‍🦳' || evt.Parsed.CommandLine contains '🧑🏻‍🦳' || evt.Parsed.CommandLine contains '👨🏻‍🦳' || evt.Parsed.CommandLine contains '👩🏻‍🦲' || evt.Parsed.CommandLine contains '🧑🏻‍🦲' || evt.Parsed.CommandLine contains '👨🏻‍🦲' || evt.Parsed.CommandLine contains '🧔🏻‍♀️' || evt.Parsed.CommandLine contains '🧔🏻' || evt.Parsed.CommandLine contains '🧔🏻‍♂️' || evt.Parsed.CommandLine contains '👵🏻' || evt.Parsed.CommandLine contains '🧓🏻' || evt.Parsed.CommandLine contains '👴🏻' || evt.Parsed.CommandLine contains '👲🏻' || evt.Parsed.CommandLine contains '👳🏻‍♀️' || evt.Parsed.CommandLine contains '👳🏻' || evt.Parsed.CommandLine contains '👳🏻‍♂️' || evt.Parsed.CommandLine contains '🧕🏻' || evt.Parsed.CommandLine contains '👮🏻‍♀️' || evt.Parsed.CommandLine contains '👮🏻' || evt.Parsed.CommandLine contains '👮🏻‍♂️' || evt.Parsed.CommandLine contains '👷🏻‍♀️' || evt.Parsed.CommandLine contains '👷🏻' || evt.Parsed.CommandLine contains '👷🏻‍♂️' || evt.Parsed.CommandLine contains '💂🏻‍♀️' || evt.Parsed.CommandLine contains '💂🏻' || evt.Parsed.CommandLine contains '💂🏻‍♂️' || evt.Parsed.CommandLine contains '🕵🏻‍♀️' || evt.Parsed.CommandLine contains '🕵🏻' || evt.Parsed.CommandLine contains '🕵🏻‍♂️' || evt.Parsed.CommandLine contains '👩🏻‍⚕️' || evt.Parsed.CommandLine contains '🧑🏻‍⚕️' || evt.Parsed.CommandLine contains '👨🏻‍⚕️' || evt.Parsed.CommandLine contains '👩🏻‍🌾' || evt.Parsed.CommandLine contains '🧑🏻‍🌾' || evt.Parsed.CommandLine contains '👨🏻‍🌾' || evt.Parsed.CommandLine contains '👩🏻‍🍳' || evt.Parsed.CommandLine contains '🧑🏻‍🍳' || evt.Parsed.CommandLine contains '👨🏻‍🍳' || evt.Parsed.CommandLine contains '👩🏻‍🎓' || evt.Parsed.CommandLine contains '🧑🏻‍🎓' || evt.Parsed.CommandLine contains '👨🏻‍🎓' || evt.Parsed.CommandLine contains '👩🏻‍🎤' || evt.Parsed.CommandLine contains '🧑🏻‍🎤' || evt.Parsed.CommandLine contains '👨🏻‍🎤' || evt.Parsed.CommandLine contains '👩🏻‍🏫' || evt.Parsed.CommandLine contains '🧑🏻‍🏫' || evt.Parsed.CommandLine contains '👨🏻‍🏫' || evt.Parsed.CommandLine contains '👩🏻‍🏭' || evt.Parsed.CommandLine contains '🧑🏻‍🏭' || evt.Parsed.CommandLine contains '👨🏻‍🏭' || evt.Parsed.CommandLine contains '👩🏻‍💻' || evt.Parsed.CommandLine contains '🧑🏻‍💻' || evt.Parsed.CommandLine contains '👨🏻‍💻' || evt.Parsed.CommandLine contains '👩🏻‍💼' || evt.Parsed.CommandLine contains '🧑🏻‍💼' || evt.Parsed.CommandLine contains '👨🏻‍💼' || evt.Parsed.CommandLine contains '👩🏻‍🔧' || evt.Parsed.CommandLine contains '🧑🏻‍🔧' || evt.Parsed.CommandLine contains '👨🏻‍🔧' || evt.Parsed.CommandLine contains '👩🏻‍🔬' || evt.Parsed.CommandLine contains '🧑🏻‍🔬' || evt.Parsed.CommandLine contains '👨🏻‍🔬' || evt.Parsed.CommandLine contains '👩🏻‍🎨' || evt.Parsed.CommandLine contains '🧑🏻‍🎨' || evt.Parsed.CommandLine contains '👨🏻‍🎨' || evt.Parsed.CommandLine contains '👩🏻‍🚒' || evt.Parsed.CommandLine contains '🧑🏻‍🚒' || evt.Parsed.CommandLine contains '👨🏻‍🚒' || evt.Parsed.CommandLine contains '👩🏻‍✈️' || evt.Parsed.CommandLine contains '🧑🏻‍✈️' || evt.Parsed.CommandLine contains '👨🏻‍✈️' || evt.Parsed.CommandLine contains '👩🏻‍🚀' || evt.Parsed.CommandLine contains '🧑🏻‍🚀' || evt.Parsed.CommandLine contains '👨🏻‍🚀' || evt.Parsed.CommandLine contains '👩🏻‍⚖️' || evt.Parsed.CommandLine contains '🧑🏻‍⚖️' || evt.Parsed.CommandLine contains '👨🏻‍⚖️' || evt.Parsed.CommandLine contains '👰🏻‍♀️' || evt.Parsed.CommandLine contains '👰🏻' || evt.Parsed.CommandLine contains '👰🏻‍♂️' || evt.Parsed.CommandLine contains '🤵🏻‍♀️' || evt.Parsed.CommandLine contains '🤵🏻' || evt.Parsed.CommandLine contains '🤵🏻‍♂️' || evt.Parsed.CommandLine contains '👸🏻' || evt.Parsed.CommandLine contains '🫅🏻' || evt.Parsed.CommandLine contains '🤴🏻' || evt.Parsed.CommandLine contains '🥷🏻' || evt.Parsed.CommandLine contains '🦸🏻‍♀️' || evt.Parsed.CommandLine contains '🦸🏻' || evt.Parsed.CommandLine contains '🦸🏻‍♂️' || evt.Parsed.CommandLine contains '🦹🏻‍♀️' || evt.Parsed.CommandLine contains '🦹🏻' || evt.Parsed.CommandLine contains '🦹🏻‍♂️' || evt.Parsed.CommandLine contains '🤶🏻' || evt.Parsed.CommandLine contains '🧑🏻‍🎄' || evt.Parsed.CommandLine contains '🎅🏻' || evt.Parsed.CommandLine contains '🧙🏻‍♀️' || evt.Parsed.CommandLine contains '🧙🏻' || evt.Parsed.CommandLine contains '🧙🏻‍♂️' || evt.Parsed.CommandLine contains '🧝🏻‍♀️' || evt.Parsed.CommandLine contains '🧝🏻' || evt.Parsed.CommandLine contains '🧝🏻‍♂️' || evt.Parsed.CommandLine contains '🧛🏻‍♀️' || evt.Parsed.CommandLine contains '🧛🏻' || evt.Parsed.CommandLine contains '🧛🏻‍♂️' || evt.Parsed.CommandLine contains '🧜🏻‍♀️' || evt.Parsed.CommandLine contains '🧜🏻' || evt.Parsed.CommandLine contains '🧜🏻‍♂️' || evt.Parsed.CommandLine contains '🧚🏻‍♀️' || evt.Parsed.CommandLine contains '🧚🏻' || evt.Parsed.CommandLine contains '🧚🏻‍♂️' || evt.Parsed.CommandLine contains '👼🏻' || evt.Parsed.CommandLine contains '🤰🏻' || evt.Parsed.CommandLine contains '🫄🏻' || evt.Parsed.CommandLine contains '🫃🏻' || evt.Parsed.CommandLine contains '🤱🏻' || evt.Parsed.CommandLine contains '👩🏻‍🍼' || evt.Parsed.CommandLine contains '🧑🏻‍🍼' || evt.Parsed.CommandLine contains '👨🏻‍🍼' || evt.Parsed.CommandLine contains '🙇🏻‍♀️' || evt.Parsed.CommandLine contains '🙇🏻' || evt.Parsed.CommandLine contains '🙇🏻‍♂️' || evt.Parsed.CommandLine contains '💁🏻‍♀️' || evt.Parsed.CommandLine contains '💁🏻' || evt.Parsed.CommandLine contains '💁🏻‍♂️' || evt.Parsed.CommandLine contains '🙅🏻‍♀️' || evt.Parsed.CommandLine contains '🙅🏻' || evt.Parsed.CommandLine contains '🙅🏻‍♂️' || evt.Parsed.CommandLine contains '🙆🏻‍♀️' || evt.Parsed.CommandLine contains '🙆🏻' || evt.Parsed.CommandLine contains '🙆🏻‍♂️' || evt.Parsed.CommandLine contains '🙋🏻‍♀️' || evt.Parsed.CommandLine contains '🙋🏻' || evt.Parsed.CommandLine contains '🙋🏻‍♂️' || evt.Parsed.CommandLine contains '🧏🏻‍♀️' || evt.Parsed.CommandLine contains '🧏🏻' || evt.Parsed.CommandLine contains '🧏🏻‍♂️' || evt.Parsed.CommandLine contains '🤦🏻‍♀️' || evt.Parsed.CommandLine contains '🤦🏻' || evt.Parsed.CommandLine contains '🤦🏻‍♂️' || evt.Parsed.CommandLine contains '🤷🏻‍♀️' || evt.Parsed.CommandLine contains '🤷🏻' || evt.Parsed.CommandLine contains '🤷🏻‍♂️' || evt.Parsed.CommandLine contains '🙎🏻‍♀️' || evt.Parsed.CommandLine contains '🙎🏻' || evt.Parsed.CommandLine contains '🙎🏻‍♂️' || evt.Parsed.CommandLine contains '🙍🏻‍♀️' || evt.Parsed.CommandLine contains '🙍🏻' || evt.Parsed.CommandLine contains '🙍🏻‍♂️' || evt.Parsed.CommandLine contains '💇🏻‍♀️' || evt.Parsed.CommandLine contains '💇🏻' || evt.Parsed.CommandLine contains '💇🏻‍♂️' || evt.Parsed.CommandLine contains '💆🏻‍♀️' || evt.Parsed.CommandLine contains '💆🏻' || evt.Parsed.CommandLine contains '💆🏻‍♂️' || evt.Parsed.CommandLine contains '🧖🏻‍♀️' || evt.Parsed.CommandLine contains '🧖🏻' || evt.Parsed.CommandLine contains '🧖🏻‍♂️' || evt.Parsed.CommandLine contains '💃🏻' || evt.Parsed.CommandLine contains '🕺🏻' || evt.Parsed.CommandLine contains '🕴🏻' || evt.Parsed.CommandLine contains '👩🏻‍🦽' || evt.Parsed.CommandLine contains '🧑🏻‍🦽' || evt.Parsed.CommandLine contains '👨🏻‍🦽' || evt.Parsed.CommandLine contains '👩🏻‍🦼' || evt.Parsed.CommandLine contains '🧑🏻‍🦼' || evt.Parsed.CommandLine contains '👨🏻‍🦼' || evt.Parsed.CommandLine contains '🚶🏻‍♀️' || evt.Parsed.CommandLine contains '🚶🏻' || evt.Parsed.CommandLine contains '🚶🏻‍♂️' || evt.Parsed.CommandLine contains '👩🏻‍🦯' || evt.Parsed.CommandLine contains '🧑🏻‍🦯' || evt.Parsed.CommandLine contains '👨🏻‍🦯' || evt.Parsed.CommandLine contains '🧎🏻‍♀️' || evt.Parsed.CommandLine contains '🧎🏻' || evt.Parsed.CommandLine contains '🧎🏻‍♂️' || evt.Parsed.CommandLine contains '🏃🏻‍♀️' || evt.Parsed.CommandLine contains '🏃🏻' || evt.Parsed.CommandLine contains '🏃🏻‍♂️' || evt.Parsed.CommandLine contains '🧍🏻‍♀️' || evt.Parsed.CommandLine contains '🧍🏻' || evt.Parsed.CommandLine contains '🧍🏻‍♂️' || evt.Parsed.CommandLine contains '👭🏻' || evt.Parsed.CommandLine contains '🧑🏻‍🤝‍🧑🏻' || evt.Parsed.CommandLine contains '👬🏻' || evt.Parsed.CommandLine contains '👫🏻' || evt.Parsed.CommandLine contains '🧗🏻‍♀️' || evt.Parsed.CommandLine contains '🧗🏻' || evt.Parsed.CommandLine contains '🧗🏻‍♂️' || evt.Parsed.CommandLine contains '🏇🏻' || evt.Parsed.CommandLine contains '🏂🏻' || evt.Parsed.CommandLine contains '🏌🏻‍♀️' || evt.Parsed.CommandLine contains '🏌🏻' || evt.Parsed.CommandLine contains '🏌🏻‍♂️' || evt.Parsed.CommandLine contains '🏄🏻‍♀️' || evt.Parsed.CommandLine contains '🏄🏻' || evt.Parsed.CommandLine contains '🏄🏻‍♂️' || evt.Parsed.CommandLine contains '🚣🏻‍♀️' || evt.Parsed.CommandLine contains '🚣🏻' || evt.Parsed.CommandLine contains '🚣🏻‍♂️' || evt.Parsed.CommandLine contains '🏊🏻‍♀️' || evt.Parsed.CommandLine contains '🏊🏻' || evt.Parsed.CommandLine contains '🏊🏻‍♂️' || evt.Parsed.CommandLine contains '⛹🏻‍♀️' || evt.Parsed.CommandLine contains '⛹🏻' || evt.Parsed.CommandLine contains '⛹🏻‍♂️' || evt.Parsed.CommandLine contains '🏋🏻‍♀️' || evt.Parsed.CommandLine contains '🏋🏻' || evt.Parsed.CommandLine contains '🏋🏻‍♂️' || evt.Parsed.CommandLine contains '🚴🏻‍♀️' || evt.Parsed.CommandLine contains '🚴🏻' || evt.Parsed.CommandLine contains '🚴🏻‍♂️' || evt.Parsed.CommandLine contains '🚵🏻‍♀️' || evt.Parsed.CommandLine contains '🚵🏻' || evt.Parsed.CommandLine contains '🚵🏻‍♂️' || evt.Parsed.CommandLine contains '🤸🏻‍♀️' || evt.Parsed.CommandLine contains '🤸🏻' || evt.Parsed.CommandLine contains '🤸🏻‍♂️' || evt.Parsed.CommandLine contains '🤽🏻‍♀️' || evt.Parsed.CommandLine contains '🤽🏻' || evt.Parsed.CommandLine contains '🤽🏻‍♂️' || evt.Parsed.CommandLine contains '🤾🏻‍♀️' || evt.Parsed.CommandLine contains '🤾🏻' || evt.Parsed.CommandLine contains '🤾🏻‍♂️' || evt.Parsed.CommandLine contains '🤹🏻‍♀️' || evt.Parsed.CommandLine contains '🤹🏻' || evt.Parsed.CommandLine contains '🤹🏻‍♂️' || evt.Parsed.CommandLine contains '🧘🏻‍♀️' || evt.Parsed.CommandLine contains '🧘🏻' || evt.Parsed.CommandLine contains '🧘🏻‍♂️' || evt.Parsed.CommandLine contains '🛀🏻' || evt.Parsed.CommandLine contains '🛌🏻' || evt.Parsed.CommandLine contains '👋🏼' || evt.Parsed.CommandLine contains '🤚🏼' || evt.Parsed.CommandLine contains '🖐🏼' || evt.Parsed.CommandLine contains '✋🏼' || evt.Parsed.CommandLine contains '🖖🏼' || evt.Parsed.CommandLine contains '👌🏼' || evt.Parsed.CommandLine contains '🤌🏼' || evt.Parsed.CommandLine contains '🤏🏼' || evt.Parsed.CommandLine contains '✌🏼' || evt.Parsed.CommandLine contains '🤞🏼' || evt.Parsed.CommandLine contains '🫰🏼' || evt.Parsed.CommandLine contains '🤟🏼' || evt.Parsed.CommandLine contains '🤘🏼' || evt.Parsed.CommandLine contains '🤙🏼' || evt.Parsed.CommandLine contains '🫵🏼' || evt.Parsed.CommandLine contains '🫱🏼' || evt.Parsed.CommandLine contains '🫲🏼' || evt.Parsed.CommandLine contains '🫳🏼' || evt.Parsed.CommandLine contains '🫴🏼' || evt.Parsed.CommandLine contains '👈🏼' || evt.Parsed.CommandLine contains '👉🏼' || evt.Parsed.CommandLine contains '👆🏼' || evt.Parsed.CommandLine contains '🖕🏼' || evt.Parsed.CommandLine contains '👇🏼' || evt.Parsed.CommandLine contains '☝🏼' || evt.Parsed.CommandLine contains '👍🏼' || evt.Parsed.CommandLine contains '👎🏼' || evt.Parsed.CommandLine contains '✊🏼' || evt.Parsed.CommandLine contains '👊🏼' || evt.Parsed.CommandLine contains '🤛🏼' || evt.Parsed.CommandLine contains '🤜🏼' || evt.Parsed.CommandLine contains '👏🏼' || evt.Parsed.CommandLine contains '🫶🏼' || evt.Parsed.CommandLine contains '🙌🏼' || evt.Parsed.CommandLine contains '👐🏼' || evt.Parsed.CommandLine contains '🤲🏼' || evt.Parsed.CommandLine contains '🙏🏼' || evt.Parsed.CommandLine contains '✍🏼' || evt.Parsed.CommandLine contains '💪🏼' || evt.Parsed.CommandLine contains '🦵🏼' || evt.Parsed.CommandLine contains '🦶🏼' || evt.Parsed.CommandLine contains '👂🏼' || evt.Parsed.CommandLine contains '🦻🏼' || evt.Parsed.CommandLine contains '👃🏼' || evt.Parsed.CommandLine contains '👶🏼' || evt.Parsed.CommandLine contains '👧🏼' || evt.Parsed.CommandLine contains '🧒🏼' || evt.Parsed.CommandLine contains '👦🏼' || evt.Parsed.CommandLine contains '👩🏼' || evt.Parsed.CommandLine contains '🧑🏼' || evt.Parsed.CommandLine contains '👨🏼' || evt.Parsed.CommandLine contains '👩🏼‍🦱' || evt.Parsed.CommandLine contains '🧑🏼‍🦱' || evt.Parsed.CommandLine contains '👨🏼‍🦱' || evt.Parsed.CommandLine contains '👩🏼‍🦰' || evt.Parsed.CommandLine contains '🧑🏼‍🦰' || evt.Parsed.CommandLine contains '👨🏼‍🦰' || evt.Parsed.CommandLine contains '👱🏼‍♀️' || evt.Parsed.CommandLine contains '👱🏼' || evt.Parsed.CommandLine contains '👱🏼‍♂️' || evt.Parsed.CommandLine contains '👩🏼‍🦳' || evt.Parsed.CommandLine contains '🧑🏼‍🦳' || evt.Parsed.CommandLine contains '👨🏼‍🦳' || evt.Parsed.CommandLine contains '👩🏼‍🦲' || evt.Parsed.CommandLine contains '🧑🏼‍🦲' || evt.Parsed.CommandLine contains '👨🏼‍🦲' || evt.Parsed.CommandLine contains '🧔🏼‍♀️' || evt.Parsed.CommandLine contains '🧔🏼' || evt.Parsed.CommandLine contains '🧔🏼‍♂️' || evt.Parsed.CommandLine contains '👵🏼' || evt.Parsed.CommandLine contains '🧓🏼' || evt.Parsed.CommandLine contains '👴🏼' || evt.Parsed.CommandLine contains '👲🏼' || evt.Parsed.CommandLine contains '👳🏼‍♀️' || evt.Parsed.CommandLine contains '👳🏼' || evt.Parsed.CommandLine contains '👳🏼‍♂️' || evt.Parsed.CommandLine contains '🧕🏼' || evt.Parsed.CommandLine contains '👮🏼‍♀️' || evt.Parsed.CommandLine contains '👮🏼' || evt.Parsed.CommandLine contains '👮🏼‍♂️' || evt.Parsed.CommandLine contains '👷🏼‍♀️' || evt.Parsed.CommandLine contains '👷🏼' || evt.Parsed.CommandLine contains '👷🏼‍♂️' || evt.Parsed.CommandLine contains '💂🏼‍♀️' || evt.Parsed.CommandLine contains '💂🏼' || evt.Parsed.CommandLine contains '💂🏼‍♂️' || evt.Parsed.CommandLine contains '🕵🏼‍♀️' || evt.Parsed.CommandLine contains '🕵🏼' || evt.Parsed.CommandLine contains '🕵🏼‍♂️' || evt.Parsed.CommandLine contains '👩🏼‍⚕️' || evt.Parsed.CommandLine contains '🧑🏼‍⚕️' || evt.Parsed.CommandLine contains '👨🏼‍⚕️' || evt.Parsed.CommandLine contains '👩🏼‍🌾' || evt.Parsed.CommandLine contains '🧑🏼‍🌾' || evt.Parsed.CommandLine contains '👨🏼‍🌾' || evt.Parsed.CommandLine contains '👩🏼‍🍳' || evt.Parsed.CommandLine contains '🧑🏼‍🍳' || evt.Parsed.CommandLine contains '👨🏼‍🍳' || evt.Parsed.CommandLine contains '👩🏼‍🎓' || evt.Parsed.CommandLine contains '🧑🏼‍🎓' || evt.Parsed.CommandLine contains '👨🏼‍🎓' || evt.Parsed.CommandLine contains '👩🏼‍🎤' || evt.Parsed.CommandLine contains '🧑🏼‍🎤' || evt.Parsed.CommandLine contains '👨🏼‍🎤' || evt.Parsed.CommandLine contains '👩🏼‍🏫' || evt.Parsed.CommandLine contains '🧑🏼‍🏫' || evt.Parsed.CommandLine contains '👨🏼‍🏫' || evt.Parsed.CommandLine contains '👩🏼‍🏭' || evt.Parsed.CommandLine contains '🧑🏼‍🏭' || evt.Parsed.CommandLine contains '👨🏼‍🏭' || evt.Parsed.CommandLine contains '👩🏼‍💻' || evt.Parsed.CommandLine contains '🧑🏼‍💻' || evt.Parsed.CommandLine contains '👨🏼‍💻' || evt.Parsed.CommandLine contains '👩🏼‍💼' || evt.Parsed.CommandLine contains '🧑🏼‍💼' || evt.Parsed.CommandLine contains '👨🏼‍💼' || evt.Parsed.CommandLine contains '👩🏼‍🔧' || evt.Parsed.CommandLine contains '🧑🏼‍🔧' || evt.Parsed.CommandLine contains '👨🏼‍🔧' || evt.Parsed.CommandLine contains '👩🏼‍🔬' || evt.Parsed.CommandLine contains '🧑🏼‍🔬' || evt.Parsed.CommandLine contains '👨🏼‍🔬' || evt.Parsed.CommandLine contains '👩🏼‍🎨' || evt.Parsed.CommandLine contains '🧑🏼‍🎨' || evt.Parsed.CommandLine contains '👨🏼‍🎨' || evt.Parsed.CommandLine contains '👩🏼‍🚒' || evt.Parsed.CommandLine contains '🧑🏼‍🚒' || evt.Parsed.CommandLine contains '👨🏼‍🚒' || evt.Parsed.CommandLine contains '👩🏼‍✈️' || evt.Parsed.CommandLine contains '🧑🏼‍✈️' || evt.Parsed.CommandLine contains '👨🏼‍✈️' || evt.Parsed.CommandLine contains '👩🏼‍🚀' || evt.Parsed.CommandLine contains '🧑🏼‍🚀' || evt.Parsed.CommandLine contains '👨🏼‍🚀' || evt.Parsed.CommandLine contains '👩🏼‍⚖️' || evt.Parsed.CommandLine contains '🧑🏼‍⚖️' || evt.Parsed.CommandLine contains '👨🏼‍⚖️' || evt.Parsed.CommandLine contains '👰🏼‍♀️' || evt.Parsed.CommandLine contains '👰🏼' || evt.Parsed.CommandLine contains '👰🏼‍♂️' || evt.Parsed.CommandLine contains '🤵🏼‍♀️' || evt.Parsed.CommandLine contains '🤵🏼' || evt.Parsed.CommandLine contains '🤵🏼‍♂️' || evt.Parsed.CommandLine contains '👸🏼' || evt.Parsed.CommandLine contains '🫅🏼' || evt.Parsed.CommandLine contains '🤴🏼' || evt.Parsed.CommandLine contains '🥷🏼' || evt.Parsed.CommandLine contains '🦸🏼‍♀️' || evt.Parsed.CommandLine contains '🦸🏼' || evt.Parsed.CommandLine contains '🦸🏼‍♂️' || evt.Parsed.CommandLine contains '🦹🏼‍♀️' || evt.Parsed.CommandLine contains '🦹🏼' || evt.Parsed.CommandLine contains '🦹🏼‍♂️' || evt.Parsed.CommandLine contains '🤶🏼' || evt.Parsed.CommandLine contains '🧑🏼‍🎄' || evt.Parsed.CommandLine contains '🎅🏼' || evt.Parsed.CommandLine contains '🧙🏼‍♀️' || evt.Parsed.CommandLine contains '🧙🏼' || evt.Parsed.CommandLine contains '🧙🏼‍♂️' || evt.Parsed.CommandLine contains '🧝🏼‍♀️' || evt.Parsed.CommandLine contains '🧝🏼' || evt.Parsed.CommandLine contains '🧝🏼‍♂️' || evt.Parsed.CommandLine contains '🧛🏼‍♀️' || evt.Parsed.CommandLine contains '🧛🏼' || evt.Parsed.CommandLine contains '🧛🏼‍♂️' || evt.Parsed.CommandLine contains '🧜🏼‍♀️' || evt.Parsed.CommandLine contains '🧜🏼' || evt.Parsed.CommandLine contains '🧜🏼‍♂️' || evt.Parsed.CommandLine contains '🧚🏼‍♀️' || evt.Parsed.CommandLine contains '🧚🏼' || evt.Parsed.CommandLine contains '🧚🏼‍♂️' || evt.Parsed.CommandLine contains '👼🏼' || evt.Parsed.CommandLine contains '🤰🏼' || evt.Parsed.CommandLine contains '🫄🏼' || evt.Parsed.CommandLine contains '🫃🏼' || evt.Parsed.CommandLine contains '🤱🏼' || evt.Parsed.CommandLine contains '👩🏼‍🍼' || evt.Parsed.CommandLine contains '🧑🏼‍🍼' || evt.Parsed.CommandLine contains '👨🏼‍🍼' || evt.Parsed.CommandLine contains '🙇🏼‍♀️' || evt.Parsed.CommandLine contains '🙇🏼' || evt.Parsed.CommandLine contains '🙇🏼‍♂️' || evt.Parsed.CommandLine contains '💁🏼‍♀️' || evt.Parsed.CommandLine contains '💁🏼' || evt.Parsed.CommandLine contains '💁🏼‍♂️' || evt.Parsed.CommandLine contains '🙅🏼‍♀️' || evt.Parsed.CommandLine contains '🙅🏼' || evt.Parsed.CommandLine contains '🙅🏼‍♂️' || evt.Parsed.CommandLine contains '🙆🏼‍♀️' || evt.Parsed.CommandLine contains '🙆🏼' || evt.Parsed.CommandLine contains '🙆🏼‍♂️' || evt.Parsed.CommandLine contains '🙋🏼‍♀️' || evt.Parsed.CommandLine contains '🙋🏼' || evt.Parsed.CommandLine contains '🙋🏼‍♂️' || evt.Parsed.CommandLine contains '🧏🏼‍♀️' || evt.Parsed.CommandLine contains '🧏🏼' || evt.Parsed.CommandLine contains '🧏🏼‍♂️' || evt.Parsed.CommandLine contains '🤦🏼‍♀️' || evt.Parsed.CommandLine contains '🤦🏼' || evt.Parsed.CommandLine contains '🤦🏼‍♂️' || evt.Parsed.CommandLine contains '🤷🏼‍♀️')

7blackhole: 2m

8#status: test

9labels:

10 service: windows

11 confidence: 1

12 spoofable: 0

13 classification:

15 label: "Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 1"

16 behavior : "windows:audit"

17 remediation: false

19scope:

20 type: ParentProcessId

21 expression: evt.Parsed.ParentProcessId

Hub configuration

« Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 1 »v0.2 by sigmahq / proc_creation_win_susp_emoji_usage_in_cli_1Attack scenariowindowsNot spoofableLow confidence

« Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 1 »
v0.2 by sigmahq / proc_creation_win_susp_emoji_usage_in_cli_1
Attack scenariowindowsNot spoofableLow confidence