Hub configuration

Name: Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 2
Author: sigmahq

More info

1type: trigger

2name: sigmahq/proc_creation_win_susp_emoji_usage_in_cli_2

3description: |

4 Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.

5filter: |

6 (evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1') && (evt.Parsed.CommandLine contains '🤷🏼' || evt.Parsed.CommandLine contains '🤷🏼‍♂️' || evt.Parsed.CommandLine contains '🙎🏼‍♀️' || evt.Parsed.CommandLine contains '🙎🏼' || evt.Parsed.CommandLine contains '🙎🏼‍♂️' || evt.Parsed.CommandLine contains '🙍🏼‍♀️' || evt.Parsed.CommandLine contains '🙍🏼' || evt.Parsed.CommandLine contains '🙍🏼‍♂️' || evt.Parsed.CommandLine contains '💇🏼‍♀️' || evt.Parsed.CommandLine contains '💇🏼' || evt.Parsed.CommandLine contains '💇🏼‍♂️' || evt.Parsed.CommandLine contains '💆🏼‍♀️' || evt.Parsed.CommandLine contains '💆🏼' || evt.Parsed.CommandLine contains '💆🏼‍♂️' || evt.Parsed.CommandLine contains '🧖🏼‍♀️' || evt.Parsed.CommandLine contains '🧖🏼' || evt.Parsed.CommandLine contains '🧖🏼‍♂️' || evt.Parsed.CommandLine contains '💃🏼' || evt.Parsed.CommandLine contains '🕺🏼' || evt.Parsed.CommandLine contains '🕴🏼' || evt.Parsed.CommandLine contains '👩🏼‍🦽' || evt.Parsed.CommandLine contains '🧑🏼‍🦽' || evt.Parsed.CommandLine contains '👨🏼‍🦽' || evt.Parsed.CommandLine contains '👩🏼‍🦼' || evt.Parsed.CommandLine contains '🧑🏼‍🦼' || evt.Parsed.CommandLine contains '👨🏼‍🦼' || evt.Parsed.CommandLine contains '🚶🏼‍♀️' || evt.Parsed.CommandLine contains '🚶🏼' || evt.Parsed.CommandLine contains '🚶🏼‍♂️' || evt.Parsed.CommandLine contains '👩🏼‍🦯' || evt.Parsed.CommandLine contains '🧑🏼‍🦯' || evt.Parsed.CommandLine contains '👨🏼‍🦯' || evt.Parsed.CommandLine contains '🧎🏼‍♀️' || evt.Parsed.CommandLine contains '🧎🏼' || evt.Parsed.CommandLine contains '🧎🏼‍♂️' || evt.Parsed.CommandLine contains '🏃🏼‍♀️' || evt.Parsed.CommandLine contains '🏃🏼' || evt.Parsed.CommandLine contains '🏃🏼‍♂️' || evt.Parsed.CommandLine contains '🧍🏼‍♀️' || evt.Parsed.CommandLine contains '🧍🏼' || evt.Parsed.CommandLine contains '🧍🏼‍♂️' || evt.Parsed.CommandLine contains '👭🏼' || evt.Parsed.CommandLine contains '🧑🏼‍🤝‍🧑🏼' || evt.Parsed.CommandLine contains '👬🏼' || evt.Parsed.CommandLine contains '👫🏼' || evt.Parsed.CommandLine contains '🧗🏼‍♀️' || evt.Parsed.CommandLine contains '🧗🏼' || evt.Parsed.CommandLine contains '🧗🏼‍♂️' || evt.Parsed.CommandLine contains '🏇🏼' || evt.Parsed.CommandLine contains '🏂🏼' || evt.Parsed.CommandLine contains '🏌🏼‍♀️' || evt.Parsed.CommandLine contains '🏌🏼' || evt.Parsed.CommandLine contains '🏌🏼‍♂️' || evt.Parsed.CommandLine contains '🏄🏼‍♀️' || evt.Parsed.CommandLine contains '🏄🏼' || evt.Parsed.CommandLine contains '🏄🏼‍♂️' || evt.Parsed.CommandLine contains '🚣🏼‍♀️' || evt.Parsed.CommandLine contains '🚣🏼' || evt.Parsed.CommandLine contains '🚣🏼‍♂️' || evt.Parsed.CommandLine contains '🏊🏼‍♀️' || evt.Parsed.CommandLine contains '🏊🏼' || evt.Parsed.CommandLine contains '🏊🏼‍♂️' || evt.Parsed.CommandLine contains '⛹🏼‍♀️' || evt.Parsed.CommandLine contains '⛹🏼' || evt.Parsed.CommandLine contains '⛹🏼‍♂️' || evt.Parsed.CommandLine contains '🏋🏼‍♀️' || evt.Parsed.CommandLine contains '🏋🏼' || evt.Parsed.CommandLine contains '🏋🏼‍♂️' || evt.Parsed.CommandLine contains '🚴🏼‍♀️' || evt.Parsed.CommandLine contains '🚴🏼' || evt.Parsed.CommandLine contains '🚴🏼‍♂️' || evt.Parsed.CommandLine contains '🚵🏼‍♀️' || evt.Parsed.CommandLine contains '🚵🏼' || evt.Parsed.CommandLine contains '🚵🏼‍♂️' || evt.Parsed.CommandLine contains '🤸🏼‍♀️' || evt.Parsed.CommandLine contains '🤸🏼' || evt.Parsed.CommandLine contains '🤸🏼‍♂️' || evt.Parsed.CommandLine contains '🤽🏼‍♀️' || evt.Parsed.CommandLine contains '🤽🏼' || evt.Parsed.CommandLine contains '🤽🏼‍♂️' || evt.Parsed.CommandLine contains '🤾🏼‍♀️' || evt.Parsed.CommandLine contains '🤾🏼' || evt.Parsed.CommandLine contains '🤾🏼‍♂️' || evt.Parsed.CommandLine contains '🤹🏼‍♀️' || evt.Parsed.CommandLine contains '🤹🏼' || evt.Parsed.CommandLine contains '🤹🏼‍♂️' || evt.Parsed.CommandLine contains '🧘🏼‍♀️' || evt.Parsed.CommandLine contains '🧘🏼' || evt.Parsed.CommandLine contains '🧘🏼‍♂️' || evt.Parsed.CommandLine contains '🛀🏼' || evt.Parsed.CommandLine contains '🛌🏼' || evt.Parsed.CommandLine contains '👋🏽' || evt.Parsed.CommandLine contains '🤚🏽' || evt.Parsed.CommandLine contains '🖐🏽' || evt.Parsed.CommandLine contains '✋🏽' || evt.Parsed.CommandLine contains '🖖🏽' || evt.Parsed.CommandLine contains '👌🏽' || evt.Parsed.CommandLine contains '🤌🏽' || evt.Parsed.CommandLine contains '🤏🏽' || evt.Parsed.CommandLine contains '✌🏽' || evt.Parsed.CommandLine contains '🤞🏽' || evt.Parsed.CommandLine contains '🫰🏽' || evt.Parsed.CommandLine contains '🤟🏽' || evt.Parsed.CommandLine contains '🤘🏽' || evt.Parsed.CommandLine contains '🤙🏽' || evt.Parsed.CommandLine contains '🫵🏽' || evt.Parsed.CommandLine contains '🫱🏽' || evt.Parsed.CommandLine contains '🫲🏽' || evt.Parsed.CommandLine contains '🫳🏽' || evt.Parsed.CommandLine contains '🫴🏽' || evt.Parsed.CommandLine contains '👈🏽' || evt.Parsed.CommandLine contains '👉🏽' || evt.Parsed.CommandLine contains '👆🏽' || evt.Parsed.CommandLine contains '🖕🏽' || evt.Parsed.CommandLine contains '👇🏽' || evt.Parsed.CommandLine contains '☝🏽' || evt.Parsed.CommandLine contains '👍🏽' || evt.Parsed.CommandLine contains '👎🏽' || evt.Parsed.CommandLine contains '✊🏽' || evt.Parsed.CommandLine contains '👊🏽' || evt.Parsed.CommandLine contains '🤛🏽' || evt.Parsed.CommandLine contains '🤜🏽' || evt.Parsed.CommandLine contains '👏🏽' || evt.Parsed.CommandLine contains '🫶🏽' || evt.Parsed.CommandLine contains '🙌🏽' || evt.Parsed.CommandLine contains '👐🏽' || evt.Parsed.CommandLine contains '🤲🏽' || evt.Parsed.CommandLine contains '🙏🏽' || evt.Parsed.CommandLine contains '✍🏽' || evt.Parsed.CommandLine contains '💪🏽' || evt.Parsed.CommandLine contains '🦵🏽' || evt.Parsed.CommandLine contains '🦶🏽' || evt.Parsed.CommandLine contains '👂🏽' || evt.Parsed.CommandLine contains '🦻🏽' || evt.Parsed.CommandLine contains '👃🏽' || evt.Parsed.CommandLine contains '👶🏽' || evt.Parsed.CommandLine contains '👧🏽' || evt.Parsed.CommandLine contains '🧒🏽' || evt.Parsed.CommandLine contains '👦🏽' || evt.Parsed.CommandLine contains '👩🏽' || evt.Parsed.CommandLine contains '🧑🏽' || evt.Parsed.CommandLine contains '👨🏽' || evt.Parsed.CommandLine contains '👩🏽‍🦱' || evt.Parsed.CommandLine contains '🧑🏽‍🦱' || evt.Parsed.CommandLine contains '👨🏽‍🦱' || evt.Parsed.CommandLine contains '👩🏽‍🦰' || evt.Parsed.CommandLine contains '🧑🏽‍🦰' || evt.Parsed.CommandLine contains '👨🏽‍🦰' || evt.Parsed.CommandLine contains '👱🏽‍♀️' || evt.Parsed.CommandLine contains '👱🏽' || evt.Parsed.CommandLine contains '👱🏽‍♂️' || evt.Parsed.CommandLine contains '👩🏽‍🦳' || evt.Parsed.CommandLine contains '🧑🏽‍🦳' || evt.Parsed.CommandLine contains '👨🏽‍🦳' || evt.Parsed.CommandLine contains '👩🏽‍🦲' || evt.Parsed.CommandLine contains '🧑🏽‍🦲' || evt.Parsed.CommandLine contains '👨🏽‍🦲' || evt.Parsed.CommandLine contains '🧔🏽‍♀️' || evt.Parsed.CommandLine contains '🧔🏽' || evt.Parsed.CommandLine contains '🧔🏽‍♂️' || evt.Parsed.CommandLine contains '👵🏽' || evt.Parsed.CommandLine contains '🧓🏽' || evt.Parsed.CommandLine contains '👴🏽' || evt.Parsed.CommandLine contains '👲🏽' || evt.Parsed.CommandLine contains '👳🏽‍♀️' || evt.Parsed.CommandLine contains '👳🏽' || evt.Parsed.CommandLine contains '👳🏽‍♂️' || evt.Parsed.CommandLine contains '🧕🏽' || evt.Parsed.CommandLine contains '👮🏽‍♀️' || evt.Parsed.CommandLine contains '👮🏽' || evt.Parsed.CommandLine contains '👮🏽‍♂️' || evt.Parsed.CommandLine contains '👷🏽‍♀️' || evt.Parsed.CommandLine contains '👷🏽' || evt.Parsed.CommandLine contains '👷🏽‍♂️' || evt.Parsed.CommandLine contains '💂🏽‍♀️' || evt.Parsed.CommandLine contains '💂🏽' || evt.Parsed.CommandLine contains '💂🏽‍♂️' || evt.Parsed.CommandLine contains '🕵🏽‍♀️' || evt.Parsed.CommandLine contains '🕵🏽' || evt.Parsed.CommandLine contains '🕵🏽‍♂️' || evt.Parsed.CommandLine contains '👩🏽‍⚕️' || evt.Parsed.CommandLine contains '🧑🏽‍⚕️' || evt.Parsed.CommandLine contains '👨🏽‍⚕️' || evt.Parsed.CommandLine contains '👩🏽‍🌾' || evt.Parsed.CommandLine contains '🧑🏽‍🌾' || evt.Parsed.CommandLine contains '👨🏽‍🌾' || evt.Parsed.CommandLine contains '👩🏽‍🍳' || evt.Parsed.CommandLine contains '🧑🏽‍🍳' || evt.Parsed.CommandLine contains '👨🏽‍🍳' || evt.Parsed.CommandLine contains '👩🏽‍🎓' || evt.Parsed.CommandLine contains '🧑🏽‍🎓' || evt.Parsed.CommandLine contains '👨🏽‍🎓' || evt.Parsed.CommandLine contains '👩🏽‍🎤' || evt.Parsed.CommandLine contains '🧑🏽‍🎤' || evt.Parsed.CommandLine contains '👨🏽‍🎤' || evt.Parsed.CommandLine contains '👩🏽‍🏫' || evt.Parsed.CommandLine contains '🧑🏽‍🏫' || evt.Parsed.CommandLine contains '👨🏽‍🏫' || evt.Parsed.CommandLine contains '👩🏽‍🏭' || evt.Parsed.CommandLine contains '🧑🏽‍🏭' || evt.Parsed.CommandLine contains '👨🏽‍🏭' || evt.Parsed.CommandLine contains '👩🏽‍💻' || evt.Parsed.CommandLine contains '🧑🏽‍💻' || evt.Parsed.CommandLine contains '👨🏽‍💻' || evt.Parsed.CommandLine contains '👩🏽‍💼' || evt.Parsed.CommandLine contains '🧑🏽‍💼' || evt.Parsed.CommandLine contains '👨🏽‍💼' || evt.Parsed.CommandLine contains '👩🏽‍🔧' || evt.Parsed.CommandLine contains '🧑🏽‍🔧' || evt.Parsed.CommandLine contains '👨🏽‍🔧' || evt.Parsed.CommandLine contains '👩🏽‍🔬' || evt.Parsed.CommandLine contains '🧑🏽‍🔬' || evt.Parsed.CommandLine contains '👨🏽‍🔬' || evt.Parsed.CommandLine contains '👩🏽‍🎨' || evt.Parsed.CommandLine contains '🧑🏽‍🎨' || evt.Parsed.CommandLine contains '👨🏽‍🎨' || evt.Parsed.CommandLine contains '👩🏽‍🚒' || evt.Parsed.CommandLine contains '🧑🏽‍🚒' || evt.Parsed.CommandLine contains '👨🏽‍🚒' || evt.Parsed.CommandLine contains '👩🏽‍✈️' || evt.Parsed.CommandLine contains '🧑🏽‍✈️' || evt.Parsed.CommandLine contains '👨🏽‍✈️' || evt.Parsed.CommandLine contains '👩🏽‍🚀' || evt.Parsed.CommandLine contains '🧑🏽‍🚀' || evt.Parsed.CommandLine contains '👨🏽‍🚀' || evt.Parsed.CommandLine contains '👩🏽‍⚖️' || evt.Parsed.CommandLine contains '🧑🏽‍⚖️' || evt.Parsed.CommandLine contains '👨🏽‍⚖️' || evt.Parsed.CommandLine contains '👰🏽‍♀️' || evt.Parsed.CommandLine contains '👰🏽' || evt.Parsed.CommandLine contains '👰🏽‍♂️' || evt.Parsed.CommandLine contains '🤵🏽‍♀️' || evt.Parsed.CommandLine contains '🤵🏽' || evt.Parsed.CommandLine contains '🤵🏽‍♂️' || evt.Parsed.CommandLine contains '👸🏽' || evt.Parsed.CommandLine contains '🫅🏽' || evt.Parsed.CommandLine contains '🤴🏽' || evt.Parsed.CommandLine contains '🥷🏽' || evt.Parsed.CommandLine contains '🦸🏽‍♀️' || evt.Parsed.CommandLine contains '🦸🏽' || evt.Parsed.CommandLine contains '🦸🏽‍♂️' || evt.Parsed.CommandLine contains '🦹🏽‍♀️' || evt.Parsed.CommandLine contains '🦹🏽' || evt.Parsed.CommandLine contains '🦹🏽‍♂️' || evt.Parsed.CommandLine contains '🤶🏽' || evt.Parsed.CommandLine contains '🧑🏽‍🎄' || evt.Parsed.CommandLine contains '🎅🏽' || evt.Parsed.CommandLine contains '🧙🏽‍♀️' || evt.Parsed.CommandLine contains '🧙🏽' || evt.Parsed.CommandLine contains '🧙🏽‍♂️' || evt.Parsed.CommandLine contains '🧝🏽‍♀️' || evt.Parsed.CommandLine contains '🧝🏽' || evt.Parsed.CommandLine contains '🧝🏽‍♂️' || evt.Parsed.CommandLine contains '🧛🏽‍♀️' || evt.Parsed.CommandLine contains '🧛🏽' || evt.Parsed.CommandLine contains '🧛🏽‍♂️' || evt.Parsed.CommandLine contains '🧜🏽‍♀️' || evt.Parsed.CommandLine contains '🧜🏽' || evt.Parsed.CommandLine contains '🧜🏽‍♂️' || evt.Parsed.CommandLine contains '🧚🏽‍♀️' || evt.Parsed.CommandLine contains '🧚🏽' || evt.Parsed.CommandLine contains '🧚🏽‍♂️' || evt.Parsed.CommandLine contains '👼🏽' || evt.Parsed.CommandLine contains '🤰🏽' || evt.Parsed.CommandLine contains '🫄🏽' || evt.Parsed.CommandLine contains '🫃🏽' || evt.Parsed.CommandLine contains '🤱🏽' || evt.Parsed.CommandLine contains '👩🏽‍🍼' || evt.Parsed.CommandLine contains '🧑🏽‍🍼' || evt.Parsed.CommandLine contains '👨🏽‍🍼' || evt.Parsed.CommandLine contains '🙇🏽‍♀️' || evt.Parsed.CommandLine contains '🙇🏽' || evt.Parsed.CommandLine contains '🙇🏽‍♂️' || evt.Parsed.CommandLine contains '💁🏽‍♀️' || evt.Parsed.CommandLine contains '💁🏽' || evt.Parsed.CommandLine contains '💁🏽‍♂️' || evt.Parsed.CommandLine contains '🙅🏽‍♀️' || evt.Parsed.CommandLine contains '🙅🏽' || evt.Parsed.CommandLine contains '🙅🏽‍♂️' || evt.Parsed.CommandLine contains '🙆🏽‍♀️' || evt.Parsed.CommandLine contains '🙆🏽' || evt.Parsed.CommandLine contains '🙆🏽‍♂️' || evt.Parsed.CommandLine contains '🙋🏽‍♀️' || evt.Parsed.CommandLine contains '🙋🏽' || evt.Parsed.CommandLine contains '🙋🏽‍♂️' || evt.Parsed.CommandLine contains '🧏🏽‍♀️' || evt.Parsed.CommandLine contains '🧏🏽' || evt.Parsed.CommandLine contains '🧏🏽‍♂️' || evt.Parsed.CommandLine contains '🤦🏽‍♀️' || evt.Parsed.CommandLine contains '🤦🏽' || evt.Parsed.CommandLine contains '🤦🏽‍♂️' || evt.Parsed.CommandLine contains '🤷🏽‍♀️' || evt.Parsed.CommandLine contains '🤷🏽' || evt.Parsed.CommandLine contains '🤷🏽‍♂️' || evt.Parsed.CommandLine contains '🙎🏽‍♀️' || evt.Parsed.CommandLine contains '🙎🏽' || evt.Parsed.CommandLine contains '🙎🏽‍♂️' || evt.Parsed.CommandLine contains '🙍🏽‍♀️' || evt.Parsed.CommandLine contains '🙍🏽' || evt.Parsed.CommandLine contains '🙍🏽‍♂️' || evt.Parsed.CommandLine contains '💇🏽‍♀️' || evt.Parsed.CommandLine contains '💇🏽' || evt.Parsed.CommandLine contains '💇🏽‍♂️' || evt.Parsed.CommandLine contains '💆🏽‍♀️' || evt.Parsed.CommandLine contains '💆🏽' || evt.Parsed.CommandLine contains '💆🏽‍♂️' || evt.Parsed.CommandLine contains '🧖🏽‍♀️' || evt.Parsed.CommandLine contains '🧖🏽' || evt.Parsed.CommandLine contains '🧖🏽‍♂️' || evt.Parsed.CommandLine contains '💃🏽' || evt.Parsed.CommandLine contains '🕺🏽' || evt.Parsed.CommandLine contains '🕴🏽' || evt.Parsed.CommandLine contains '👩🏽‍🦽' || evt.Parsed.CommandLine contains '🧑🏽‍🦽' || evt.Parsed.CommandLine contains '👨🏽‍🦽' || evt.Parsed.CommandLine contains '👩🏽‍🦼' || evt.Parsed.CommandLine contains '🧑🏽‍🦼' || evt.Parsed.CommandLine contains '👨🏽‍🦼' || evt.Parsed.CommandLine contains '🚶🏽‍♀️' || evt.Parsed.CommandLine contains '🚶🏽' || evt.Parsed.CommandLine contains '🚶🏽‍♂️' || evt.Parsed.CommandLine contains '👩🏽‍🦯' || evt.Parsed.CommandLine contains '🧑🏽‍🦯' || evt.Parsed.CommandLine contains '👨🏽‍🦯' || evt.Parsed.CommandLine contains '🧎🏽‍♀️' || evt.Parsed.CommandLine contains '🧎🏽' || evt.Parsed.CommandLine contains '🧎🏽‍♂️' || evt.Parsed.CommandLine contains '🏃🏽‍♀️' || evt.Parsed.CommandLine contains '🏃🏽' || evt.Parsed.CommandLine contains '🏃🏽‍♂️' || evt.Parsed.CommandLine contains '🧍🏽‍♀️' || evt.Parsed.CommandLine contains '🧍🏽' || evt.Parsed.CommandLine contains '🧍🏽‍♂️' || evt.Parsed.CommandLine contains '👭🏽' || evt.Parsed.CommandLine contains '🧑🏽‍🤝‍🧑🏽' || evt.Parsed.CommandLine contains '👬🏽' || evt.Parsed.CommandLine contains '👫🏽' || evt.Parsed.CommandLine contains '🧗🏽‍♀️' || evt.Parsed.CommandLine contains '🧗🏽' || evt.Parsed.CommandLine contains '🧗🏽‍♂️' || evt.Parsed.CommandLine contains '🏇🏽' || evt.Parsed.CommandLine contains '🏂🏽' || evt.Parsed.CommandLine contains '🏌🏽‍♀️' || evt.Parsed.CommandLine contains '🏌🏽' || evt.Parsed.CommandLine contains '🏌🏽‍♂️' || evt.Parsed.CommandLine contains '🏄🏽‍♀️' || evt.Parsed.CommandLine contains '🏄🏽' || evt.Parsed.CommandLine contains '🏄🏽‍♂️' || evt.Parsed.CommandLine contains '🚣🏽‍♀️' || evt.Parsed.CommandLine contains '🚣🏽' || evt.Parsed.CommandLine contains '🚣🏽‍♂️' || evt.Parsed.CommandLine contains '🏊🏽‍♀️' || evt.Parsed.CommandLine contains '🏊🏽' || evt.Parsed.CommandLine contains '🏊🏽‍♂️' || evt.Parsed.CommandLine contains '⛹🏽‍♀️' || evt.Parsed.CommandLine contains '⛹🏽' || evt.Parsed.CommandLine contains '⛹🏽‍♂️' || evt.Parsed.CommandLine contains '🏋🏽‍♀️' || evt.Parsed.CommandLine contains '🏋🏽' || evt.Parsed.CommandLine contains '🏋🏽‍♂️' || evt.Parsed.CommandLine contains '🚴🏽‍♀️' || evt.Parsed.CommandLine contains '🚴🏽' || evt.Parsed.CommandLine contains '🚴🏽‍♂️' || evt.Parsed.CommandLine contains '🚵🏽‍♀️' || evt.Parsed.CommandLine contains '🚵🏽' || evt.Parsed.CommandLine contains '🚵🏽‍♂️' || evt.Parsed.CommandLine contains '🤸🏽‍♀️' || evt.Parsed.CommandLine contains '🤸🏽' || evt.Parsed.CommandLine contains '🤸🏽‍♂️' || evt.Parsed.CommandLine contains '🤽🏽‍♀️' || evt.Parsed.CommandLine contains '🤽🏽' || evt.Parsed.CommandLine contains '🤽🏽‍♂️' || evt.Parsed.CommandLine contains '🤾🏽‍♀️' || evt.Parsed.CommandLine contains '🤾🏽' || evt.Parsed.CommandLine contains '🤾🏽‍♂️' || evt.Parsed.CommandLine contains '🤹🏽‍♀️' || evt.Parsed.CommandLine contains '🤹🏽' || evt.Parsed.CommandLine contains '🤹🏽‍♂️' || evt.Parsed.CommandLine contains '🧘🏽‍♀️' || evt.Parsed.CommandLine contains '🧘🏽' || evt.Parsed.CommandLine contains '🧘🏽‍♂️' || evt.Parsed.CommandLine contains '🛀🏽' || evt.Parsed.CommandLine contains '🛌🏽' || evt.Parsed.CommandLine contains '👋🏾' || evt.Parsed.CommandLine contains '🤚🏾' || evt.Parsed.CommandLine contains '🖐🏾' || evt.Parsed.CommandLine contains '✋🏾' || evt.Parsed.CommandLine contains '🖖🏾' || evt.Parsed.CommandLine contains '👌🏾' || evt.Parsed.CommandLine contains '🤌🏾' || evt.Parsed.CommandLine contains '🤏🏾' || evt.Parsed.CommandLine contains '✌🏾' || evt.Parsed.CommandLine contains '🤞🏾' || evt.Parsed.CommandLine contains '🫰🏾' || evt.Parsed.CommandLine contains '🤟🏾' || evt.Parsed.CommandLine contains '🤘🏾' || evt.Parsed.CommandLine contains '🤙🏾' || evt.Parsed.CommandLine contains '🫵🏾' || evt.Parsed.CommandLine contains '🫱🏾' || evt.Parsed.CommandLine contains '🫲🏾' || evt.Parsed.CommandLine contains '🫳🏾' || evt.Parsed.CommandLine contains '🫴🏾' || evt.Parsed.CommandLine contains '👈🏾' || evt.Parsed.CommandLine contains '👉🏾' || evt.Parsed.CommandLine contains '👆🏾' || evt.Parsed.CommandLine contains '🖕🏾' || evt.Parsed.CommandLine contains '👇🏾' || evt.Parsed.CommandLine contains '☝🏾' || evt.Parsed.CommandLine contains '👍🏾' || evt.Parsed.CommandLine contains '👎🏾' || evt.Parsed.CommandLine contains '✊🏾' || evt.Parsed.CommandLine contains '👊🏾' || evt.Parsed.CommandLine contains '🤛🏾' || evt.Parsed.CommandLine contains '🤜🏾' || evt.Parsed.CommandLine contains '👏🏾' || evt.Parsed.CommandLine contains '🫶🏾' || evt.Parsed.CommandLine contains '🙌🏾' || evt.Parsed.CommandLine contains '👐🏾' || evt.Parsed.CommandLine contains '🤲🏾' || evt.Parsed.CommandLine contains '🙏🏾' || evt.Parsed.CommandLine contains '✍🏾' || evt.Parsed.CommandLine contains '💪🏾' || evt.Parsed.CommandLine contains '🦵🏾' || evt.Parsed.CommandLine contains '🦶🏾' || evt.Parsed.CommandLine contains '👂🏾' || evt.Parsed.CommandLine contains '🦻🏾' || evt.Parsed.CommandLine contains '👃🏾' || evt.Parsed.CommandLine contains '👶🏾' || evt.Parsed.CommandLine contains '👧🏾' || evt.Parsed.CommandLine contains '🧒🏾' || evt.Parsed.CommandLine contains '👦🏾' || evt.Parsed.CommandLine contains '👩🏾' || evt.Parsed.CommandLine contains '🧑🏾' || evt.Parsed.CommandLine contains '👨🏾' || evt.Parsed.CommandLine contains '👩🏾‍🦱' || evt.Parsed.CommandLine contains '🧑🏾‍🦱' || evt.Parsed.CommandLine contains '👨🏾‍🦱' || evt.Parsed.CommandLine contains '👩🏾‍🦰' || evt.Parsed.CommandLine contains '🧑🏾‍🦰' || evt.Parsed.CommandLine contains '👨🏾‍🦰' || evt.Parsed.CommandLine contains '👱🏾‍♀️' || evt.Parsed.CommandLine contains '👱🏾' || evt.Parsed.CommandLine contains '👱🏾‍♂️' || evt.Parsed.CommandLine contains '👩🏾‍🦳' || evt.Parsed.CommandLine contains '🧑🏾‍🦳' || evt.Parsed.CommandLine contains '👨🏾‍🦳' || evt.Parsed.CommandLine contains '👩🏾‍🦲' || evt.Parsed.CommandLine contains '🧑🏾‍🦲' || evt.Parsed.CommandLine contains '👨🏾‍🦲' || evt.Parsed.CommandLine contains '🧔🏾‍♀️' || evt.Parsed.CommandLine contains '🧔🏾' || evt.Parsed.CommandLine contains '🧔🏾‍♂️' || evt.Parsed.CommandLine contains '👵🏾' || evt.Parsed.CommandLine contains '🧓🏾' || evt.Parsed.CommandLine contains '👴🏾' || evt.Parsed.CommandLine contains '👲🏾' || evt.Parsed.CommandLine contains '👳🏾‍♀️' || evt.Parsed.CommandLine contains '👳🏾' || evt.Parsed.CommandLine contains '👳🏾‍♂️' || evt.Parsed.CommandLine contains '🧕🏾' || evt.Parsed.CommandLine contains '👮🏾‍♀️' || evt.Parsed.CommandLine contains '👮🏾' || evt.Parsed.CommandLine contains '👮🏾‍♂️' || evt.Parsed.CommandLine contains '👷🏾‍♀️' || evt.Parsed.CommandLine contains '👷🏾' || evt.Parsed.CommandLine contains '👷🏾‍♂️' || evt.Parsed.CommandLine contains '💂🏾‍♀️' || evt.Parsed.CommandLine contains '💂🏾' || evt.Parsed.CommandLine contains '💂🏾‍♂️' || evt.Parsed.CommandLine contains '🕵🏾‍♀️' || evt.Parsed.CommandLine contains '🕵🏾' || evt.Parsed.CommandLine contains '🕵🏾‍♂️' || evt.Parsed.CommandLine contains '👩🏾‍⚕️' || evt.Parsed.CommandLine contains '🧑🏾‍⚕️' || evt.Parsed.CommandLine contains '👨🏾‍⚕️' || evt.Parsed.CommandLine contains '👩🏾‍🌾' || evt.Parsed.CommandLine contains '🧑🏾‍🌾' || evt.Parsed.CommandLine contains '👨🏾‍🌾' || evt.Parsed.CommandLine contains '👩🏾‍🍳' || evt.Parsed.CommandLine contains '🧑🏾‍🍳' || evt.Parsed.CommandLine contains '👨🏾‍🍳' || evt.Parsed.CommandLine contains '👩🏾‍🎓' || evt.Parsed.CommandLine contains '🧑🏾‍🎓' || evt.Parsed.CommandLine contains '👨🏾‍🎓' || evt.Parsed.CommandLine contains '👩🏾‍🎤' || evt.Parsed.CommandLine contains '🧑🏾‍🎤' || evt.Parsed.CommandLine contains '👨🏾‍🎤' || evt.Parsed.CommandLine contains '👩🏾‍🏫' || evt.Parsed.CommandLine contains '🧑🏾‍🏫' || evt.Parsed.CommandLine contains '👨🏾‍🏫' || evt.Parsed.CommandLine contains '👩🏾‍🏭' || evt.Parsed.CommandLine contains '🧑🏾‍🏭' || evt.Parsed.CommandLine contains '👨🏾‍🏭' || evt.Parsed.CommandLine contains '👩🏾‍💻' || evt.Parsed.CommandLine contains '🧑🏾‍💻' || evt.Parsed.CommandLine contains '👨🏾‍💻' || evt.Parsed.CommandLine contains '👩🏾‍💼' || evt.Parsed.CommandLine contains '🧑🏾‍💼' || evt.Parsed.CommandLine contains '👨🏾‍💼' || evt.Parsed.CommandLine contains '👩🏾‍🔧' || evt.Parsed.CommandLine contains '🧑🏾‍🔧' || evt.Parsed.CommandLine contains '👨🏾‍🔧' || evt.Parsed.CommandLine contains '👩🏾‍🔬' || evt.Parsed.CommandLine contains '🧑🏾‍🔬' || evt.Parsed.CommandLine contains '👨🏾‍🔬' || evt.Parsed.CommandLine contains '👩🏾‍🎨' || evt.Parsed.CommandLine contains '🧑🏾‍🎨' || evt.Parsed.CommandLine contains '👨🏾‍🎨' || evt.Parsed.CommandLine contains '👩🏾‍🚒' || evt.Parsed.CommandLine contains '🧑🏾‍🚒' || evt.Parsed.CommandLine contains '👨🏾‍🚒' || evt.Parsed.CommandLine contains '👩🏾‍✈️' || evt.Parsed.CommandLine contains '🧑🏾‍✈️' || evt.Parsed.CommandLine contains '👨🏾‍✈️' || evt.Parsed.CommandLine contains '👩🏾‍🚀' || evt.Parsed.CommandLine contains '🧑🏾‍🚀' || evt.Parsed.CommandLine contains '👨🏾‍🚀' || evt.Parsed.CommandLine contains '👩🏾‍⚖️' || evt.Parsed.CommandLine contains '🧑🏾‍⚖️' || evt.Parsed.CommandLine contains '👨🏾‍⚖️' || evt.Parsed.CommandLine contains '👰🏾‍♀️' || evt.Parsed.CommandLine contains '👰🏾' || evt.Parsed.CommandLine contains '👰🏾‍♂️' || evt.Parsed.CommandLine contains '🤵🏾‍♀️' || evt.Parsed.CommandLine contains '🤵🏾' || evt.Parsed.CommandLine contains '🤵🏾‍♂️' || evt.Parsed.CommandLine contains '👸🏾' || evt.Parsed.CommandLine contains '🫅🏾' || evt.Parsed.CommandLine contains '🤴🏾' || evt.Parsed.CommandLine contains '🥷🏾' || evt.Parsed.CommandLine contains '🦸🏾‍♀️' || evt.Parsed.CommandLine contains '🦸🏾' || evt.Parsed.CommandLine contains '🦸🏾‍♂️' || evt.Parsed.CommandLine contains '🦹🏾‍♀️' || evt.Parsed.CommandLine contains '🦹🏾' || evt.Parsed.CommandLine contains '🦹🏾‍♂️' || evt.Parsed.CommandLine contains '🤶🏾' || evt.Parsed.CommandLine contains '🧑🏾‍🎄' || evt.Parsed.CommandLine contains '🎅🏾' || evt.Parsed.CommandLine contains '🧙🏾‍♀️' || evt.Parsed.CommandLine contains '🧙🏾' || evt.Parsed.CommandLine contains '🧙🏾‍♂️' || evt.Parsed.CommandLine contains '🧝🏾‍♀️' || evt.Parsed.CommandLine contains '🧝🏾' || evt.Parsed.CommandLine contains '🧝🏾‍♂️' || evt.Parsed.CommandLine contains '🧛🏾‍♀️' || evt.Parsed.CommandLine contains '🧛🏾' || evt.Parsed.CommandLine contains '🧛🏾‍♂️' || evt.Parsed.CommandLine contains '🧜🏾‍♀️' || evt.Parsed.CommandLine contains '🧜🏾' || evt.Parsed.CommandLine contains '🧜🏾‍♂️' || evt.Parsed.CommandLine contains '🧚🏾‍♀️' || evt.Parsed.CommandLine contains '🧚🏾' || evt.Parsed.CommandLine contains '🧚🏾‍♂️' || evt.Parsed.CommandLine contains '👼🏾' || evt.Parsed.CommandLine contains '🤰🏾' || evt.Parsed.CommandLine contains '🫄🏾' || evt.Parsed.CommandLine contains '🫃🏾' || evt.Parsed.CommandLine contains '🤱🏾' || evt.Parsed.CommandLine contains '👩🏾‍🍼' || evt.Parsed.CommandLine contains '🧑🏾‍🍼' || evt.Parsed.CommandLine contains '👨🏾‍🍼' || evt.Parsed.CommandLine contains '🙇🏾‍♀️' || evt.Parsed.CommandLine contains '🙇🏾' || evt.Parsed.CommandLine contains '🙇🏾‍♂️' || evt.Parsed.CommandLine contains '💁🏾‍♀️' || evt.Parsed.CommandLine contains '💁🏾' || evt.Parsed.CommandLine contains '💁🏾‍♂️' || evt.Parsed.CommandLine contains '🙅🏾‍♀️' || evt.Parsed.CommandLine contains '🙅🏾' || evt.Parsed.CommandLine contains '🙅🏾‍♂️' || evt.Parsed.CommandLine contains '🙆🏾‍♀️' || evt.Parsed.CommandLine contains '🙆🏾' || evt.Parsed.CommandLine contains '🙆🏾‍♂️' || evt.Parsed.CommandLine contains '🙋🏾‍♀️' || evt.Parsed.CommandLine contains '🙋🏾' || evt.Parsed.CommandLine contains '🙋🏾‍♂️' || evt.Parsed.CommandLine contains '🧏🏾‍♀️' || evt.Parsed.CommandLine contains '🧏🏾' || evt.Parsed.CommandLine contains '🧏🏾‍♂️' || evt.Parsed.CommandLine contains '🤦🏾‍♀️' || evt.Parsed.CommandLine contains '🤦🏾' || evt.Parsed.CommandLine contains '🤦🏾‍♂️' || evt.Parsed.CommandLine contains '🤷🏾‍♀️' || evt.Parsed.CommandLine contains '🤷🏾' || evt.Parsed.CommandLine contains '🤷🏾‍♂️' || evt.Parsed.CommandLine contains '🙎🏾‍♀️' || evt.Parsed.CommandLine contains '🙎🏾' || evt.Parsed.CommandLine contains '🙎🏾‍♂️' || evt.Parsed.CommandLine contains '🙍🏾‍♀️' || evt.Parsed.CommandLine contains '🙍🏾' || evt.Parsed.CommandLine contains '🙍🏾‍♂️' || evt.Parsed.CommandLine contains '💇🏾‍♀️' || evt.Parsed.CommandLine contains '💇🏾' || evt.Parsed.CommandLine contains '💇🏾‍♂️' || evt.Parsed.CommandLine contains '💆🏾‍♀️' || evt.Parsed.CommandLine contains '💆🏾' || evt.Parsed.CommandLine contains '💆🏾‍♂️' || evt.Parsed.CommandLine contains '🧖🏾‍♀️' || evt.Parsed.CommandLine contains '🧖🏾' || evt.Parsed.CommandLine contains '🧖🏾‍♂️' || evt.Parsed.CommandLine contains '💃🏾' || evt.Parsed.CommandLine contains '🕺🏾' || evt.Parsed.CommandLine contains '👩🏾‍🦽' || evt.Parsed.CommandLine contains '🧑🏾‍🦽' || evt.Parsed.CommandLine contains '👨🏾‍🦽' || evt.Parsed.CommandLine contains '👩🏾‍🦼' || evt.Parsed.CommandLine contains '🧑🏾‍🦼' || evt.Parsed.CommandLine contains '👨🏾‍🦼' || evt.Parsed.CommandLine contains '🚶🏾‍♀️' || evt.Parsed.CommandLine contains '🚶🏾' || evt.Parsed.CommandLine contains '🚶🏾‍♂️' || evt.Parsed.CommandLine contains '👩🏾‍🦯' || evt.Parsed.CommandLine contains '🧑🏾‍🦯' || evt.Parsed.CommandLine contains '👨🏾‍🦯' || evt.Parsed.CommandLine contains '🧎🏾‍♀️' || evt.Parsed.CommandLine contains '🧎🏾' || evt.Parsed.CommandLine contains '🧎🏾‍♂️' || evt.Parsed.CommandLine contains '🏃🏾‍♀️' || evt.Parsed.CommandLine contains '🏃🏾' || evt.Parsed.CommandLine contains '🏃🏾‍♂️' || evt.Parsed.CommandLine contains '🧍🏾‍♀️' || evt.Parsed.CommandLine contains '🧍🏾' || evt.Parsed.CommandLine contains '🧍🏾‍♂️' || evt.Parsed.CommandLine contains '👭🏾' || evt.Parsed.CommandLine contains '🧑🏾‍🤝‍🧑🏾' || evt.Parsed.CommandLine contains '👬🏾' || evt.Parsed.CommandLine contains '👫🏾' || evt.Parsed.CommandLine contains '🧗🏾‍♀️' || evt.Parsed.CommandLine contains '🧗🏾' || evt.Parsed.CommandLine contains '🧗🏾‍♂️' || evt.Parsed.CommandLine contains '🏇🏾' || evt.Parsed.CommandLine contains '🏂🏾' || evt.Parsed.CommandLine contains '🏌🏾‍♀️' || evt.Parsed.CommandLine contains '🏌🏾' || evt.Parsed.CommandLine contains '🏌🏾‍♂️' || evt.Parsed.CommandLine contains '🏄🏾‍♀️' || evt.Parsed.CommandLine contains '🏄🏾' || evt.Parsed.CommandLine contains '🏄🏾‍♂️' || evt.Parsed.CommandLine contains '🚣🏾‍♀️' || evt.Parsed.CommandLine contains '🚣🏾' || evt.Parsed.CommandLine contains '🚣🏾‍♂️' || evt.Parsed.CommandLine contains '🏊🏾‍♀️' || evt.Parsed.CommandLine contains '🏊🏾' || evt.Parsed.CommandLine contains '🏊🏾‍♂️' || evt.Parsed.CommandLine contains '⛹🏾‍♀️' || evt.Parsed.CommandLine contains '⛹🏾' || evt.Parsed.CommandLine contains '⛹🏾‍♂️' || evt.Parsed.CommandLine contains '🏋🏾‍♀️' || evt.Parsed.CommandLine contains '🏋🏾' || evt.Parsed.CommandLine contains '🏋🏾‍♂️' || evt.Parsed.CommandLine contains '🚴🏾‍♀️' || evt.Parsed.CommandLine contains '🚴🏾' || evt.Parsed.CommandLine contains '🚴🏾‍♂️' || evt.Parsed.CommandLine contains '🚵🏾‍♀️' || evt.Parsed.CommandLine contains '🚵🏾' || evt.Parsed.CommandLine contains '🚵🏾‍♂️' || evt.Parsed.CommandLine contains '🤸🏾‍♀️' || evt.Parsed.CommandLine contains '🤸🏾' || evt.Parsed.CommandLine contains '🤸🏾‍♂️' || evt.Parsed.CommandLine contains '🤽🏾‍♀️' || evt.Parsed.CommandLine contains '🤽🏾' || evt.Parsed.CommandLine contains '🤽🏾‍♂️' || evt.Parsed.CommandLine contains '🤾🏾‍♀️' || evt.Parsed.CommandLine contains '🤾🏾' || evt.Parsed.CommandLine contains '🤾🏾‍♂️' || evt.Parsed.CommandLine contains '🤹🏾‍♀️' || evt.Parsed.CommandLine contains '🤹🏾' || evt.Parsed.CommandLine contains '🤹🏾‍♂️' || evt.Parsed.CommandLine contains '🧘🏾‍♀️' || evt.Parsed.CommandLine contains '🧘🏾' || evt.Parsed.CommandLine contains '🧘🏾‍♂️' || evt.Parsed.CommandLine contains '🛀🏾' || evt.Parsed.CommandLine contains '🛌🏾' || evt.Parsed.CommandLine contains '👋🏿' || evt.Parsed.CommandLine contains '🤚🏿' || evt.Parsed.CommandLine contains '🖐🏿' || evt.Parsed.CommandLine contains '✋🏿' || evt.Parsed.CommandLine contains '🖖🏿' || evt.Parsed.CommandLine contains '👌🏿' || evt.Parsed.CommandLine contains '🤌🏿' || evt.Parsed.CommandLine contains '🤏🏿' || evt.Parsed.CommandLine contains '✌🏿' || evt.Parsed.CommandLine contains '🤞🏿' || evt.Parsed.CommandLine contains '🫰🏿' || evt.Parsed.CommandLine contains '🤟🏿' || evt.Parsed.CommandLine contains '🤘🏿' || evt.Parsed.CommandLine contains '🤙🏿' || evt.Parsed.CommandLine contains '🫵🏿' || evt.Parsed.CommandLine contains '🫱🏿' || evt.Parsed.CommandLine contains '🫲🏿' || evt.Parsed.CommandLine contains '🫳🏿' || evt.Parsed.CommandLine contains '🫴🏿' || evt.Parsed.CommandLine contains '👈🏿' || evt.Parsed.CommandLine contains '👉🏿' || evt.Parsed.CommandLine contains '👆🏿' || evt.Parsed.CommandLine contains '🖕🏿' || evt.Parsed.CommandLine contains '👇🏿' || evt.Parsed.CommandLine contains '☝🏿' || evt.Parsed.CommandLine contains '👍🏿' || evt.Parsed.CommandLine contains '👎🏿' || evt.Parsed.CommandLine contains '✊🏿' || evt.Parsed.CommandLine contains '👊🏿' || evt.Parsed.CommandLine contains '🤛🏿' || evt.Parsed.CommandLine contains '🤜🏿' || evt.Parsed.CommandLine contains '👏🏿' || evt.Parsed.CommandLine contains '🫶🏿' || evt.Parsed.CommandLine contains '🙌🏿' || evt.Parsed.CommandLine contains '👐🏿' || evt.Parsed.CommandLine contains '🤲🏿' || evt.Parsed.CommandLine contains '🙏🏿' || evt.Parsed.CommandLine contains '✍🏿' || evt.Parsed.CommandLine contains '🤳🏿' || evt.Parsed.CommandLine contains '💪🏿' || evt.Parsed.CommandLine contains '🦵🏿' || evt.Parsed.CommandLine contains '🦶🏿' || evt.Parsed.CommandLine contains '👂🏿' || evt.Parsed.CommandLine contains '🦻🏿' || evt.Parsed.CommandLine contains '👃🏿' || evt.Parsed.CommandLine contains '👶🏿' || evt.Parsed.CommandLine contains '👧🏿' || evt.Parsed.CommandLine contains '🧒🏿' || evt.Parsed.CommandLine contains '👦🏿' || evt.Parsed.CommandLine contains '👩🏿' || evt.Parsed.CommandLine contains '🧑🏿' || evt.Parsed.CommandLine contains '👨🏿' || evt.Parsed.CommandLine contains '👩🏿‍🦱' || evt.Parsed.CommandLine contains '🧑🏿‍🦱' || evt.Parsed.CommandLine contains '👨🏿‍🦱' || evt.Parsed.CommandLine contains '👩🏿‍🦰' || evt.Parsed.CommandLine contains '🧑🏿‍🦰' || evt.Parsed.CommandLine contains '👨🏿‍🦰' || evt.Parsed.CommandLine contains '👱🏿‍♀️' || evt.Parsed.CommandLine contains '👱🏿' || evt.Parsed.CommandLine contains '👱🏿‍♂️' || evt.Parsed.CommandLine contains '👩🏿‍🦳' || evt.Parsed.CommandLine contains '🧑🏿‍🦳' || evt.Parsed.CommandLine contains '👨🏿‍🦳' || evt.Parsed.CommandLine contains '👩🏿‍🦲' || evt.Parsed.CommandLine contains '🧑🏿‍🦲' || evt.Parsed.CommandLine contains '👨🏿‍🦲' || evt.Parsed.CommandLine contains '🧔🏿‍♀️' || evt.Parsed.CommandLine contains '🧔🏿' || evt.Parsed.CommandLine contains '🧔🏿‍♂️' || evt.Parsed.CommandLine contains '👵🏿' || evt.Parsed.CommandLine contains '🧓🏿' || evt.Parsed.CommandLine contains '👴🏿' || evt.Parsed.CommandLine contains '👲🏿' || evt.Parsed.CommandLine contains '👳🏿‍♀️' || evt.Parsed.CommandLine contains '👳🏿' || evt.Parsed.CommandLine contains '👳🏿‍♂️' || evt.Parsed.CommandLine contains '🧕🏿' || evt.Parsed.CommandLine contains '👮🏿‍♀️' || evt.Parsed.CommandLine contains '👮🏿' || evt.Parsed.CommandLine contains '👮🏿‍♂️' || evt.Parsed.CommandLine contains '👷🏿‍♀️' || evt.Parsed.CommandLine contains '👷🏿' || evt.Parsed.CommandLine contains '👷🏿‍♂️' || evt.Parsed.CommandLine contains '💂🏿‍♀️' || evt.Parsed.CommandLine contains '💂🏿' || evt.Parsed.CommandLine contains '💂🏿‍♂️' || evt.Parsed.CommandLine contains '🕵🏿‍♀️' || evt.Parsed.CommandLine contains '🕵🏿' || evt.Parsed.CommandLine contains '🕵🏿‍♂️' || evt.Parsed.CommandLine contains '👩🏿‍⚕️' || evt.Parsed.CommandLine contains '🧑🏿‍⚕️' || evt.Parsed.CommandLine contains '👨🏿‍⚕️' || evt.Parsed.CommandLine contains '👩🏿‍🌾' || evt.Parsed.CommandLine contains '🧑🏿‍🌾' || evt.Parsed.CommandLine contains '👨🏿‍🌾' || evt.Parsed.CommandLine contains '👩🏿‍🍳' || evt.Parsed.CommandLine contains '🧑🏿‍🍳' || evt.Parsed.CommandLine contains '👨🏿‍🍳' || evt.Parsed.CommandLine contains '👩🏿‍🎓' || evt.Parsed.CommandLine contains '🧑🏿‍🎓' || evt.Parsed.CommandLine contains '👨🏿‍🎓' || evt.Parsed.CommandLine contains '👩🏿‍🎤' || evt.Parsed.CommandLine contains '🧑🏿‍🎤' || evt.Parsed.CommandLine contains '👨🏿‍🎤' || evt.Parsed.CommandLine contains '👩🏿‍🏫' || evt.Parsed.CommandLine contains '🧑🏿‍🏫' || evt.Parsed.CommandLine contains '👨🏿‍🏫' || evt.Parsed.CommandLine contains '👩🏿‍🏭' || evt.Parsed.CommandLine contains '🧑🏿‍🏭' || evt.Parsed.CommandLine contains '👨🏿‍🏭' || evt.Parsed.CommandLine contains '👩🏿‍💻' || evt.Parsed.CommandLine contains '🧑🏿‍💻' || evt.Parsed.CommandLine contains '👨🏿‍💻' || evt.Parsed.CommandLine contains '👩🏿‍💼' || evt.Parsed.CommandLine contains '🧑🏿‍💼' || evt.Parsed.CommandLine contains '👨🏿‍💼' || evt.Parsed.CommandLine contains '👩🏿‍🔧' || evt.Parsed.CommandLine contains '🧑🏿‍🔧' || evt.Parsed.CommandLine contains '👨🏿‍🔧' || evt.Parsed.CommandLine contains '👩🏿‍🔬' || evt.Parsed.CommandLine contains '🧑🏿‍🔬' || evt.Parsed.CommandLine contains '👨🏿‍🔬' || evt.Parsed.CommandLine contains '👩🏿‍🎨' || evt.Parsed.CommandLine contains '🧑🏿‍🎨' || evt.Parsed.CommandLine contains '👨🏿‍🎨' || evt.Parsed.CommandLine contains '👩🏿‍🚒' || evt.Parsed.CommandLine contains '🧑🏿‍🚒' || evt.Parsed.CommandLine contains '👨🏿‍🚒' || evt.Parsed.CommandLine contains '👩🏿‍✈️' || evt.Parsed.CommandLine contains '🧑🏿‍✈️' || evt.Parsed.CommandLine contains '👨🏿‍✈️' || evt.Parsed.CommandLine contains '👩🏿‍🚀' || evt.Parsed.CommandLine contains '🧑🏿‍🚀' || evt.Parsed.CommandLine contains '👨🏿‍🚀' || evt.Parsed.CommandLine contains '👩🏿‍⚖️' || evt.Parsed.CommandLine contains '🧑🏿‍⚖️' || evt.Parsed.CommandLine contains '👨🏿‍⚖️' || evt.Parsed.CommandLine contains '👰🏿‍♀️' || evt.Parsed.CommandLine contains '👰🏿' || evt.Parsed.CommandLine contains '👰🏿‍♂️' || evt.Parsed.CommandLine contains '🤵🏿‍♀️' || evt.Parsed.CommandLine contains '🤵🏿' || evt.Parsed.CommandLine contains '🤵🏿‍♂️' || evt.Parsed.CommandLine contains '👸🏿' || evt.Parsed.CommandLine contains '🫅🏿' || evt.Parsed.CommandLine contains '🤴🏿' || evt.Parsed.CommandLine contains '🥷🏿' || evt.Parsed.CommandLine contains '🦸🏿‍♀️' || evt.Parsed.CommandLine contains '🦸🏿' || evt.Parsed.CommandLine contains '🦸🏿‍♂️' || evt.Parsed.CommandLine contains '🦹🏿‍♀️' || evt.Parsed.CommandLine contains '🦹🏿' || evt.Parsed.CommandLine contains '🦹🏿‍♂️' || evt.Parsed.CommandLine contains '🤶🏿' || evt.Parsed.CommandLine contains '🧑🏿‍🎄' || evt.Parsed.CommandLine contains '🎅🏿' || evt.Parsed.CommandLine contains '🧙🏿‍♀️' || evt.Parsed.CommandLine contains '🧙🏿' || evt.Parsed.CommandLine contains '🧙🏿‍♂️' || evt.Parsed.CommandLine contains '🧝🏿‍♀️' || evt.Parsed.CommandLine contains '🧝🏿' || evt.Parsed.CommandLine contains '🧝🏿‍♂️' || evt.Parsed.CommandLine contains '🧛🏿‍♀️' || evt.Parsed.CommandLine contains '🧛🏿' || evt.Parsed.CommandLine contains '🧛🏿‍♂️' || evt.Parsed.CommandLine contains '🧜🏿‍♀️' || evt.Parsed.CommandLine contains '🧜🏿' || evt.Parsed.CommandLine contains '🧜🏿‍♂️' || evt.Parsed.CommandLine contains '🧚🏿‍♀️' || evt.Parsed.CommandLine contains '🧚🏿' || evt.Parsed.CommandLine contains '🧚🏿‍♂️' || evt.Parsed.CommandLine contains '👼🏿' || evt.Parsed.CommandLine contains '🤰🏿' || evt.Parsed.CommandLine contains '🫄🏿' || evt.Parsed.CommandLine contains '🫃🏿' || evt.Parsed.CommandLine contains '🤱🏿' || evt.Parsed.CommandLine contains '👩🏿‍🍼' || evt.Parsed.CommandLine contains '🧑🏿‍🍼' || evt.Parsed.CommandLine contains '👨🏿‍🍼' || evt.Parsed.CommandLine contains '🙇🏿‍♀️' || evt.Parsed.CommandLine contains '🙇🏿' || evt.Parsed.CommandLine contains '🙇🏿‍♂️' || evt.Parsed.CommandLine contains '💁🏿‍♀️' || evt.Parsed.CommandLine contains '💁🏿' || evt.Parsed.CommandLine contains '💁🏿‍♂️' || evt.Parsed.CommandLine contains '🙅🏿‍♀️' || evt.Parsed.CommandLine contains '🙅🏿' || evt.Parsed.CommandLine contains '🙅🏿‍♂️' || evt.Parsed.CommandLine contains '🙆🏿‍♀️' || evt.Parsed.CommandLine contains '🙆🏿' || evt.Parsed.CommandLine contains '🙆🏿‍♂️' || evt.Parsed.CommandLine contains '🙋🏿‍♀️' || evt.Parsed.CommandLine contains '🙋🏿' || evt.Parsed.CommandLine contains '🙋🏿‍♂️' || evt.Parsed.CommandLine contains '🧏🏿‍♀️' || evt.Parsed.CommandLine contains '🧏🏿' || evt.Parsed.CommandLine contains '🧏🏿‍♂️' || evt.Parsed.CommandLine contains '🤦🏿‍♀️' || evt.Parsed.CommandLine contains '🤦🏿' || evt.Parsed.CommandLine contains '🤦🏿‍♂️' || evt.Parsed.CommandLine contains '🤷🏿‍♀️' || evt.Parsed.CommandLine contains '🤷🏿' || evt.Parsed.CommandLine contains '🤷🏿‍♂️' || evt.Parsed.CommandLine contains '🙎🏿‍♀️' || evt.Parsed.CommandLine contains '🙎🏿' || evt.Parsed.CommandLine contains '🙎🏿‍♂️' || evt.Parsed.CommandLine contains '🙍🏿‍♀️' || evt.Parsed.CommandLine contains '🙍🏿' || evt.Parsed.CommandLine contains '🙍🏿‍♂️' || evt.Parsed.CommandLine contains '💇🏿‍♀️' || evt.Parsed.CommandLine contains '💇🏿' || evt.Parsed.CommandLine contains '💇🏿‍♂️' || evt.Parsed.CommandLine contains '💆🏿‍♀️' || evt.Parsed.CommandLine contains '💆🏿' || evt.Parsed.CommandLine contains '💆🏿‍♂️' || evt.Parsed.CommandLine contains '🧖🏿‍♀️' || evt.Parsed.CommandLine contains '🧖🏿' || evt.Parsed.CommandLine contains '🧖🏿‍♂️' || evt.Parsed.CommandLine contains '💃🏿' || evt.Parsed.CommandLine contains '🕺🏿' || evt.Parsed.CommandLine contains '🕴🏿' || evt.Parsed.CommandLine contains '👩🏿‍🦽' || evt.Parsed.CommandLine contains '🧑🏿‍🦽' || evt.Parsed.CommandLine contains '👨🏿‍🦽' || evt.Parsed.CommandLine contains '👩🏿‍🦼' || evt.Parsed.CommandLine contains '🧑🏿‍🦼' || evt.Parsed.CommandLine contains '👨🏿‍🦼' || evt.Parsed.CommandLine contains '🚶🏿‍♀️' || evt.Parsed.CommandLine contains '🚶🏿' || evt.Parsed.CommandLine contains '🚶🏿‍♂️' || evt.Parsed.CommandLine contains '👩🏿‍🦯' || evt.Parsed.CommandLine contains '🧑🏿‍🦯' || evt.Parsed.CommandLine contains '👨🏿‍🦯' || evt.Parsed.CommandLine contains '🧎🏿‍♀️' || evt.Parsed.CommandLine contains '🧎🏿' || evt.Parsed.CommandLine contains '🧎🏿‍♂️' || evt.Parsed.CommandLine contains '🏃🏿‍♀️' || evt.Parsed.CommandLine contains '🏃🏿' || evt.Parsed.CommandLine contains '🏃🏿‍♂️' || evt.Parsed.CommandLine contains '🧍🏿‍♀️' || evt.Parsed.CommandLine contains '🧍🏿' || evt.Parsed.CommandLine contains '🧍🏿‍♂️' || evt.Parsed.CommandLine contains '👭🏿' || evt.Parsed.CommandLine contains '🧑🏿‍🤝‍🧑🏿' || evt.Parsed.CommandLine contains '👬🏿' || evt.Parsed.CommandLine contains '👫🏿' || evt.Parsed.CommandLine contains '🧗🏿‍♀️' || evt.Parsed.CommandLine contains '🧗🏿' || evt.Parsed.CommandLine contains '🧗🏿‍♂️' || evt.Parsed.CommandLine contains '🏇🏿' || evt.Parsed.CommandLine contains '🏂🏿' || evt.Parsed.CommandLine contains '🏌🏿‍♀️' || evt.Parsed.CommandLine contains '🏌🏿' || evt.Parsed.CommandLine contains '🏌🏿‍♂️' || evt.Parsed.CommandLine contains '🏄🏿‍♀️' || evt.Parsed.CommandLine contains '🏄🏿' || evt.Parsed.CommandLine contains '🏄🏿‍♂️' || evt.Parsed.CommandLine contains '🚣🏿‍♀️' || evt.Parsed.CommandLine contains '🚣🏿' || evt.Parsed.CommandLine contains '🚣🏿‍♂️' || evt.Parsed.CommandLine contains '🏊🏿‍♀️' || evt.Parsed.CommandLine contains '🏊🏿' || evt.Parsed.CommandLine contains '🏊🏿‍♂️' || evt.Parsed.CommandLine contains '⛹🏿‍♀️' || evt.Parsed.CommandLine contains '⛹🏿' || evt.Parsed.CommandLine contains '⛹🏿‍♂️' || evt.Parsed.CommandLine contains '🏋🏿‍♀️' || evt.Parsed.CommandLine contains '🏋🏿' || evt.Parsed.CommandLine contains '🏋🏿‍♂️' || evt.Parsed.CommandLine contains '🚴🏿‍♀️' || evt.Parsed.CommandLine contains '🚴🏿' || evt.Parsed.CommandLine contains '🚴🏿‍♂️' || evt.Parsed.CommandLine contains '🚵🏿‍♀️' || evt.Parsed.CommandLine contains '🚵🏿' || evt.Parsed.CommandLine contains '🚵🏿‍♂️' || evt.Parsed.CommandLine contains '🤸🏿‍♀️' || evt.Parsed.CommandLine contains '🤸🏿' || evt.Parsed.CommandLine contains '🤸🏿‍♂️' || evt.Parsed.CommandLine contains '🤽🏿‍♀️' || evt.Parsed.CommandLine contains '🤽🏿' || evt.Parsed.CommandLine contains '🤽🏿‍♂️' || evt.Parsed.CommandLine contains '🤾🏿‍♀️' || evt.Parsed.CommandLine contains '🤾🏿' || evt.Parsed.CommandLine contains '🤾🏿‍♂️' || evt.Parsed.CommandLine contains '🤹🏿‍♀️' || evt.Parsed.CommandLine contains '🤹🏿' || evt.Parsed.CommandLine contains '🤹🏿‍♂️' || evt.Parsed.CommandLine contains '🧘🏿‍♀️' || evt.Parsed.CommandLine contains '🧘🏿' || evt.Parsed.CommandLine contains '🧘🏿‍♂️' || evt.Parsed.CommandLine contains '🛀🏿' || evt.Parsed.CommandLine contains '🛌🏿' || evt.Parsed.CommandLine contains '🐶' || evt.Parsed.CommandLine contains '🐱' || evt.Parsed.CommandLine contains '🐭' || evt.Parsed.CommandLine contains '🐹' || evt.Parsed.CommandLine contains '🐰' || evt.Parsed.CommandLine contains '🦊' || evt.Parsed.CommandLine contains '🐻' || evt.Parsed.CommandLine contains '🐼' || evt.Parsed.CommandLine contains '🐻‍❄️' || evt.Parsed.CommandLine contains '🐨' || evt.Parsed.CommandLine contains '🐯' || evt.Parsed.CommandLine contains '🦁' || evt.Parsed.CommandLine contains '🐮' || evt.Parsed.CommandLine contains '🐷' || evt.Parsed.CommandLine contains '🐽' || evt.Parsed.CommandLine contains '🐸' || evt.Parsed.CommandLine contains '🐵' || evt.Parsed.CommandLine contains '🙈' || evt.Parsed.CommandLine contains '🙉' || evt.Parsed.CommandLine contains '🙊' || evt.Parsed.CommandLine contains '🐒' || evt.Parsed.CommandLine contains '🐔' || evt.Parsed.CommandLine contains '🐧' || evt.Parsed.CommandLine contains '🐦' || evt.Parsed.CommandLine contains '🐤' || evt.Parsed.CommandLine contains '🐣' || evt.Parsed.CommandLine contains '🐥')

7blackhole: 2m

8#status: test

9labels:

10 service: windows

11 confidence: 1

12 spoofable: 0

13 classification:

15 label: "Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 2"

16 behavior : "windows:audit"

17 remediation: false

19scope:

20 type: ParentProcessId

21 expression: evt.Parsed.ParentProcessId

Hub configuration

« Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 2 »v0.2 by sigmahq / proc_creation_win_susp_emoji_usage_in_cli_2Attack scenariowindowsNot spoofableLow confidence

« Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 2 »
v0.2 by sigmahq / proc_creation_win_susp_emoji_usage_in_cli_2
Attack scenariowindowsNot spoofableLow confidence