Hub configuration

Name: Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 3
Author: sigmahq

More info

1type: trigger

2name: sigmahq/proc_creation_win_susp_emoji_usage_in_cli_3

3description: |

4 Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.

5filter: |

6 (evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1') && (evt.Parsed.CommandLine contains '🦆' || evt.Parsed.CommandLine contains '🦅' || evt.Parsed.CommandLine contains '🦉' || evt.Parsed.CommandLine contains '🦇' || evt.Parsed.CommandLine contains '🐺' || evt.Parsed.CommandLine contains '🐗' || evt.Parsed.CommandLine contains '🐴' || evt.Parsed.CommandLine contains '🦄' || evt.Parsed.CommandLine contains '🐝' || evt.Parsed.CommandLine contains '🪱' || evt.Parsed.CommandLine contains '🐛' || evt.Parsed.CommandLine contains '🦋' || evt.Parsed.CommandLine contains '🐌' || evt.Parsed.CommandLine contains '🐞' || evt.Parsed.CommandLine contains '🐜' || evt.Parsed.CommandLine contains '🪰' || evt.Parsed.CommandLine contains '🪲' || evt.Parsed.CommandLine contains '🪳' || evt.Parsed.CommandLine contains '🦟' || evt.Parsed.CommandLine contains '🦗' || evt.Parsed.CommandLine contains '🕷' || evt.Parsed.CommandLine contains '🕸' || evt.Parsed.CommandLine contains '🦂' || evt.Parsed.CommandLine contains '🐢' || evt.Parsed.CommandLine contains '🐍' || evt.Parsed.CommandLine contains '🦎' || evt.Parsed.CommandLine contains '🦖' || evt.Parsed.CommandLine contains '🦕' || evt.Parsed.CommandLine contains '🐙' || evt.Parsed.CommandLine contains '🦑' || evt.Parsed.CommandLine contains '🦐' || evt.Parsed.CommandLine contains '🦞' || evt.Parsed.CommandLine contains '🦀' || evt.Parsed.CommandLine contains '🪸' || evt.Parsed.CommandLine contains '🐡' || evt.Parsed.CommandLine contains '🐠' || evt.Parsed.CommandLine contains '🐟' || evt.Parsed.CommandLine contains '🐬' || evt.Parsed.CommandLine contains '🐳' || evt.Parsed.CommandLine contains '🐋' || evt.Parsed.CommandLine contains '🦈' || evt.Parsed.CommandLine contains '🐊' || evt.Parsed.CommandLine contains '🐅' || evt.Parsed.CommandLine contains '🐆' || evt.Parsed.CommandLine contains '🦓' || evt.Parsed.CommandLine contains '🦍' || evt.Parsed.CommandLine contains '🦧' || evt.Parsed.CommandLine contains '🦣' || evt.Parsed.CommandLine contains '🐘' || evt.Parsed.CommandLine contains '🦛' || evt.Parsed.CommandLine contains '🦏' || evt.Parsed.CommandLine contains '🐪' || evt.Parsed.CommandLine contains '🐫' || evt.Parsed.CommandLine contains '🦒' || evt.Parsed.CommandLine contains '🦘' || evt.Parsed.CommandLine contains '🦬' || evt.Parsed.CommandLine contains '🐃' || evt.Parsed.CommandLine contains '🐂' || evt.Parsed.CommandLine contains '🐄' || evt.Parsed.CommandLine contains '🐎' || evt.Parsed.CommandLine contains '🐖' || evt.Parsed.CommandLine contains '🐏' || evt.Parsed.CommandLine contains '🐑' || evt.Parsed.CommandLine contains '🦙' || evt.Parsed.CommandLine contains '🐐' || evt.Parsed.CommandLine contains '🦌' || evt.Parsed.CommandLine contains '🐕' || evt.Parsed.CommandLine contains '🐩' || evt.Parsed.CommandLine contains '🦮' || evt.Parsed.CommandLine contains '🐕‍🦺' || evt.Parsed.CommandLine contains '🐈' || evt.Parsed.CommandLine contains '🐈‍⬛' || evt.Parsed.CommandLine contains '🪶' || evt.Parsed.CommandLine contains '🐓' || evt.Parsed.CommandLine contains '🦃' || evt.Parsed.CommandLine contains '🦤' || evt.Parsed.CommandLine contains '🦚' || evt.Parsed.CommandLine contains '🦜' || evt.Parsed.CommandLine contains '🦢' || evt.Parsed.CommandLine contains '🦩' || evt.Parsed.CommandLine contains '🕊' || evt.Parsed.CommandLine contains '🐇' || evt.Parsed.CommandLine contains '🦝' || evt.Parsed.CommandLine contains '🦨' || evt.Parsed.CommandLine contains '🦡' || evt.Parsed.CommandLine contains '🦫' || evt.Parsed.CommandLine contains '🦦' || evt.Parsed.CommandLine contains '🦥' || evt.Parsed.CommandLine contains '🐁' || evt.Parsed.CommandLine contains '🐀' || evt.Parsed.CommandLine contains '🐿' || evt.Parsed.CommandLine contains '🦔' || evt.Parsed.CommandLine contains '🐾' || evt.Parsed.CommandLine contains '🐉' || evt.Parsed.CommandLine contains '🐲' || evt.Parsed.CommandLine contains '🌵' || evt.Parsed.CommandLine contains '🎄' || evt.Parsed.CommandLine contains '🌲' || evt.Parsed.CommandLine contains '🌳' || evt.Parsed.CommandLine contains '🌴' || evt.Parsed.CommandLine contains '🪹' || evt.Parsed.CommandLine contains '🪺' || evt.Parsed.CommandLine contains '🪵' || evt.Parsed.CommandLine contains '🌱' || evt.Parsed.CommandLine contains '🌿' || evt.Parsed.CommandLine contains '☘️' || evt.Parsed.CommandLine contains '🍀' || evt.Parsed.CommandLine contains '🎍' || evt.Parsed.CommandLine contains '🪴' || evt.Parsed.CommandLine contains '🎋' || evt.Parsed.CommandLine contains '🍃' || evt.Parsed.CommandLine contains '🍂' || evt.Parsed.CommandLine contains '🍁' || evt.Parsed.CommandLine contains '🍄' || evt.Parsed.CommandLine contains '🐚' || evt.Parsed.CommandLine contains '🪨' || evt.Parsed.CommandLine contains '🌾' || evt.Parsed.CommandLine contains '💐' || evt.Parsed.CommandLine contains '🌷' || evt.Parsed.CommandLine contains '🪷' || evt.Parsed.CommandLine contains '🌹' || evt.Parsed.CommandLine contains '🥀' || evt.Parsed.CommandLine contains '🌺' || evt.Parsed.CommandLine contains '🌸' || evt.Parsed.CommandLine contains '🌼' || evt.Parsed.CommandLine contains '🌻' || evt.Parsed.CommandLine contains '🌞' || evt.Parsed.CommandLine contains '🌝' || evt.Parsed.CommandLine contains '🌛' || evt.Parsed.CommandLine contains '🌜' || evt.Parsed.CommandLine contains '🌚' || evt.Parsed.CommandLine contains '🌕' || evt.Parsed.CommandLine contains '🌖' || evt.Parsed.CommandLine contains '🌗' || evt.Parsed.CommandLine contains '🌘' || evt.Parsed.CommandLine contains '🌑' || evt.Parsed.CommandLine contains '🌒' || evt.Parsed.CommandLine contains '🌓' || evt.Parsed.CommandLine contains '🌔' || evt.Parsed.CommandLine contains '🌙' || evt.Parsed.CommandLine contains '🌎' || evt.Parsed.CommandLine contains '🌍' || evt.Parsed.CommandLine contains '🌏' || evt.Parsed.CommandLine contains '🪐' || evt.Parsed.CommandLine contains '💫' || evt.Parsed.CommandLine contains '⭐️' || evt.Parsed.CommandLine contains '🌟' || evt.Parsed.CommandLine contains '✨' || evt.Parsed.CommandLine contains '⚡️' || evt.Parsed.CommandLine contains '☄️' || evt.Parsed.CommandLine contains '💥' || evt.Parsed.CommandLine contains '🔥' || evt.Parsed.CommandLine contains '🌪' || evt.Parsed.CommandLine contains '🌈' || evt.Parsed.CommandLine contains '☀️' || evt.Parsed.CommandLine contains '🌤' || evt.Parsed.CommandLine contains '⛅️' || evt.Parsed.CommandLine contains '🌥' || evt.Parsed.CommandLine contains '☁️' || evt.Parsed.CommandLine contains '🌦' || evt.Parsed.CommandLine contains '🌧' || evt.Parsed.CommandLine contains '⛈' || evt.Parsed.CommandLine contains '🌩' || evt.Parsed.CommandLine contains '🌨' || evt.Parsed.CommandLine contains '❄️' || evt.Parsed.CommandLine contains '☃️' || evt.Parsed.CommandLine contains '⛄️' || evt.Parsed.CommandLine contains '🌬' || evt.Parsed.CommandLine contains '💨' || evt.Parsed.CommandLine contains '💧' || evt.Parsed.CommandLine contains '💦' || evt.Parsed.CommandLine contains '🫧' || evt.Parsed.CommandLine contains '☔️' || evt.Parsed.CommandLine contains '☂️' || evt.Parsed.CommandLine contains '🌊' || evt.Parsed.CommandLine contains '🌫🍏' || evt.Parsed.CommandLine contains '🍎' || evt.Parsed.CommandLine contains '🍐' || evt.Parsed.CommandLine contains '🍊' || evt.Parsed.CommandLine contains '🍋' || evt.Parsed.CommandLine contains '🍌' || evt.Parsed.CommandLine contains '🍉' || evt.Parsed.CommandLine contains '🍇' || evt.Parsed.CommandLine contains '🍓' || evt.Parsed.CommandLine contains '🫐' || evt.Parsed.CommandLine contains '🍈' || evt.Parsed.CommandLine contains '🍒' || evt.Parsed.CommandLine contains '🍑' || evt.Parsed.CommandLine contains '🥭' || evt.Parsed.CommandLine contains '🍍' || evt.Parsed.CommandLine contains '🥥' || evt.Parsed.CommandLine contains '🥝' || evt.Parsed.CommandLine contains '🍅' || evt.Parsed.CommandLine contains '🍆' || evt.Parsed.CommandLine contains '🥑' || evt.Parsed.CommandLine contains '🥦' || evt.Parsed.CommandLine contains '🥬' || evt.Parsed.CommandLine contains '🥒' || evt.Parsed.CommandLine contains '🌶' || evt.Parsed.CommandLine contains '🫑' || evt.Parsed.CommandLine contains '🌽' || evt.Parsed.CommandLine contains '🥕' || evt.Parsed.CommandLine contains '🫒' || evt.Parsed.CommandLine contains '🧄' || evt.Parsed.CommandLine contains '🧅' || evt.Parsed.CommandLine contains '🥔' || evt.Parsed.CommandLine contains '🍠' || evt.Parsed.CommandLine contains '🫘' || evt.Parsed.CommandLine contains '🥐' || evt.Parsed.CommandLine contains '🥯' || evt.Parsed.CommandLine contains '🍞' || evt.Parsed.CommandLine contains '🥖' || evt.Parsed.CommandLine contains '🥨' || evt.Parsed.CommandLine contains '🧀' || evt.Parsed.CommandLine contains '🥚' || evt.Parsed.CommandLine contains '🍳' || evt.Parsed.CommandLine contains '🧈' || evt.Parsed.CommandLine contains '🥞' || evt.Parsed.CommandLine contains '🧇' || evt.Parsed.CommandLine contains '🥓' || evt.Parsed.CommandLine contains '🥩' || evt.Parsed.CommandLine contains '🍗' || evt.Parsed.CommandLine contains '🍖' || evt.Parsed.CommandLine contains '🦴' || evt.Parsed.CommandLine contains '🌭' || evt.Parsed.CommandLine contains '🍔' || evt.Parsed.CommandLine contains '🍟' || evt.Parsed.CommandLine contains '🍕' || evt.Parsed.CommandLine contains '🫓' || evt.Parsed.CommandLine contains '🥪' || evt.Parsed.CommandLine contains '🥙' || evt.Parsed.CommandLine contains '🧆' || evt.Parsed.CommandLine contains '🌮' || evt.Parsed.CommandLine contains '🌯' || evt.Parsed.CommandLine contains '🫔' || evt.Parsed.CommandLine contains '🥗' || evt.Parsed.CommandLine contains '🥘' || evt.Parsed.CommandLine contains '🫕' || evt.Parsed.CommandLine contains '🥫' || evt.Parsed.CommandLine contains '🍝' || evt.Parsed.CommandLine contains '🍜' || evt.Parsed.CommandLine contains '🍲' || evt.Parsed.CommandLine contains '🍛' || evt.Parsed.CommandLine contains '🍣' || evt.Parsed.CommandLine contains '🍱' || evt.Parsed.CommandLine contains '🥟' || evt.Parsed.CommandLine contains '🦪' || evt.Parsed.CommandLine contains '🍤' || evt.Parsed.CommandLine contains '🍙' || evt.Parsed.CommandLine contains '🍚' || evt.Parsed.CommandLine contains '🍘' || evt.Parsed.CommandLine contains '🍥' || evt.Parsed.CommandLine contains '🥠' || evt.Parsed.CommandLine contains '🥮' || evt.Parsed.CommandLine contains '🍢' || evt.Parsed.CommandLine contains '🍡' || evt.Parsed.CommandLine contains '🍧' || evt.Parsed.CommandLine contains '🍨' || evt.Parsed.CommandLine contains '🍦' || evt.Parsed.CommandLine contains '🥧' || evt.Parsed.CommandLine contains '🧁' || evt.Parsed.CommandLine contains '🍰' || evt.Parsed.CommandLine contains '🎂' || evt.Parsed.CommandLine contains '🍮' || evt.Parsed.CommandLine contains '🍭' || evt.Parsed.CommandLine contains '🍬' || evt.Parsed.CommandLine contains '🍫' || evt.Parsed.CommandLine contains '🍿' || evt.Parsed.CommandLine contains '🍩' || evt.Parsed.CommandLine contains '🍪' || evt.Parsed.CommandLine contains '🌰' || evt.Parsed.CommandLine contains '🥜' || evt.Parsed.CommandLine contains '🍯' || evt.Parsed.CommandLine contains '🥛' || evt.Parsed.CommandLine contains '🍼' || evt.Parsed.CommandLine contains '🫖' || evt.Parsed.CommandLine contains '☕️' || evt.Parsed.CommandLine contains '🍵' || evt.Parsed.CommandLine contains '🧃' || evt.Parsed.CommandLine contains '🥤' || evt.Parsed.CommandLine contains '🧋' || evt.Parsed.CommandLine contains '🫙' || evt.Parsed.CommandLine contains '🍶' || evt.Parsed.CommandLine contains '🍺' || evt.Parsed.CommandLine contains '🍻' || evt.Parsed.CommandLine contains '🥂' || evt.Parsed.CommandLine contains '🍷' || evt.Parsed.CommandLine contains '🫗' || evt.Parsed.CommandLine contains '🥃' || evt.Parsed.CommandLine contains '🍸' || evt.Parsed.CommandLine contains '🍹' || evt.Parsed.CommandLine contains '🧉' || evt.Parsed.CommandLine contains '🍾' || evt.Parsed.CommandLine contains '🧊' || evt.Parsed.CommandLine contains '🥄' || evt.Parsed.CommandLine contains '🍴' || evt.Parsed.CommandLine contains '🍽' || evt.Parsed.CommandLine contains '🥣' || evt.Parsed.CommandLine contains '🥡' || evt.Parsed.CommandLine contains '🥢' || evt.Parsed.CommandLine contains '🧂' || evt.Parsed.CommandLine contains '⚽️' || evt.Parsed.CommandLine contains '🏀' || evt.Parsed.CommandLine contains '🏈' || evt.Parsed.CommandLine contains '⚾️' || evt.Parsed.CommandLine contains '🥎' || evt.Parsed.CommandLine contains '🎾' || evt.Parsed.CommandLine contains '🏐' || evt.Parsed.CommandLine contains '🏉' || evt.Parsed.CommandLine contains '🥏' || evt.Parsed.CommandLine contains '🎱' || evt.Parsed.CommandLine contains '🪀' || evt.Parsed.CommandLine contains '🏓' || evt.Parsed.CommandLine contains '🏸' || evt.Parsed.CommandLine contains '🏒' || evt.Parsed.CommandLine contains '🏑' || evt.Parsed.CommandLine contains '🥍' || evt.Parsed.CommandLine contains '🏏' || evt.Parsed.CommandLine contains '🪃' || evt.Parsed.CommandLine contains '🥅' || evt.Parsed.CommandLine contains '⛳️' || evt.Parsed.CommandLine contains '🪁' || evt.Parsed.CommandLine contains '🏹' || evt.Parsed.CommandLine contains '🎣' || evt.Parsed.CommandLine contains '🤿' || evt.Parsed.CommandLine contains '🥊' || evt.Parsed.CommandLine contains '🥋' || evt.Parsed.CommandLine contains '🎽' || evt.Parsed.CommandLine contains '🛹' || evt.Parsed.CommandLine contains '🛼' || evt.Parsed.CommandLine contains '🛷' || evt.Parsed.CommandLine contains '⛸' || evt.Parsed.CommandLine contains '🥌' || evt.Parsed.CommandLine contains '🎿' || evt.Parsed.CommandLine contains '⛷' || evt.Parsed.CommandLine contains '🏂' || evt.Parsed.CommandLine contains '🪂' || evt.Parsed.CommandLine contains '🏋️‍♀️' || evt.Parsed.CommandLine contains '🏋️' || evt.Parsed.CommandLine contains '🏋️‍♂️' || evt.Parsed.CommandLine contains '🤼‍♀️' || evt.Parsed.CommandLine contains '🤼' || evt.Parsed.CommandLine contains '🤼‍♂️' || evt.Parsed.CommandLine contains '🤸‍♀️' || evt.Parsed.CommandLine contains '🤸' || evt.Parsed.CommandLine contains '🤸‍♂️' || evt.Parsed.CommandLine contains '⛹️‍♀️' || evt.Parsed.CommandLine contains '⛹️' || evt.Parsed.CommandLine contains '⛹️‍♂️' || evt.Parsed.CommandLine contains '🤺' || evt.Parsed.CommandLine contains '🤾‍♀️' || evt.Parsed.CommandLine contains '🤾' || evt.Parsed.CommandLine contains '🤾‍♂️' || evt.Parsed.CommandLine contains '🏌️‍♀️' || evt.Parsed.CommandLine contains '🏌️' || evt.Parsed.CommandLine contains '🏌️‍♂️' || evt.Parsed.CommandLine contains '🏇' || evt.Parsed.CommandLine contains '🧘‍♀️' || evt.Parsed.CommandLine contains '🧘' || evt.Parsed.CommandLine contains '🧘‍♂️' || evt.Parsed.CommandLine contains '🏄‍♀️' || evt.Parsed.CommandLine contains '🏄' || evt.Parsed.CommandLine contains '🏄‍♂️' || evt.Parsed.CommandLine contains '🏊‍♀️' || evt.Parsed.CommandLine contains '🏊' || evt.Parsed.CommandLine contains '🏊‍♂️' || evt.Parsed.CommandLine contains '🤽‍♀️' || evt.Parsed.CommandLine contains '🤽' || evt.Parsed.CommandLine contains '🤽‍♂️' || evt.Parsed.CommandLine contains '🚣‍♀️' || evt.Parsed.CommandLine contains '🚣' || evt.Parsed.CommandLine contains '🚣‍♂️' || evt.Parsed.CommandLine contains '🧗‍♀️' || evt.Parsed.CommandLine contains '🧗' || evt.Parsed.CommandLine contains '🧗‍♂️' || evt.Parsed.CommandLine contains '🚵‍♀️' || evt.Parsed.CommandLine contains '🚵' || evt.Parsed.CommandLine contains '🚵‍♂️' || evt.Parsed.CommandLine contains '🚴‍♀️' || evt.Parsed.CommandLine contains '🚴' || evt.Parsed.CommandLine contains '🚴‍♂️' || evt.Parsed.CommandLine contains '🏆' || evt.Parsed.CommandLine contains '🥇' || evt.Parsed.CommandLine contains '🥈' || evt.Parsed.CommandLine contains '🥉' || evt.Parsed.CommandLine contains '🏅' || evt.Parsed.CommandLine contains '🎖' || evt.Parsed.CommandLine contains '🏵' || evt.Parsed.CommandLine contains '🎗' || evt.Parsed.CommandLine contains '🎫' || evt.Parsed.CommandLine contains '🎟' || evt.Parsed.CommandLine contains '🎪' || evt.Parsed.CommandLine contains '🤹' || evt.Parsed.CommandLine contains '🤹‍♂️' || evt.Parsed.CommandLine contains '🤹‍♀️' || evt.Parsed.CommandLine contains '🎭' || evt.Parsed.CommandLine contains '🩰' || evt.Parsed.CommandLine contains '🎨' || evt.Parsed.CommandLine contains '🎬' || evt.Parsed.CommandLine contains '🎤' || evt.Parsed.CommandLine contains '🎧' || evt.Parsed.CommandLine contains '🎼' || evt.Parsed.CommandLine contains '🎹' || evt.Parsed.CommandLine contains '🥁' || evt.Parsed.CommandLine contains '🪘' || evt.Parsed.CommandLine contains '🎷' || evt.Parsed.CommandLine contains '🎺' || evt.Parsed.CommandLine contains '🪗' || evt.Parsed.CommandLine contains '🎸' || evt.Parsed.CommandLine contains '🪕' || evt.Parsed.CommandLine contains '🎻' || evt.Parsed.CommandLine contains '🎲' || evt.Parsed.CommandLine contains '♟' || evt.Parsed.CommandLine contains '🎯' || evt.Parsed.CommandLine contains '🎳' || evt.Parsed.CommandLine contains '🎮' || evt.Parsed.CommandLine contains '🎰' || evt.Parsed.CommandLine contains '🧩' || evt.Parsed.CommandLine contains '🚗' || evt.Parsed.CommandLine contains '🚕' || evt.Parsed.CommandLine contains '🚙' || evt.Parsed.CommandLine contains '🚌' || evt.Parsed.CommandLine contains '🚎' || evt.Parsed.CommandLine contains '🏎' || evt.Parsed.CommandLine contains '🚓' || evt.Parsed.CommandLine contains '🚑' || evt.Parsed.CommandLine contains '🚒' || evt.Parsed.CommandLine contains '🚐' || evt.Parsed.CommandLine contains '🛻' || evt.Parsed.CommandLine contains '🚚' || evt.Parsed.CommandLine contains '🚛' || evt.Parsed.CommandLine contains '🚜' || evt.Parsed.CommandLine contains '🦯' || evt.Parsed.CommandLine contains '🦽' || evt.Parsed.CommandLine contains '🦼' || evt.Parsed.CommandLine contains '🛴' || evt.Parsed.CommandLine contains '🚲' || evt.Parsed.CommandLine contains '🛵' || evt.Parsed.CommandLine contains '🏍' || evt.Parsed.CommandLine contains '🛺' || evt.Parsed.CommandLine contains '🚨' || evt.Parsed.CommandLine contains '🚔' || evt.Parsed.CommandLine contains '🚍' || evt.Parsed.CommandLine contains '🚘' || evt.Parsed.CommandLine contains '🚖' || evt.Parsed.CommandLine contains '🛞' || evt.Parsed.CommandLine contains '🚡' || evt.Parsed.CommandLine contains '🚠' || evt.Parsed.CommandLine contains '🚟' || evt.Parsed.CommandLine contains '🚃' || evt.Parsed.CommandLine contains '🚋' || evt.Parsed.CommandLine contains '🚞' || evt.Parsed.CommandLine contains '🚝' || evt.Parsed.CommandLine contains '🚄' || evt.Parsed.CommandLine contains '🚅' || evt.Parsed.CommandLine contains '🚈' || evt.Parsed.CommandLine contains '🚂' || evt.Parsed.CommandLine contains '🚆' || evt.Parsed.CommandLine contains '🚇' || evt.Parsed.CommandLine contains '🚊' || evt.Parsed.CommandLine contains '🚉' || evt.Parsed.CommandLine contains '✈️' || evt.Parsed.CommandLine contains '🛫' || evt.Parsed.CommandLine contains '🛬' || evt.Parsed.CommandLine contains '🛩' || evt.Parsed.CommandLine contains '💺' || evt.Parsed.CommandLine contains '🛰' || evt.Parsed.CommandLine contains '🚀' || evt.Parsed.CommandLine contains '🛸' || evt.Parsed.CommandLine contains '🚁' || evt.Parsed.CommandLine contains '🛶' || evt.Parsed.CommandLine contains '⛵️' || evt.Parsed.CommandLine contains '🚤' || evt.Parsed.CommandLine contains '🛥' || evt.Parsed.CommandLine contains '🛳' || evt.Parsed.CommandLine contains '⛴' || evt.Parsed.CommandLine contains '🚢' || evt.Parsed.CommandLine contains '⚓️' || evt.Parsed.CommandLine contains '🛟' || evt.Parsed.CommandLine contains '🪝' || evt.Parsed.CommandLine contains '⛽️' || evt.Parsed.CommandLine contains '🚧' || evt.Parsed.CommandLine contains '🚦' || evt.Parsed.CommandLine contains '🚥' || evt.Parsed.CommandLine contains '🚏' || evt.Parsed.CommandLine contains '🗺' || evt.Parsed.CommandLine contains '🗿' || evt.Parsed.CommandLine contains '🗽' || evt.Parsed.CommandLine contains '🗼' || evt.Parsed.CommandLine contains '🏰' || evt.Parsed.CommandLine contains '🏯' || evt.Parsed.CommandLine contains '🏟' || evt.Parsed.CommandLine contains '🎡' || evt.Parsed.CommandLine contains '🎢' || evt.Parsed.CommandLine contains '🛝' || evt.Parsed.CommandLine contains '🎠' || evt.Parsed.CommandLine contains '⛲️' || evt.Parsed.CommandLine contains '⛱' || evt.Parsed.CommandLine contains '🏖' || evt.Parsed.CommandLine contains '🏝' || evt.Parsed.CommandLine contains '🏜' || evt.Parsed.CommandLine contains '🌋' || evt.Parsed.CommandLine contains '⛰' || evt.Parsed.CommandLine contains '🏔' || evt.Parsed.CommandLine contains '🗻' || evt.Parsed.CommandLine contains '🏕' || evt.Parsed.CommandLine contains '⛺️' || evt.Parsed.CommandLine contains '🛖' || evt.Parsed.CommandLine contains '🏠' || evt.Parsed.CommandLine contains '🏡' || evt.Parsed.CommandLine contains '🏘' || evt.Parsed.CommandLine contains '🏚' || evt.Parsed.CommandLine contains '🏗' || evt.Parsed.CommandLine contains '🏭' || evt.Parsed.CommandLine contains '🏢' || evt.Parsed.CommandLine contains '🏬' || evt.Parsed.CommandLine contains '🏣' || evt.Parsed.CommandLine contains '🏤' || evt.Parsed.CommandLine contains '🏥' || evt.Parsed.CommandLine contains '🏦' || evt.Parsed.CommandLine contains '🏨' || evt.Parsed.CommandLine contains '🏪' || evt.Parsed.CommandLine contains '🏫' || evt.Parsed.CommandLine contains '🏩' || evt.Parsed.CommandLine contains '💒' || evt.Parsed.CommandLine contains '🏛' || evt.Parsed.CommandLine contains '⛪️' || evt.Parsed.CommandLine contains '🕌' || evt.Parsed.CommandLine contains '🕍' || evt.Parsed.CommandLine contains '🛕' || evt.Parsed.CommandLine contains '🕋' || evt.Parsed.CommandLine contains '⛩' || evt.Parsed.CommandLine contains '🛤' || evt.Parsed.CommandLine contains '🛣' || evt.Parsed.CommandLine contains '🗾' || evt.Parsed.CommandLine contains '🎑' || evt.Parsed.CommandLine contains '🏞' || evt.Parsed.CommandLine contains '🌅' || evt.Parsed.CommandLine contains '🌄' || evt.Parsed.CommandLine contains '🌠' || evt.Parsed.CommandLine contains '🎇' || evt.Parsed.CommandLine contains '🎆' || evt.Parsed.CommandLine contains '🌇' || evt.Parsed.CommandLine contains '🌆' || evt.Parsed.CommandLine contains '🏙' || evt.Parsed.CommandLine contains '🌃' || evt.Parsed.CommandLine contains '🌌' || evt.Parsed.CommandLine contains '🌉' || evt.Parsed.CommandLine contains '🌁' || evt.Parsed.CommandLine contains '⌚️' || evt.Parsed.CommandLine contains '📱' || evt.Parsed.CommandLine contains '📲' || evt.Parsed.CommandLine contains '💻' || evt.Parsed.CommandLine contains '⌨️' || evt.Parsed.CommandLine contains '🖥' || evt.Parsed.CommandLine contains '🖨' || evt.Parsed.CommandLine contains '🖱' || evt.Parsed.CommandLine contains '🖲' || evt.Parsed.CommandLine contains '🕹' || evt.Parsed.CommandLine contains '🗜' || evt.Parsed.CommandLine contains '💽' || evt.Parsed.CommandLine contains '💾' || evt.Parsed.CommandLine contains '💿' || evt.Parsed.CommandLine contains '📀' || evt.Parsed.CommandLine contains '📼' || evt.Parsed.CommandLine contains '📷' || evt.Parsed.CommandLine contains '📸' || evt.Parsed.CommandLine contains '📹' || evt.Parsed.CommandLine contains '🎥' || evt.Parsed.CommandLine contains '📽' || evt.Parsed.CommandLine contains '🎞' || evt.Parsed.CommandLine contains '📞' || evt.Parsed.CommandLine contains '☎️' || evt.Parsed.CommandLine contains '📟' || evt.Parsed.CommandLine contains '📠' || evt.Parsed.CommandLine contains '📺' || evt.Parsed.CommandLine contains '📻' || evt.Parsed.CommandLine contains '🎙' || evt.Parsed.CommandLine contains '🎚' || evt.Parsed.CommandLine contains '🎛' || evt.Parsed.CommandLine contains '🧭' || evt.Parsed.CommandLine contains '⏱' || evt.Parsed.CommandLine contains '⏲' || evt.Parsed.CommandLine contains '⏰' || evt.Parsed.CommandLine contains '🕰' || evt.Parsed.CommandLine contains '⌛️' || evt.Parsed.CommandLine contains '⏳' || evt.Parsed.CommandLine contains '📡' || evt.Parsed.CommandLine contains '🔋' || evt.Parsed.CommandLine contains '🪫' || evt.Parsed.CommandLine contains '🔌' || evt.Parsed.CommandLine contains '💡' || evt.Parsed.CommandLine contains '🔦' || evt.Parsed.CommandLine contains '🕯' || evt.Parsed.CommandLine contains '🪔' || evt.Parsed.CommandLine contains '🧯' || evt.Parsed.CommandLine contains '🛢' || evt.Parsed.CommandLine contains '💸' || evt.Parsed.CommandLine contains '💵' || evt.Parsed.CommandLine contains '💴' || evt.Parsed.CommandLine contains '💶' || evt.Parsed.CommandLine contains '💷' || evt.Parsed.CommandLine contains '🪙' || evt.Parsed.CommandLine contains '💰' || evt.Parsed.CommandLine contains '💳' || evt.Parsed.CommandLine contains '💎' || evt.Parsed.CommandLine contains '⚖️' || evt.Parsed.CommandLine contains '🪜' || evt.Parsed.CommandLine contains '🧰' || evt.Parsed.CommandLine contains '🪛' || evt.Parsed.CommandLine contains '🔧' || evt.Parsed.CommandLine contains '🔨' || evt.Parsed.CommandLine contains '⚒' || evt.Parsed.CommandLine contains '🛠' || evt.Parsed.CommandLine contains '⛏' || evt.Parsed.CommandLine contains '🪚' || evt.Parsed.CommandLine contains '🔩' || evt.Parsed.CommandLine contains '⚙️' || evt.Parsed.CommandLine contains '🪤' || evt.Parsed.CommandLine contains '🧱' || evt.Parsed.CommandLine contains '⛓' || evt.Parsed.CommandLine contains '🧲' || evt.Parsed.CommandLine contains '🔫' || evt.Parsed.CommandLine contains '💣' || evt.Parsed.CommandLine contains '🧨' || evt.Parsed.CommandLine contains '🪓' || evt.Parsed.CommandLine contains '🔪' || evt.Parsed.CommandLine contains '🗡' || evt.Parsed.CommandLine contains '⚔️' || evt.Parsed.CommandLine contains '🛡' || evt.Parsed.CommandLine contains '🚬' || evt.Parsed.CommandLine contains '⚰️' || evt.Parsed.CommandLine contains '🪦' || evt.Parsed.CommandLine contains '⚱️' || evt.Parsed.CommandLine contains '🏺' || evt.Parsed.CommandLine contains '🔮' || evt.Parsed.CommandLine contains '📿' || evt.Parsed.CommandLine contains '🧿' || evt.Parsed.CommandLine contains '🪬' || evt.Parsed.CommandLine contains '💈' || evt.Parsed.CommandLine contains '⚗️' || evt.Parsed.CommandLine contains '🔭' || evt.Parsed.CommandLine contains '🔬' || evt.Parsed.CommandLine contains '🕳' || evt.Parsed.CommandLine contains '🩹' || evt.Parsed.CommandLine contains '🩺' || evt.Parsed.CommandLine contains '🩻' || evt.Parsed.CommandLine contains '🩼' || evt.Parsed.CommandLine contains '💊' || evt.Parsed.CommandLine contains '💉' || evt.Parsed.CommandLine contains '🩸' || evt.Parsed.CommandLine contains '🧬' || evt.Parsed.CommandLine contains '🦠' || evt.Parsed.CommandLine contains '🧫' || evt.Parsed.CommandLine contains '🧪' || evt.Parsed.CommandLine contains '🌡' || evt.Parsed.CommandLine contains '🧹' || evt.Parsed.CommandLine contains '🪠' || evt.Parsed.CommandLine contains '🧺' || evt.Parsed.CommandLine contains '🧻' || evt.Parsed.CommandLine contains '🚽' || evt.Parsed.CommandLine contains '🚰' || evt.Parsed.CommandLine contains '🚿' || evt.Parsed.CommandLine contains '🛁' || evt.Parsed.CommandLine contains '🛀' || evt.Parsed.CommandLine contains '🧼' || evt.Parsed.CommandLine contains '🪥' || evt.Parsed.CommandLine contains '🪒' || evt.Parsed.CommandLine contains '🧽' || evt.Parsed.CommandLine contains '🪣' || evt.Parsed.CommandLine contains '🧴' || evt.Parsed.CommandLine contains '🛎' || evt.Parsed.CommandLine contains '🔑' || evt.Parsed.CommandLine contains '🗝' || evt.Parsed.CommandLine contains '🚪' || evt.Parsed.CommandLine contains '🪑' || evt.Parsed.CommandLine contains '🛋' || evt.Parsed.CommandLine contains '🛏' || evt.Parsed.CommandLine contains '🛌' || evt.Parsed.CommandLine contains '🧸' || evt.Parsed.CommandLine contains '🪆' || evt.Parsed.CommandLine contains '🖼' || evt.Parsed.CommandLine contains '🪞' || evt.Parsed.CommandLine contains '🪟' || evt.Parsed.CommandLine contains '🛍' || evt.Parsed.CommandLine contains '🛒' || evt.Parsed.CommandLine contains '🎁' || evt.Parsed.CommandLine contains '🎈' || evt.Parsed.CommandLine contains '🎏' || evt.Parsed.CommandLine contains '🎀' || evt.Parsed.CommandLine contains '🪄' || evt.Parsed.CommandLine contains '🪅' || evt.Parsed.CommandLine contains '🎊' || evt.Parsed.CommandLine contains '🎉' || evt.Parsed.CommandLine contains '🪩' || evt.Parsed.CommandLine contains '🎎' || evt.Parsed.CommandLine contains '🏮' || evt.Parsed.CommandLine contains '🎐' || evt.Parsed.CommandLine contains '🧧' || evt.Parsed.CommandLine contains '✉️' || evt.Parsed.CommandLine contains '📩' || evt.Parsed.CommandLine contains '📨' || evt.Parsed.CommandLine contains '📧' || evt.Parsed.CommandLine contains '💌' || evt.Parsed.CommandLine contains '📥' || evt.Parsed.CommandLine contains '📤' || evt.Parsed.CommandLine contains '📦' || evt.Parsed.CommandLine contains '🏷' || evt.Parsed.CommandLine contains '🪧' || evt.Parsed.CommandLine contains '📪' || evt.Parsed.CommandLine contains '📫' || evt.Parsed.CommandLine contains '📬' || evt.Parsed.CommandLine contains '📭' || evt.Parsed.CommandLine contains '📮' || evt.Parsed.CommandLine contains '📯' || evt.Parsed.CommandLine contains '📜' || evt.Parsed.CommandLine contains '📃' || evt.Parsed.CommandLine contains '📄' || evt.Parsed.CommandLine contains '📑' || evt.Parsed.CommandLine contains '🧾' || evt.Parsed.CommandLine contains '📊' || evt.Parsed.CommandLine contains '📈' || evt.Parsed.CommandLine contains '📉' || evt.Parsed.CommandLine contains '🗒' || evt.Parsed.CommandLine contains '🗓' || evt.Parsed.CommandLine contains '📆' || evt.Parsed.CommandLine contains '📅' || evt.Parsed.CommandLine contains '🗑' || evt.Parsed.CommandLine contains '🪪' || evt.Parsed.CommandLine contains '📇' || evt.Parsed.CommandLine contains '🗃' || evt.Parsed.CommandLine contains '🗳' || evt.Parsed.CommandLine contains '🗄' || evt.Parsed.CommandLine contains '📋' || evt.Parsed.CommandLine contains '📁' || evt.Parsed.CommandLine contains '📂' || evt.Parsed.CommandLine contains '🗂' || evt.Parsed.CommandLine contains '🗞' || evt.Parsed.CommandLine contains '📰' || evt.Parsed.CommandLine contains '📓' || evt.Parsed.CommandLine contains '📔' || evt.Parsed.CommandLine contains '📒' || evt.Parsed.CommandLine contains '📕' || evt.Parsed.CommandLine contains '📗' || evt.Parsed.CommandLine contains '📘' || evt.Parsed.CommandLine contains '📙' || evt.Parsed.CommandLine contains '📚' || evt.Parsed.CommandLine contains '📖' || evt.Parsed.CommandLine contains '🔖' || evt.Parsed.CommandLine contains '🧷' || evt.Parsed.CommandLine contains '🔗' || evt.Parsed.CommandLine contains '📎' || evt.Parsed.CommandLine contains '🖇' || evt.Parsed.CommandLine contains '📐' || evt.Parsed.CommandLine contains '📏' || evt.Parsed.CommandLine contains '🧮' || evt.Parsed.CommandLine contains '📌' || evt.Parsed.CommandLine contains '📍' || evt.Parsed.CommandLine contains '✂️' || evt.Parsed.CommandLine contains '🖊' || evt.Parsed.CommandLine contains '🖋' || evt.Parsed.CommandLine contains '✒️' || evt.Parsed.CommandLine contains '🖌' || evt.Parsed.CommandLine contains '🖍' || evt.Parsed.CommandLine contains '📝' || evt.Parsed.CommandLine contains '✏️' || evt.Parsed.CommandLine contains '🔍' || evt.Parsed.CommandLine contains '🔎' || evt.Parsed.CommandLine contains '🔏' || evt.Parsed.CommandLine contains '🔐' || evt.Parsed.CommandLine contains '🔒' || evt.Parsed.CommandLine contains '🔓❤️' || evt.Parsed.CommandLine contains '🧡' || evt.Parsed.CommandLine contains '💛' || evt.Parsed.CommandLine contains '💚' || evt.Parsed.CommandLine contains '💙' || evt.Parsed.CommandLine contains '💜' || evt.Parsed.CommandLine contains '🖤' || evt.Parsed.CommandLine contains '🤍' || evt.Parsed.CommandLine contains '🤎' || evt.Parsed.CommandLine contains '❤️‍🔥' || evt.Parsed.CommandLine contains '❤️‍🩹' || evt.Parsed.CommandLine contains '💔' || evt.Parsed.CommandLine contains '❣️' || evt.Parsed.CommandLine contains '💕' || evt.Parsed.CommandLine contains '💞' || evt.Parsed.CommandLine contains '💓' || evt.Parsed.CommandLine contains '💗' || evt.Parsed.CommandLine contains '💖' || evt.Parsed.CommandLine contains '💘' || evt.Parsed.CommandLine contains '💝' || evt.Parsed.CommandLine contains '💟' || evt.Parsed.CommandLine contains '☮️' || evt.Parsed.CommandLine contains '✝️' || evt.Parsed.CommandLine contains '☪️' || evt.Parsed.CommandLine contains '🕉' || evt.Parsed.CommandLine contains '☸️' || evt.Parsed.CommandLine contains '✡️' || evt.Parsed.CommandLine contains '🔯' || evt.Parsed.CommandLine contains '🕎' || evt.Parsed.CommandLine contains '☯️' || evt.Parsed.CommandLine contains '☦️' || evt.Parsed.CommandLine contains '🛐' || evt.Parsed.CommandLine contains '⛎' || evt.Parsed.CommandLine contains '♈️' || evt.Parsed.CommandLine contains '♉️' || evt.Parsed.CommandLine contains '♊️' || evt.Parsed.CommandLine contains '♋️' || evt.Parsed.CommandLine contains '♌️' || evt.Parsed.CommandLine contains '♍️' || evt.Parsed.CommandLine contains '♎️' || evt.Parsed.CommandLine contains '♏️' || evt.Parsed.CommandLine contains '♐️' || evt.Parsed.CommandLine contains '♑️' || evt.Parsed.CommandLine contains '♒️' || evt.Parsed.CommandLine contains '♓️' || evt.Parsed.CommandLine contains '🆔' || evt.Parsed.CommandLine contains '⚛️' || evt.Parsed.CommandLine contains '🉑' || evt.Parsed.CommandLine contains '☢️' || evt.Parsed.CommandLine contains '☣️' || evt.Parsed.CommandLine contains '📴' || evt.Parsed.CommandLine contains '📳' || evt.Parsed.CommandLine contains '🈶' || evt.Parsed.CommandLine contains '🈚️' || evt.Parsed.CommandLine contains '🈸' || evt.Parsed.CommandLine contains '🈺' || evt.Parsed.CommandLine contains '🈷️' || evt.Parsed.CommandLine contains '✴️' || evt.Parsed.CommandLine contains '🆚' || evt.Parsed.CommandLine contains '💮' || evt.Parsed.CommandLine contains '🉐' || evt.Parsed.CommandLine contains '㊙️' || evt.Parsed.CommandLine contains '㊗️' || evt.Parsed.CommandLine contains '🈴' || evt.Parsed.CommandLine contains '🈵' || evt.Parsed.CommandLine contains '🈹' || evt.Parsed.CommandLine contains '🈲' || evt.Parsed.CommandLine contains '🅰️' || evt.Parsed.CommandLine contains '🅱️' || evt.Parsed.CommandLine contains '🆎' || evt.Parsed.CommandLine contains '🆑' || evt.Parsed.CommandLine contains '🅾️' || evt.Parsed.CommandLine contains '🆘' || evt.Parsed.CommandLine contains '❌' || evt.Parsed.CommandLine contains '⭕️' || evt.Parsed.CommandLine contains '🛑' || evt.Parsed.CommandLine contains '⛔️' || evt.Parsed.CommandLine contains '📛' || evt.Parsed.CommandLine contains '🚫' || evt.Parsed.CommandLine contains '💯' || evt.Parsed.CommandLine contains '💢' || evt.Parsed.CommandLine contains '♨️' || evt.Parsed.CommandLine contains '🚷' || evt.Parsed.CommandLine contains '🚯' || evt.Parsed.CommandLine contains '🚳' || evt.Parsed.CommandLine contains '🚱' || evt.Parsed.CommandLine contains '🔞' || evt.Parsed.CommandLine contains '📵' || evt.Parsed.CommandLine contains '🚭' || evt.Parsed.CommandLine contains '❗️' || evt.Parsed.CommandLine contains '❕' || evt.Parsed.CommandLine contains '❓' || evt.Parsed.CommandLine contains '❔' || evt.Parsed.CommandLine contains '‼️' || evt.Parsed.CommandLine contains '⁉️' || evt.Parsed.CommandLine contains '🔅' || evt.Parsed.CommandLine contains '🔆' || evt.Parsed.CommandLine contains '〽️' || evt.Parsed.CommandLine contains '⚠️' || evt.Parsed.CommandLine contains '🚸' || evt.Parsed.CommandLine contains '🔱' || evt.Parsed.CommandLine contains '⚜️' || evt.Parsed.CommandLine contains '🔰' || evt.Parsed.CommandLine contains '♻️' || evt.Parsed.CommandLine contains '✅' || evt.Parsed.CommandLine contains '🈯️' || evt.Parsed.CommandLine contains '💹' || evt.Parsed.CommandLine contains '❇️' || evt.Parsed.CommandLine contains '✳️' || evt.Parsed.CommandLine contains '❎' || evt.Parsed.CommandLine contains '🌐' || evt.Parsed.CommandLine contains '💠' || evt.Parsed.CommandLine contains 'Ⓜ️' || evt.Parsed.CommandLine contains '🌀' || evt.Parsed.CommandLine contains '💤' || evt.Parsed.CommandLine contains '🏧' || evt.Parsed.CommandLine contains '🚾' || evt.Parsed.CommandLine contains '♿️' || evt.Parsed.CommandLine contains '🅿️' || evt.Parsed.CommandLine contains '🛗' || evt.Parsed.CommandLine contains '🈳' || evt.Parsed.CommandLine contains '🈂️' || evt.Parsed.CommandLine contains '🛂' || evt.Parsed.CommandLine contains '🛃' || evt.Parsed.CommandLine contains '🛄' || evt.Parsed.CommandLine contains '🛅' || evt.Parsed.CommandLine contains '🚹' || evt.Parsed.CommandLine contains '🚺' || evt.Parsed.CommandLine contains '🚼' || evt.Parsed.CommandLine contains '⚧' || evt.Parsed.CommandLine contains '🚻' || evt.Parsed.CommandLine contains '🚮' || evt.Parsed.CommandLine contains '🎦' || evt.Parsed.CommandLine contains '📶' || evt.Parsed.CommandLine contains '🈁' || evt.Parsed.CommandLine contains '🔣' || evt.Parsed.CommandLine contains 'ℹ️' || evt.Parsed.CommandLine contains '🔤' || evt.Parsed.CommandLine contains '🔡' || evt.Parsed.CommandLine contains '🔠' || evt.Parsed.CommandLine contains '🆖' || evt.Parsed.CommandLine contains '🆗' || evt.Parsed.CommandLine contains '🆙' || evt.Parsed.CommandLine contains '🆒' || evt.Parsed.CommandLine contains '🆕' || evt.Parsed.CommandLine contains '🆓' || evt.Parsed.CommandLine contains '0️⃣' || evt.Parsed.CommandLine contains '1️⃣' || evt.Parsed.CommandLine contains '2️⃣' || evt.Parsed.CommandLine contains '3️⃣' || evt.Parsed.CommandLine contains '4️⃣' || evt.Parsed.CommandLine contains '5️⃣' || evt.Parsed.CommandLine contains '6️⃣' || evt.Parsed.CommandLine contains '7️⃣' || evt.Parsed.CommandLine contains '8️⃣' || evt.Parsed.CommandLine contains '9️⃣' || evt.Parsed.CommandLine contains '🔟' || evt.Parsed.CommandLine contains '🔢' || evt.Parsed.CommandLine contains '#️⃣' || evt.Parsed.CommandLine contains '️⃣' || evt.Parsed.CommandLine contains '⏏️' || evt.Parsed.CommandLine contains '▶️' || evt.Parsed.CommandLine contains '⏸' || evt.Parsed.CommandLine contains '⏯' || evt.Parsed.CommandLine contains '⏹' || evt.Parsed.CommandLine contains '⏺' || evt.Parsed.CommandLine contains '⏭' || evt.Parsed.CommandLine contains '⏮' || evt.Parsed.CommandLine contains '⏩' || evt.Parsed.CommandLine contains '⏪' || evt.Parsed.CommandLine contains '⏫' || evt.Parsed.CommandLine contains '⏬' || evt.Parsed.CommandLine contains '◀️' || evt.Parsed.CommandLine contains '🔼' || evt.Parsed.CommandLine contains '🔽' || evt.Parsed.CommandLine contains '➡️' || evt.Parsed.CommandLine contains '⬅️' || evt.Parsed.CommandLine contains '⬆️' || evt.Parsed.CommandLine contains '⬇️' || evt.Parsed.CommandLine contains '↗️' || evt.Parsed.CommandLine contains '↘️' || evt.Parsed.CommandLine contains '↙️' || evt.Parsed.CommandLine contains '↖️' || evt.Parsed.CommandLine contains '↕️' || evt.Parsed.CommandLine contains '↔️' || evt.Parsed.CommandLine contains '↪️' || evt.Parsed.CommandLine contains '↩️' || evt.Parsed.CommandLine contains '⤴️' || evt.Parsed.CommandLine contains '⤵️' || evt.Parsed.CommandLine contains '🔀' || evt.Parsed.CommandLine contains '🔁' || evt.Parsed.CommandLine contains '🔂' || evt.Parsed.CommandLine contains '🔄' || evt.Parsed.CommandLine contains '🔃' || evt.Parsed.CommandLine contains '🎵' || evt.Parsed.CommandLine contains '🎶' || evt.Parsed.CommandLine contains '➕' || evt.Parsed.CommandLine contains '➖' || evt.Parsed.CommandLine contains '➗' || evt.Parsed.CommandLine contains '✖️' || evt.Parsed.CommandLine contains '🟰' || evt.Parsed.CommandLine contains '♾' || evt.Parsed.CommandLine contains '💲' || evt.Parsed.CommandLine contains '💱' || evt.Parsed.CommandLine contains '™️' || evt.Parsed.CommandLine contains '©️' || evt.Parsed.CommandLine contains '®️' || evt.Parsed.CommandLine contains '〰️' || evt.Parsed.CommandLine contains '➰' || evt.Parsed.CommandLine contains '➿' || evt.Parsed.CommandLine contains '🔚' || evt.Parsed.CommandLine contains '🔙' || evt.Parsed.CommandLine contains '🔛' || evt.Parsed.CommandLine contains '🔝' || evt.Parsed.CommandLine contains '🔜' || evt.Parsed.CommandLine contains '✔️' || evt.Parsed.CommandLine contains '☑️' || evt.Parsed.CommandLine contains '🔘' || evt.Parsed.CommandLine contains '🔴' || evt.Parsed.CommandLine contains '🟠' || evt.Parsed.CommandLine contains '🟡' || evt.Parsed.CommandLine contains '🟢' || evt.Parsed.CommandLine contains '🔵' || evt.Parsed.CommandLine contains '🟣' || evt.Parsed.CommandLine contains '⚫️' || evt.Parsed.CommandLine contains '⚪️' || evt.Parsed.CommandLine contains '🟤' || evt.Parsed.CommandLine contains '🔺' || evt.Parsed.CommandLine contains '🔻')

7blackhole: 2m

8#status: test

9labels:

10 service: windows

11 confidence: 1

12 spoofable: 0

13 classification:

15 label: "Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 3"

16 behavior : "windows:audit"

17 remediation: false

19scope:

20 type: ParentProcessId

21 expression: evt.Parsed.ParentProcessId

Hub configuration

« Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 3 »v0.2 by sigmahq / proc_creation_win_susp_emoji_usage_in_cli_3Attack scenariowindowsNot spoofableLow confidence

« Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 3 »
v0.2 by sigmahq / proc_creation_win_susp_emoji_usage_in_cli_3
Attack scenariowindowsNot spoofableLow confidence