Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 1

Hunt Hypothesis

Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.

Detection Rule

Sigma (Original)

title: Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 1
id: 4a30ac0c-b9d6-4e01-b71a-5f851bbf4259
status: test
description: Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.
author: '@Kostastsale, TheDFIRReport'
references:
    - Internal Research
tags:
    - attack.stealth
date: 2022-12-05
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        CommandLine|contains:
            - '😀'
            - '😃'
            - '😄'
            - '😁'
            - '😆'
            - '😅'
            - '😂'
            - '🤣'
            - '🥲'
            - '🥹'
            - '☺️'
            - '😊'
            - '😇'
            - '🙂'
            - '🙃'
            - '😉'
            - '😌'
            - '😍'
            - '🥰'
            - '😘'
            - '😗'
            - '😙'
            - '😚'
            - '😋'
            - '😛'
            - '😝'
            - '😜'
            - '🤪'
            - '🤨'
            - '🧐'
            - '🤓'
            - '😎'
            - '🥸'
            - '🤩'
            - '🥳'
            - '😏'
            - '😒'
            - '😞'
            - '😔'
            - '😟'
            - '😕'
            - '🙁'
            - '☹️'
            - '😣'
            - '😖'
            - '😫'
            - '😩'
            - '🥺'
            - '😢'
            - '😭'
            - '😮‍💨'
            - '😤'
            - '😠'
            - '😡'
            - '🤬'
            - '🤯'
            - '😳'
            - '🥵'
            - '🥶'
            - '😱'
            - '😨'
            - '😰'
            - '😥'
            - '😓'
            - '🫣'
            - '🤗'
            - '🫡'
            - '🤔'
            - '🫢'
            - '🤭'
            - '🤫'
            - '🤥'
            - '😶'
            - '😶‍🌫️'
            - '😐'
            - '😑'
            - '😬'
            - '🫠'
            - '🙄'
            - '😯'
            - '😦'
            - '😧'
            - '😮'
            - '😲'
            - '🥱'
            - '😴'
            - '🤤'
            - '😪'
            - '😵'
            - '😵‍💫'
            - '🫥'
            - '🤐'
            - '🥴'
            - '🤢'
            - '🤮'
            - '🤧'
            - '😷'
            - '🤒'
            - '🤕'
            - '🤑'
            - '🤠'
            - '😈'
            - '👿'
            - '👹'
            - '👺'
            - '🤡'
            - '💩'
            - '👻'
            - '💀'
            - '☠️'
            - '👽'
            - '👾'
            - '🤖'
            - '🎃'
            - '😺'
            - '😸'
            - '😹'
            - '😻'
            - '😼'
            - '😽'
            - '🙀'
            - '😿'
            - '😾'
            - '👋'
            - '🤚'
            - '🖐'
            - '✋'
            - '🖖'
            - '👌'
            - '🤌'
            - '🤏'
            - '✌️'
            - '🤞'
            - '🫰'
            - '🤟'
            - '🤘'
            - '🤙'
            - '🫵'
            - '🫱'
            - '🫲'
            - '🫳'
            - '🫴'
            - '👈'
            - '👉'
            - '👆'
            - '🖕'
            - '👇'
            - '☝️'
            - '👍'
            - '👎'
            - '✊'
            - '👊'
            - '🤛'
            - '🤜'
            - '👏'
            - '🫶'
            - '🙌'
            - '👐'
            - '🤲'
            - '🤝'
            - '🙏'
            - '✍️'
            - '💪'
            - '🦾'
            - '🦵'
            - '🦿'
            - '🦶'
            - '👣'
            - '👂'
            - '🦻'
            - '👃'
            - '🫀'
            - '🫁'
            - '🧠'
            - '🦷'
            - '🦴'
            - '👀'
            - '👁'
            - '👅'
            - '👄'
            - '🫦'
            - '💋'
            - '🩸'
            - '👶'
            - '👧'
            - '🧒'
            - '👦'
            - '👩'
            - '🧑'
            - '👨'
            - '👩‍🦱'
            - '🧑‍🦱'
            - '👨‍🦱'
            - '👩‍🦰'
            - '🧑‍🦰'
            - '👨‍🦰'
            - '👱‍♀️'
            - '👱'
            - '👱‍♂️'
            - '👩‍🦳'
            - '🧑‍🦳'
            - '👨‍🦳'
            - '👩‍🦲'
            - '🧑‍🦲'
            - '👨‍🦲'
            - '🧔‍♀️'
            - '🧔'
            - '🧔‍♂️'
            - '👵'
            - '🧓'
            - '👴'
            - '👲'
            - '👳‍♀️'
            - '👳'
            - '👳‍♂️'
            - '🧕'
            - '👮‍♀️'
            - '👮'
            - '👮‍♂️'
            - '👷‍♀️'
            - '👷'
            - '👷‍♂️'
            - '💂‍♀️'
            - '💂'
            - '💂‍♂️'
            - '🕵️‍♀️'
            - '🕵️'
            - '🕵️‍♂️'
            - '👩‍⚕️'
            - '🧑‍⚕️'
            - '👨‍⚕️'
            - '👩‍🌾'
            - '🧑‍🌾'
            - '👨‍🌾'
            - '👩‍🍳'
            - '🧑‍🍳'
            - '👨‍🍳'
            - '👩‍🎓'
            - '🧑‍🎓'
            - '👨‍🎓'
            - '👩‍🎤'
            - '🧑‍🎤'
            - '👨‍🎤'
            - '👩‍🏫'
            - '🧑‍🏫'
            - '👨‍🏫'
            - '👩‍🏭'
            - '🧑‍🏭'
            - '👨‍🏭'
            - '👩‍💻'
            - '🧑‍💻'
            - '👨‍💻'
            - '👩‍💼'
            - '🧑‍💼'
            - '👨‍💼'
            - '👩‍🔧'
            - '🧑‍🔧'
            - '👨‍🔧'
            - '👩‍🔬'
            - '🧑‍🔬'
            - '👨‍🔬'
            - '👩‍🎨'
            - '🧑‍🎨'
            - '👨‍🎨'
            - '👩‍🚒'
            - '🧑‍🚒'
            - '👨‍🚒'
            - '👩‍✈️'
            - '🧑‍✈️'
            - '👨‍✈️'
            - '👩‍🚀'
            - '🧑‍🚀'
            - '👨‍🚀'
            - '👩‍⚖️'
            - '🧑‍⚖️'
            - '👨‍⚖️'
            - '👰‍♀️'
            - '👰'
            - '👰‍♂️'
            - '🤵‍♀️'
            - '🤵'
            - '🤵‍♂️'
            - '👸'
            - '🫅'
            - '🤴'
            - '🥷'
            - '🦸‍♀️'
            - '🦸'
            - '🦸‍♂️'
            - '🦹‍♀️'
            - '🦹'
            - '🦹‍♂️'
            - '🤶'
            - '🧑‍🎄'
            - '🎅'
            - '🧙‍♀️'
            - '🧙'
            - '🧙‍♂️'
            - '🧝‍♀️'
            - '🧝'
            - '🧝‍♂️'
            - '🧛‍♀️'
            - '🧛'
            - '🧛‍♂️'
            - '🧟‍♀️'
            - '🧟'
            - '🧟‍♂️'
            - '🧞‍♀️'
            - '🧞'
            - '🧞‍♂️'
            - '🧜‍♀️'
            - '🧜'
            - '🧜‍♂️'
            - '🧚‍♀️'
            - '🧚'
            - '🧚‍♂️'
            - '🧌'
            - '👼'
            - '🤰'
            - '🫄'
            - '🫃'
            - '🤱'
            - '👩‍🍼'
            - '🧑‍🍼'
            - '👨‍🍼'
            - '🙇‍♀️'
            - '🙇'
            - '🙇‍♂️'
            - '💁‍♀️'
            - '💁'
            - '💁‍♂️'
            - '🙅‍♀️'
            - '🙅'
            - '🙅‍♂️'
            - '🙆‍♀️'
            - '🙆'
            - '🙆‍♂️'
            - '🙋‍♀️'
            - '🙋'
            - '🙋‍♂️'
            - '🧏‍♀️'
            - '🧏'
            - '🧏‍♂️'
            - '🤦‍♀️'
            - '🤦'
            - '🤦‍♂️'
            - '🤷‍♀️'
            - '🤷'
            - '🤷‍♂️'
            - '🙎‍♀️'
            - '🙎'
            - '🙎‍♂️'
            - '🙍‍♀️'
            - '🙍'
            - '🙍‍♂️'
            - '💇‍♀️'
            - '💇'
            - '💇‍♂️'
            - '💆‍♀️'
            - '💆'
            - '💆‍♂️'
            - '🧖‍♀️'
            - '🧖'
            - '🧖‍♂️'
            - '💅'
            - '💃'
            - '🕺'
            - '👯‍♀️'
            - '👯'
            - '👯‍♂️'
            - '🕴'
            - '👩‍🦽'
            - '🧑‍🦽'
            - '👨‍🦽'
            - '👩‍🦼'
            - '🧑‍🦼'
            - '👨‍🦼'
            - '🚶‍♀️'
            - '🚶'
            - '🚶‍♂️'
            - '👩‍🦯'
            - '🧑‍🦯'
            - '👨‍🦯'
            - '🧎‍♀️'
            - '🧎'
            - '🧎‍♂️'
            - '🏃‍♀️'
            - '🏃'
            - '🏃‍♂️'
            - '🧍‍♀️'
            - '🧍'
            - '🧍‍♂️'
            - '👭'
            - '🧑‍🤝‍🧑'
            - '👬'
            - '👫'
            - '👩‍❤️‍👩'
            - '💑'
            - '👨‍❤️‍👨'
            - '👩‍❤️‍👨'
            - '👩‍❤️‍💋‍👩'
            - '💏'
            - '👨‍❤️‍💋‍👨'
            - '👩‍❤️‍💋‍👨'
            - '👪'
            - '👨‍👩‍👦'
            - '👨‍👩‍👧'
            - '👨‍👩‍👧‍👦'
            - '👨‍👩‍👦‍👦'
            - '👨‍👩‍👧‍👧'
            - '👨‍👨‍👦'
            - '👨‍👨‍👧'
            - '👨‍👨‍👧‍👦'
            - '👨‍👨‍👦‍👦'
            - '👨‍👨‍👧‍👧'
            - '👩‍👩‍👦'
            - '👩‍👩‍👧'
            - '👩‍👩‍👧‍👦'
            - '👩‍👩‍👦‍👦'
            - '👩‍👩‍👧‍👧'
            - '👨‍👦'
            - '👨‍👦‍👦'
            - '👨‍👧'
            - '👨‍👧‍👦'
            - '👨‍👧‍👧'
            - '👩‍👦'
            - '👩‍👦‍👦'
            - '👩‍👧'
            - '👩‍👧‍👦'
            - '👩‍👧‍👧'
            - '🗣'
            - '👤'
            - '👥'
            - '🫂'
            - '🧳'
            - '🌂'
            - '☂️'
            - '🧵'
            - '🪡'
            - '🪢'
            - '🧶'
            - '👓'
            - '🕶'
            - '🥽'
            - '🥼'
            - '🦺'
            - '👔'
            - '👕'
            - '👖'
            - '🧣'
            - '🧤'
            - '🧥'
            - '🧦'
            - '👗'
            - '👘'
            - '🥻'
            - '🩴'
            - '🩱'
            - '🩲'
            - '🩳'
            - '👙'
            - '👚'
            - '👛'
            - '👜'
            - '👝'
            - '🎒'
            - '👞'
            - '👟'
            - '🥾'
            - '🥿'
            - '👠'
            - '👡'
            - '🩰'
            - '👢'
            - '👑'
            - '👒'
            - '🎩'
            - '🎓'
            - '🧢'
            - '⛑'
            - '🪖'
            - '💄'
            - '💍'
            - '💼'
            - '👋🏻'
            - '🤚🏻'
            - '🖐🏻'
            - '✋🏻'
            - '🖖🏻'
            - '👌🏻'
            - '🤌🏻'
            - '🤏🏻'
            - '✌🏻'
            - '🤞🏻'
            - '🫰🏻'
            - '🤟🏻'
            - '🤘🏻'
            - '🤙🏻'
            - '🫵🏻'
            - '🫱🏻'
            - '🫲🏻'
            - '🫳🏻'
            - '🫴🏻'
            - '👈🏻'
            - '👉🏻'
            - '👆🏻'
            - '🖕🏻'
            - '👇🏻'
            - '☝🏻'
            - '👍🏻'
            - '👎🏻'
            - '✊🏻'
            - '👊🏻'
            - '🤛🏻'
            - '🤜🏻'
            - '👏🏻'
            - '🫶🏻'
            - '🙌🏻'
            - '👐🏻'
            - '🤲🏻'
            - '🙏🏻'
            - '✍🏻'
            - '💪🏻'
            - '🦵🏻'
            - '🦶🏻'
            - '👂🏻'
            - '🦻🏻'
            - '👃🏻'
            - '👶🏻'
            - '👧🏻'
            - '🧒🏻'
            - '👦🏻'
            - '👩🏻'
            - '🧑🏻'
            - '👨🏻'
            - '👩🏻‍🦱'
            - '🧑🏻‍🦱'
            - '👨🏻‍🦱'
            - '👩🏻‍🦰'
            - '🧑🏻‍🦰'
            - '👨🏻‍🦰'
            - '👱🏻‍♀️'
            - '👱🏻'
            - '👱🏻‍♂️'
            - '👩🏻‍🦳'
            - '🧑🏻‍🦳'
            - '👨🏻‍🦳'
            - '👩🏻‍🦲'
            - '🧑🏻‍🦲'
            - '👨🏻‍🦲'
            - '🧔🏻‍♀️'
            - '🧔🏻'
            - '🧔🏻‍♂️'
            - '👵🏻'
            - '🧓🏻'
            - '👴🏻'
            - '👲🏻'
            - '👳🏻‍♀️'
            - '👳🏻'
            - '👳🏻‍♂️'
            - '🧕🏻'
            - '👮🏻‍♀️'
            - '👮🏻'
            - '👮🏻‍♂️'
            - '👷🏻‍♀️'
            - '👷🏻'
            - '👷🏻‍♂️'
            - '💂🏻‍♀️'
            - '💂🏻'
            - '💂🏻‍♂️'
            - '🕵🏻‍♀️'
            - '🕵🏻'
            - '🕵🏻‍♂️'
            - '👩🏻‍⚕️'
            - '🧑🏻‍⚕️'
            - '👨🏻‍⚕️'
            - '👩🏻‍🌾'
            - '🧑🏻‍🌾'
            - '👨🏻‍🌾'
            - '👩🏻‍🍳'
            - '🧑🏻‍🍳'
            - '👨🏻‍🍳'
            - '👩🏻‍🎓'
            - '🧑🏻‍🎓'
            - '👨🏻‍🎓'
            - '👩🏻‍🎤'
            - '🧑🏻‍🎤'
            - '👨🏻‍🎤'
            - '👩🏻‍🏫'
            - '🧑🏻‍🏫'
            - '👨🏻‍🏫'
            - '👩🏻‍🏭'
            - '🧑🏻‍🏭'
            - '👨🏻‍🏭'
            - '👩🏻‍💻'
            - '🧑🏻‍💻'
            - '👨🏻‍💻'
            - '👩🏻‍💼'
            - '🧑🏻‍💼'
            - '👨🏻‍💼'
            - '👩🏻‍🔧'
            - '🧑🏻‍🔧'
            - '👨🏻‍🔧'
            - '👩🏻‍🔬'
            - '🧑🏻‍🔬'
            - '👨🏻‍🔬'
            - '👩🏻‍🎨'
            - '🧑🏻‍🎨'
            - '👨🏻‍🎨'
            - '👩🏻‍🚒'
            - '🧑🏻‍🚒'
            - '👨🏻‍🚒'
            - '👩🏻‍✈️'
            - '🧑🏻‍✈️'
            - '👨🏻‍✈️'
            - '👩🏻‍🚀'
            - '🧑🏻‍🚀'
            - '👨🏻‍🚀'
            - '👩🏻‍⚖️'
            - '🧑🏻‍⚖️'
            - '👨🏻‍⚖️'
            - '👰🏻‍♀️'
            - '👰🏻'
            - '👰🏻‍♂️'
            - '🤵🏻‍♀️'
            - '🤵🏻'
            - '🤵🏻‍♂️'
            - '👸🏻'
            - '🫅🏻'
            - '🤴🏻'
            - '🥷🏻'
            - '🦸🏻‍♀️'
            - '🦸🏻'
            - '🦸🏻‍♂️'
            - '🦹🏻‍♀️'
            - '🦹🏻'
            - '🦹🏻‍♂️'
            - '🤶🏻'
            - '🧑🏻‍🎄'
            - '🎅🏻'
            - '🧙🏻‍♀️'
            - '🧙🏻'
            - '🧙🏻‍♂️'
            - '🧝🏻‍♀️'
            - '🧝🏻'
            - '🧝🏻‍♂️'
            - '🧛🏻‍♀️'
            - '🧛🏻'
            - '🧛🏻‍♂️'
            - '🧜🏻‍♀️'
            - '🧜🏻'
            - '🧜🏻‍♂️'
            - '🧚🏻‍♀️'
            - '🧚🏻'
            - '🧚🏻‍♂️'
            - '👼🏻'
            - '🤰🏻'
            - '🫄🏻'
            - '🫃🏻'
            - '🤱🏻'
            - '👩🏻‍🍼'
            - '🧑🏻‍🍼'
            - '👨🏻‍🍼'
            - '🙇🏻‍♀️'
            - '🙇🏻'
            - '🙇🏻‍♂️'
            - '💁🏻‍♀️'
            - '💁🏻'
            - '💁🏻‍♂️'
            - '🙅🏻‍♀️'
            - '🙅🏻'
            - '🙅🏻‍♂️'
            - '🙆🏻‍♀️'
            - '🙆🏻'
            - '🙆🏻‍♂️'
            - '🙋🏻‍♀️'
            - '🙋🏻'
            - '🙋🏻‍♂️'
            - '🧏🏻‍♀️'
            - '🧏🏻'
            - '🧏🏻‍♂️'
            - '🤦🏻‍♀️'
            - '🤦🏻'
            - '🤦🏻‍♂️'
            - '🤷🏻‍♀️'
            - '🤷🏻'
            - '🤷🏻‍♂️'
            - '🙎🏻‍♀️'
            - '🙎🏻'
            - '🙎🏻‍♂️'
            - '🙍🏻‍♀️'
            - '🙍🏻'
            - '🙍🏻‍♂️'
            - '💇🏻‍♀️'
            - '💇🏻'
            - '💇🏻‍♂️'
            - '💆🏻‍♀️'
            - '💆🏻'
            - '💆🏻‍♂️'
            - '🧖🏻‍♀️'
            - '🧖🏻'
            - '🧖🏻‍♂️'
            - '💃🏻'
            - '🕺🏻'
            - '🕴🏻'
            - '👩🏻‍🦽'
            - '🧑🏻‍🦽'
            - '👨🏻‍🦽'
            - '👩🏻‍🦼'
            - '🧑🏻‍🦼'
            - '👨🏻‍🦼'
            - '🚶🏻‍♀️'
            - '🚶🏻'
            - '🚶🏻‍♂️'
            - '👩🏻‍🦯'
            - '🧑🏻‍🦯'
            - '👨🏻‍🦯'
            - '🧎🏻‍♀️'
            - '🧎🏻'
            - '🧎🏻‍♂️'
            - '🏃🏻‍♀️'
            - '🏃🏻'
            - '🏃🏻‍♂️'
            - '🧍🏻‍♀️'
            - '🧍🏻'
            - '🧍🏻‍♂️'
            - '👭🏻'
            - '🧑🏻‍🤝‍🧑🏻'
            - '👬🏻'
            - '👫🏻'
            - '🧗🏻‍♀️'
            - '🧗🏻'
            - '🧗🏻‍♂️'
            - '🏇🏻'
            - '🏂🏻'
            - '🏌🏻‍♀️'
            - '🏌🏻'
            - '🏌🏻‍♂️'
            - '🏄🏻‍♀️'
            - '🏄🏻'
            - '🏄🏻‍♂️'
            - '🚣🏻‍♀️'
            - '🚣🏻'
            - '🚣🏻‍♂️'
            - '🏊🏻‍♀️'
            - '🏊🏻'
            - '🏊🏻‍♂️'
            - '⛹🏻‍♀️'
            - '⛹🏻'
            - '⛹🏻‍♂️'
            - '🏋🏻‍♀️'
            - '🏋🏻'
            - '🏋🏻‍♂️'
            - '🚴🏻‍♀️'
            - '🚴🏻'
            - '🚴🏻‍♂️'
            - '🚵🏻‍♀️'
            - '🚵🏻'
            - '🚵🏻‍♂️'
            - '🤸🏻‍♀️'
            - '🤸🏻'
            - '🤸🏻‍♂️'
            - '🤽🏻‍♀️'
            - '🤽🏻'
            - '🤽🏻‍♂️'
            - '🤾🏻‍♀️'
            - '🤾🏻'
            - '🤾🏻‍♂️'
            - '🤹🏻‍♀️'
            - '🤹🏻'
            - '🤹🏻‍♂️'
            - '🧘🏻‍♀️'
            - '🧘🏻'
            - '🧘🏻‍♂️'
            - '🛀🏻'
            - '🛌🏻'
            - '👋🏼'
            - '🤚🏼'
            - '🖐🏼'
            - '✋🏼'
            - '🖖🏼'
            - '👌🏼'
            - '🤌🏼'
            - '🤏🏼'
            - '✌🏼'
            - '🤞🏼'
            - '🫰🏼'
            - '🤟🏼'
            - '🤘🏼'
            - '🤙🏼'
            - '🫵🏼'
            - '🫱🏼'
            - '🫲🏼'
            - '🫳🏼'
            - '🫴🏼'
            - '👈🏼'
            - '👉🏼'
            - '👆🏼'
            - '🖕🏼'
            - '👇🏼'
            - '☝🏼'
            - '👍🏼'
            - '👎🏼'
            - '✊🏼'
            - '👊🏼'
            - '🤛🏼'
            - '🤜🏼'
            - '👏🏼'
            - '🫶🏼'
            - '🙌🏼'
            - '👐🏼'
            - '🤲🏼'
            - '🙏🏼'
            - '✍🏼'
            - '💪🏼'
            - '🦵🏼'
            - '🦶🏼'
            - '👂🏼'
            - '🦻🏼'
            - '👃🏼'
            - '👶🏼'
            - '👧🏼'
            - '🧒🏼'
            - '👦🏼'
            - '👩🏼'
            - '🧑🏼'
            - '👨🏼'
            - '👩🏼‍🦱'
            - '🧑🏼‍🦱'
            - '👨🏼‍🦱'
            - '👩🏼‍🦰'
            - '🧑🏼‍🦰'
            - '👨🏼‍🦰'
            - '👱🏼‍♀️'
            - '👱🏼'
            - '👱🏼‍♂️'
            - '👩🏼‍🦳'
            - '🧑🏼‍🦳'
            - '👨🏼‍🦳'
            - '👩🏼‍🦲'
            - '🧑🏼‍🦲'
            - '👨🏼‍🦲'
            - '🧔🏼‍♀️'
            - '🧔🏼'
            - '🧔🏼‍♂️'
            - '👵🏼'
            - '🧓🏼'
            - '👴🏼'
            - '👲🏼'
            - '👳🏼‍♀️'
            - '👳🏼'
            - '👳🏼‍♂️'
            - '🧕🏼'
            - '👮🏼‍♀️'
            - '👮🏼'
            - '👮🏼‍♂️'
            - '👷🏼‍♀️'
            - '👷🏼'
            - '👷🏼‍♂️'
            - '💂🏼‍♀️'
            - '💂🏼'
            - '💂🏼‍♂️'
            - '🕵🏼‍♀️'
            - '🕵🏼'
            - '🕵🏼‍♂️'
            - '👩🏼‍⚕️'
            - '🧑🏼‍⚕️'
            - '👨🏼‍⚕️'
            - '👩🏼‍🌾'
            - '🧑🏼‍🌾'
            - '👨🏼‍🌾'
            - '👩🏼‍🍳'
            - '🧑🏼‍🍳'
            - '👨🏼‍🍳'
            - '👩🏼‍🎓'
            - '🧑🏼‍🎓'
            - '👨🏼‍🎓'
            - '👩🏼‍🎤'
            - '🧑🏼‍🎤'
            - '👨🏼‍🎤'
            - '👩🏼‍🏫'
            - '🧑🏼‍🏫'
            - '👨🏼‍🏫'
            - '👩🏼‍🏭'
            - '🧑🏼‍🏭'
            - '👨🏼‍🏭'
            - '👩🏼‍💻'
            - '🧑🏼‍💻'
            - '👨🏼‍💻'
            - '👩🏼‍💼'
            - '🧑🏼‍💼'
            - '👨🏼‍💼'
            - '👩🏼‍🔧'
            - '🧑🏼‍🔧'
            - '👨🏼‍🔧'
            - '👩🏼‍🔬'
            - '🧑🏼‍🔬'
            - '👨🏼‍🔬'
            - '👩🏼‍🎨'
            - '🧑🏼‍🎨'
            - '👨🏼‍🎨'
            - '👩🏼‍🚒'
            - '🧑🏼‍🚒'
            - '👨🏼‍🚒'
            - '👩🏼‍✈️'
            - '🧑🏼‍✈️'
            - '👨🏼‍✈️'
            - '👩🏼‍🚀'
            - '🧑🏼‍🚀'
            - '👨🏼‍🚀'
            - '👩🏼‍⚖️'
            - '🧑🏼‍⚖️'
            - '👨🏼‍⚖️'
            - '👰🏼‍♀️'
            - '👰🏼'
            - '👰🏼‍♂️'
            - '🤵🏼‍♀️'
            - '🤵🏼'
            - '🤵🏼‍♂️'
            - '👸🏼'
            - '🫅🏼'
            - '🤴🏼'
            - '🥷🏼'
            - '🦸🏼‍♀️'
            - '🦸🏼'
            - '🦸🏼‍♂️'
            - '🦹🏼‍♀️'
            - '🦹🏼'
            - '🦹🏼‍♂️'
            - '🤶🏼'
            - '🧑🏼‍🎄'
            - '🎅🏼'
            - '🧙🏼‍♀️'
            - '🧙🏼'
            - '🧙🏼‍♂️'
            - '🧝🏼‍♀️'
            - '🧝🏼'
            - '🧝🏼‍♂️'
            - '🧛🏼‍♀️'
            - '🧛🏼'
            - '🧛🏼‍♂️'
            - '🧜🏼‍♀️'
            - '🧜🏼'
            - '🧜🏼‍♂️'
            - '🧚🏼‍♀️'
            - '🧚🏼'
            - '🧚🏼‍♂️'
            - '👼🏼'
            - '🤰🏼'
            - '🫄🏼'
            - '🫃🏼'
            - '🤱🏼'
            - '👩🏼‍🍼'
            - '🧑🏼‍🍼'
            - '👨🏼‍🍼'
            - '🙇🏼‍♀️'
            - '🙇🏼'
            - '🙇🏼‍♂️'
            - '💁🏼‍♀️'
            - '💁🏼'
            - '💁🏼‍♂️'
            - '🙅🏼‍♀️'
            - '🙅🏼'
            - '🙅🏼‍♂️'
            - '🙆🏼‍♀️'
            - '🙆🏼'
            - '🙆🏼‍♂️'
            - '🙋🏼‍♀️'
            - '🙋🏼'
            - '🙋🏼‍♂️'
            - '🧏🏼‍♀️'
            - '🧏🏼'
            - '🧏🏼‍♂️'
            - '🤦🏼‍♀️'
            - '🤦🏼'
            - '🤦🏼‍♂️'
            - '🤷🏼‍♀️'
    condition: selection
falsepositives:
    - Unknown
level: high

KQL (Azure Sentinel)

imProcessCreate
| where TargetProcessCommandLine contains "😀" or TargetProcessCommandLine contains "😃" or TargetProcessCommandLine contains "😄" or TargetProcessCommandLine contains "😁" or TargetProcessCommandLine contains "😆" or TargetProcessCommandLine contains "😅" or TargetProcessCommandLine contains "😂" or TargetProcessCommandLine contains "🤣" or TargetProcessCommandLine contains "🥲" or TargetProcessCommandLine contains "🥹" or TargetProcessCommandLine contains "☺️" or TargetProcessCommandLine contains "😊" or TargetProcessCommandLine contains "😇" or TargetProcessCommandLine contains "🙂" or TargetProcessCommandLine contains "🙃" or TargetProcessCommandLine contains "😉" or TargetProcessCommandLine contains "😌" or TargetProcessCommandLine contains "😍" or TargetProcessCommandLine contains "🥰" or TargetProcessCommandLine contains "😘" or TargetProcessCommandLine contains "😗" or TargetProcessCommandLine contains "😙" or TargetProcessCommandLine contains "😚" or TargetProcessCommandLine contains "😋" or TargetProcessCommandLine contains "😛" or TargetProcessCommandLine contains "😝" or TargetProcessCommandLine contains "😜" or TargetProcessCommandLine contains "🤪" or TargetProcessCommandLine contains "🤨" or TargetProcessCommandLine contains "🧐" or TargetProcessCommandLine contains "🤓" or TargetProcessCommandLine contains "😎" or TargetProcessCommandLine contains "🥸" or TargetProcessCommandLine contains "🤩" or TargetProcessCommandLine contains "🥳" or TargetProcessCommandLine contains "😏" or TargetProcessCommandLine contains "😒" or TargetProcessCommandLine contains "😞" or TargetProcessCommandLine contains "😔" or TargetProcessCommandLine contains "😟" or TargetProcessCommandLine contains "😕" or TargetProcessCommandLine contains "🙁" or TargetProcessCommandLine contains "☹️" or TargetProcessCommandLine contains "😣" or TargetProcessCommandLine contains "😖" or TargetProcessCommandLine contains "😫" or TargetProcessCommandLine contains "😩" or TargetProcessCommandLine contains "🥺" or TargetProcessCommandLine contains "😢" or TargetProcessCommandLine contains "😭" or TargetProcessCommandLine contains "😮‍💨" or TargetProcessCommandLine contains "😤" or TargetProcessCommandLine contains "😠" or TargetProcessCommandLine contains "😡" or TargetProcessCommandLine contains "🤬" or TargetProcessCommandLine contains "🤯" or TargetProcessCommandLine contains "😳" or TargetProcessCommandLine contains "🥵" or TargetProcessCommandLine contains "🥶" or TargetProcessCommandLine contains "😱" or TargetProcessCommandLine contains "😨" or TargetProcessCommandLine contains "😰" or TargetProcessCommandLine contains "😥" or TargetProcessCommandLine contains "😓" or TargetProcessCommandLine contains "🫣" or TargetProcessCommandLine contains "🤗" or TargetProcessCommandLine contains "🫡" or TargetProcessCommandLine contains "🤔" or TargetProcessCommandLine contains "🫢" or TargetProcessCommandLine contains "🤭" or TargetProcessCommandLine contains "🤫" or TargetProcessCommandLine contains "🤥" or TargetProcessCommandLine contains "😶" or TargetProcessCommandLine contains "😶‍🌫️" or TargetProcessCommandLine contains "😐" or TargetProcessCommandLine contains "😑" or TargetProcessCommandLine contains "😬" or TargetProcessCommandLine contains "🫠" or TargetProcessCommandLine contains "🙄" or TargetProcessCommandLine contains "😯" or TargetProcessCommandLine contains "😦" or TargetProcessCommandLine contains "😧" or TargetProcessCommandLine contains "😮" or TargetProcessCommandLine contains "😲" or TargetProcessCommandLine contains "🥱" or TargetProcessCommandLine contains "😴" or TargetProcessCommandLine contains "🤤" or TargetProcessCommandLine contains "😪" or TargetProcessCommandLine contains "😵" or TargetProcessCommandLine contains "😵‍💫" or TargetProcessCommandLine contains "🫥" or TargetProcessCommandLine contains "🤐" or TargetProcessCommandLine contains "🥴" or TargetProcessCommandLine contains "🤢" or TargetProcessCommandLine contains "🤮" or TargetProcessCommandLine contains "🤧" or TargetProcessCommandLine contains "😷" or TargetProcessCommandLine contains "🤒" or TargetProcessCommandLine contains "🤕" or TargetProcessCommandLine contains "🤑" or TargetProcessCommandLine contains "🤠" or TargetProcessCommandLine contains "😈" or TargetProcessCommandLine contains "👿" or TargetProcessCommandLine contains "👹" or TargetProcessCommandLine contains "👺" or TargetProcessCommandLine contains "🤡" or TargetProcessCommandLine contains "💩" or TargetProcessCommandLine contains "👻" or TargetProcessCommandLine contains "💀" or TargetProcessCommandLine contains "☠️" or TargetProcessCommandLine contains "👽" or TargetProcessCommandLine contains "👾" or TargetProcessCommandLine contains "🤖" or TargetProcessCommandLine contains "🎃" or TargetProcessCommandLine contains "😺" or TargetProcessCommandLine contains "😸" or TargetProcessCommandLine contains "😹" or TargetProcessCommandLine contains "😻" or TargetProcessCommandLine contains "😼" or TargetProcessCommandLine contains "😽" or TargetProcessCommandLine contains "🙀" or TargetProcessCommandLine contains "😿" or TargetProcessCommandLine contains "😾" or TargetProcessCommandLine contains "👋" or TargetProcessCommandLine contains "🤚" or TargetProcessCommandLine contains "🖐" or TargetProcessCommandLine contains "✋" or TargetProcessCommandLine contains "🖖" or TargetProcessCommandLine contains "👌" or TargetProcessCommandLine contains "🤌" or TargetProcessCommandLine contains "🤏" or TargetProcessCommandLine contains "✌️" or TargetProcessCommandLine contains "🤞" or TargetProcessCommandLine contains "🫰" or TargetProcessCommandLine contains "🤟" or TargetProcessCommandLine contains "🤘" or TargetProcessCommandLine contains "🤙" or TargetProcessCommandLine contains "🫵" or TargetProcessCommandLine contains "🫱" or TargetProcessCommandLine contains "🫲" or TargetProcessCommandLine contains "🫳" or TargetProcessCommandLine contains "🫴" or TargetProcessCommandLine contains "👈" or TargetProcessCommandLine contains "👉" or TargetProcessCommandLine contains "👆" or TargetProcessCommandLine contains "🖕" or TargetProcessCommandLine contains "👇" or TargetProcessCommandLine contains "☝️" or TargetProcessCommandLine contains "👍" or TargetProcessCommandLine contains "👎" or TargetProcessCommandLine contains "✊" or TargetProcessCommandLine contains "👊" or TargetProcessCommandLine contains "🤛" or TargetProcessCommandLine contains "🤜" or TargetProcessCommandLine contains "👏" or TargetProcessCommandLine contains "🫶" or TargetProcessCommandLine contains "🙌" or TargetProcessCommandLine contains "👐" or TargetProcessCommandLine contains "🤲" or TargetProcessCommandLine contains "🤝" or TargetProcessCommandLine contains "🙏" or TargetProcessCommandLine contains "✍️" or TargetProcessCommandLine contains "💪" or TargetProcessCommandLine contains "🦾" or TargetProcessCommandLine contains "🦵" or TargetProcessCommandLine contains "🦿" or TargetProcessCommandLine contains "🦶" or TargetProcessCommandLine contains "👣" or TargetProcessCommandLine contains "👂" or TargetProcessCommandLine contains "🦻" or TargetProcessCommandLine contains "👃" or TargetProcessCommandLine contains "🫀" or TargetProcessCommandLine contains "🫁" or TargetProcessCommandLine contains "🧠" or TargetProcessCommandLine contains "🦷" or TargetProcessCommandLine contains "🦴" or TargetProcessCommandLine contains "👀" or TargetProcessCommandLine contains "👁" or TargetProcessCommandLine contains "👅" or TargetProcessCommandLine contains "👄" or TargetProcessCommandLine contains "🫦" or TargetProcessCommandLine contains "💋" or TargetProcessCommandLine contains "🩸" or TargetProcessCommandLine contains "👶" or TargetProcessCommandLine contains "👧" or TargetProcessCommandLine contains "🧒" or TargetProcessCommandLine contains "👦" or TargetProcessCommandLine contains "👩" or TargetProcessCommandLine contains "🧑" or TargetProcessCommandLine contains "👨" or TargetProcessCommandLine contains "👩‍🦱" or TargetProcessCommandLine contains "🧑‍🦱" or TargetProcessCommandLine contains "👨‍🦱" or TargetProcessCommandLine contains "👩‍🦰" or TargetProcessCommandLine contains "🧑‍🦰" or TargetProcessCommandLine contains "👨‍🦰" or TargetProcessCommandLine contains "👱‍♀️" or TargetProcessCommandLine contains "👱" or TargetProcessCommandLine contains "👱‍♂️" or TargetProcessCommandLine contains "👩‍🦳" or TargetProcessCommandLine contains "🧑‍🦳" or TargetProcessCommandLine contains "👨‍🦳" or TargetProcessCommandLine contains "👩‍🦲" or TargetProcessCommandLine contains "🧑‍🦲" or TargetProcessCommandLine contains "👨‍🦲" or TargetProcessCommandLine contains "🧔‍♀️" or TargetProcessCommandLine contains "🧔" or TargetProcessCommandLine contains "🧔‍♂️" or TargetProcessCommandLine contains "👵" or TargetProcessCommandLine contains "🧓" or TargetProcessCommandLine contains "👴" or TargetProcessCommandLine contains "👲" or TargetProcessCommandLine contains "👳‍♀️" or TargetProcessCommandLine contains "👳" or TargetProcessCommandLine contains "👳‍♂️" or TargetProcessCommandLine contains "🧕" or TargetProcessCommandLine contains "👮‍♀️" or TargetProcessCommandLine contains "👮" or TargetProcessCommandLine contains "👮‍♂️" or TargetProcessCommandLine contains "👷‍♀️" or TargetProcessCommandLine contains "👷" or TargetProcessCommandLine contains "👷‍♂️" or TargetProcessCommandLine contains "💂‍♀️" or TargetProcessCommandLine contains "💂" or TargetProcessCommandLine contains "💂‍♂️" or TargetProcessCommandLine contains "🕵️‍♀️" or TargetProcessCommandLine contains "🕵️" or TargetProcessCommandLine contains "🕵️‍♂️" or TargetProcessCommandLine contains "👩‍⚕️" or TargetProcessCommandLine contains "🧑‍⚕️" or TargetProcessCommandLine contains "👨‍⚕️" or TargetProcessCommandLine contains "👩‍🌾" or TargetProcessCommandLine contains "🧑‍🌾" or TargetProcessCommandLine contains "👨‍🌾" or TargetProcessCommandLine contains "👩‍🍳" or TargetProcessCommandLine contains "🧑‍🍳" or TargetProcessCommandLine contains "👨‍🍳" or TargetProcessCommandLine contains "👩‍🎓" or TargetProcessCommandLine contains "🧑‍🎓" or TargetProcessCommandLine contains "👨‍🎓" or TargetProcessCommandLine contains "👩‍🎤" or TargetProcessCommandLine contains "🧑‍🎤" or TargetProcessCommandLine contains "👨‍🎤" or TargetProcessCommandLine contains "👩‍🏫" or TargetProcessCommandLine contains "🧑‍🏫" or TargetProcessCommandLine contains "👨‍🏫" or TargetProcessCommandLine contains "👩‍🏭" or TargetProcessCommandLine contains "🧑‍🏭" or TargetProcessCommandLine contains "👨‍🏭" or TargetProcessCommandLine contains "👩‍💻" or TargetProcessCommandLine contains "🧑‍💻" or TargetProcessCommandLine contains "👨‍💻" or TargetProcessCommandLine contains "👩‍💼" or TargetProcessCommandLine contains "🧑‍💼" or TargetProcessCommandLine contains "👨‍💼" or TargetProcessCommandLine contains "👩‍🔧" or TargetProcessCommandLine contains "🧑‍🔧" or TargetProcessCommandLine contains "👨‍🔧" or TargetProcessCommandLine contains "👩‍🔬" or TargetProcessCommandLine contains "🧑‍🔬" or TargetProcessCommandLine contains "👨‍🔬" or TargetProcessCommandLine contains "👩‍🎨" or TargetProcessCommandLine contains "🧑‍🎨" or TargetProcessCommandLine contains "👨‍🎨" or TargetProcessCommandLine contains "👩‍🚒" or TargetProcessCommandLine contains "🧑‍🚒" or TargetProcessCommandLine contains "👨‍🚒" or TargetProcessCommandLine contains "👩‍✈️" or TargetProcessCommandLine contains "🧑‍✈️" or TargetProcessCommandLine contains "👨‍✈️" or TargetProcessCommandLine contains "👩‍🚀" or TargetProcessCommandLine contains "🧑‍🚀" or TargetProcessCommandLine contains "👨‍🚀" or TargetProcessCommandLine contains "👩‍⚖️" or TargetProcessCommandLine contains "🧑‍⚖️" or TargetProcessCommandLine contains "👨‍⚖️" or TargetProcessCommandLine contains "👰‍♀️" or TargetProcessCommandLine contains "👰" or TargetProcessCommandLine contains "👰‍♂️" or TargetProcessCommandLine contains "🤵‍♀️" or TargetProcessCommandLine contains "🤵" or TargetProcessCommandLine contains "🤵‍♂️" or TargetProcessCommandLine contains "👸" or TargetProcessCommandLine contains "🫅" or TargetProcessCommandLine contains "🤴" or TargetProcessCommandLine contains "🥷" or TargetProcessCommandLine contains "🦸‍♀️" or TargetProcessCommandLine contains "🦸" or TargetProcessCommandLine contains "🦸‍♂️" or TargetProcessCommandLine contains "🦹‍♀️" or TargetProcessCommandLine contains "🦹" or TargetProcessCommandLine contains "🦹‍♂️" or TargetProcessCommandLine contains "🤶" or TargetProcessCommandLine contains "🧑‍🎄" or TargetProcessCommandLine contains "🎅" or TargetProcessCommandLine contains "🧙‍♀️" or TargetProcessCommandLine contains "🧙" or TargetProcessCommandLine contains "🧙‍♂️" or TargetProcessCommandLine contains "🧝‍♀️" or TargetProcessCommandLine contains "🧝" or TargetProcessCommandLine contains "🧝‍♂️" or TargetProcessCommandLine contains "🧛‍♀️" or TargetProcessCommandLine contains "🧛" or TargetProcessCommandLine contains "🧛‍♂️" or TargetProcessCommandLine contains "🧟‍♀️" or TargetProcessCommandLine contains "🧟" or TargetProcessCommandLine contains "🧟‍♂️" or TargetProcessCommandLine contains "🧞‍♀️" or TargetProcessCommandLine contains "🧞" or TargetProcessCommandLine contains "🧞‍♂️" or TargetProcessCommandLine contains "🧜‍♀️" or TargetProcessCommandLine contains "🧜" or TargetProcessCommandLine contains "🧜‍♂️" or TargetProcessCommandLine contains "🧚‍♀️" or TargetProcessCommandLine contains "🧚" or TargetProcessCommandLine contains "🧚‍♂️" or TargetProcessCommandLine contains "🧌" or TargetProcessCommandLine contains "👼" or TargetProcessCommandLine contains "🤰" or TargetProcessCommandLine contains "🫄" or TargetProcessCommandLine contains "🫃" or TargetProcessCommandLine contains "🤱" or TargetProcessCommandLine contains "👩‍🍼" or TargetProcessCommandLine contains "🧑‍🍼" or TargetProcessCommandLine contains "👨‍🍼" or TargetProcessCommandLine contains "🙇‍♀️" or TargetProcessCommandLine contains "🙇" or TargetProcessCommandLine contains "🙇‍♂️" or TargetProcessCommandLine contains "💁‍♀️" or TargetProcessCommandLine contains "💁" or TargetProcessCommandLine contains "💁‍♂️" or TargetProcessCommandLine contains "🙅‍♀️" or TargetProcessCommandLine contains "🙅" or TargetProcessCommandLine contains "🙅‍♂️" or TargetProcessCommandLine contains "🙆‍♀️" or TargetProcessCommandLine contains "🙆" or TargetProcessCommandLine contains "🙆‍♂️" or TargetProcessCommandLine contains "🙋‍♀️" or TargetProcessCommandLine contains "🙋" or TargetProcessCommandLine contains "🙋‍♂️" or TargetProcessCommandLine contains "🧏‍♀️" or TargetProcessCommandLine contains "🧏" or TargetProcessCommandLine contains "🧏‍♂️" or TargetProcessCommandLine contains "🤦‍♀️" or TargetProcessCommandLine contains "🤦" or TargetProcessCommandLine contains "🤦‍♂️" or TargetProcessCommandLine contains "🤷‍♀️" or TargetProcessCommandLine contains "🤷" or TargetProcessCommandLine contains "🤷‍♂️" or TargetProcessCommandLine contains "🙎‍♀️" or TargetProcessCommandLine contains "🙎" or TargetProcessCommandLine contains "🙎‍♂️" or TargetProcessCommandLine contains "🙍‍♀️" or TargetProcessCommandLine contains "🙍" or TargetProcessCommandLine contains "🙍‍♂️" or TargetProcessCommandLine contains "💇‍♀️" or TargetProcessCommandLine contains "💇" or TargetProcessCommandLine contains "💇‍♂️" or TargetProcessCommandLine contains "💆‍♀️" or TargetProcessCommandLine contains "💆" or TargetProcessCommandLine contains "💆‍♂️" or TargetProcessCommandLine contains "🧖‍♀️" or TargetProcessCommandLine contains "🧖" or TargetProcessCommandLine contains "🧖‍♂️" or TargetProcessCommandLine contains "💅" or TargetProcessCommandLine contains "💃" or TargetProcessCommandLine contains "🕺" or TargetProcessCommandLine contains "👯‍♀️" or TargetProcessCommandLine contains "👯" or TargetProcessCommandLine contains "👯‍♂️" or TargetProcessCommandLine contains "🕴" or TargetProcessCommandLine contains "👩‍🦽" or TargetProcessCommandLine contains "🧑‍🦽" or TargetProcessCommandLine contains "👨‍🦽" or TargetProcessCommandLine contains "👩‍🦼" or TargetProcessCommandLine contains "🧑‍🦼" or TargetProcessCommandLine contains "👨‍🦼" or TargetProcessCommandLine contains "🚶‍♀️" or TargetProcessCommandLine contains "🚶" or TargetProcessCommandLine contains "🚶‍♂️" or TargetProcessCommandLine contains "👩‍🦯" or TargetProcessCommandLine contains "🧑‍🦯" or TargetProcessCommandLine contains "👨‍🦯" or TargetProcessCommandLine contains "🧎‍♀️" or TargetProcessCommandLine contains "🧎" or TargetProcessCommandLine contains "🧎‍♂️" or TargetProcessCommandLine contains "🏃‍♀️" or TargetProcessCommandLine contains "🏃" or TargetProcessCommandLine contains "🏃‍♂️" or TargetProcessCommandLine contains "🧍‍♀️" or TargetProcessCommandLine contains "🧍" or TargetProcessCommandLine contains "🧍‍♂️" or TargetProcessCommandLine contains "👭" or TargetProcessCommandLine contains "🧑‍🤝‍🧑" or TargetProcessCommandLine contains "👬" or TargetProcessCommandLine contains "👫" or TargetProcessCommandLine contains "👩‍❤️‍👩" or TargetProcessCommandLine contains "💑" or TargetProcessCommandLine contains "👨‍❤️‍👨" or TargetProcessCommandLine contains "👩‍❤️‍👨" or TargetProcessCommandLine contains "👩‍❤️‍💋‍👩" or TargetProcessCommandLine contains "💏" or TargetProcessCommandLine contains "👨‍❤️‍💋‍👨" or TargetProcessCommandLine contains "👩‍❤️‍💋‍👨" or TargetProcessCommandLine contains "👪" or TargetProcessCommandLine contains "👨‍👩‍👦" or TargetProcessCommandLine contains "👨‍👩‍👧" or TargetProcessCommandLine contains "👨‍👩‍👧‍👦" or TargetProcessCommandLine contains "👨‍👩‍👦‍👦" or TargetProcessCommandLine contains "👨‍👩‍👧‍👧" or TargetProcessCommandLine contains "👨‍👨‍👦" or TargetProcessCommandLine contains "👨‍👨‍👧" or TargetProcessCommandLine contains "👨‍👨‍👧‍👦" or TargetProcessCommandLine contains "👨‍👨‍👦‍👦" or TargetProcessCommandLine contains "👨‍👨‍👧‍👧" or TargetProcessCommandLine contains "👩‍👩‍👦" or TargetProcessCommandLine contains "👩‍👩‍👧" or TargetProcessCommandLine contains "👩‍👩‍👧‍👦" or TargetProcessCommandLine contains "👩‍👩‍👦‍👦" or TargetProcessCommandLine contains "👩‍👩‍👧‍👧" or TargetProcessCommandLine contains "👨‍👦" or TargetProcessCommandLine contains "👨‍👦‍👦" or TargetProcessCommandLine contains "👨‍👧" or TargetProcessCommandLine contains "👨‍👧‍👦" or TargetProcessCommandLine contains "👨‍👧‍👧" or TargetProcessCommandLine contains "👩‍👦" or TargetProcessCommandLine contains "👩‍👦‍👦" or TargetProcessCommandLine contains "👩‍👧" or TargetProcessCommandLine contains "👩‍👧‍👦" or TargetProcessCommandLine contains "👩‍👧‍👧" or TargetProcessCommandLine contains "🗣" or TargetProcessCommandLine contains "👤" or TargetProcessCommandLine contains "👥" or TargetProcessCommandLine contains "🫂" or TargetProcessCommandLine contains "🧳" or TargetProcessCommandLine contains "🌂" or TargetProcessCommandLine contains "☂️" or TargetProcessCommandLine contains "🧵" or TargetProcessCommandLine contains "🪡" or TargetProcessCommandLine contains "🪢" or TargetProcessCommandLine contains "🧶" or TargetProcessCommandLine contains "👓" or TargetProcessCommandLine contains "🕶" or TargetProcessCommandLine contains "🥽" or TargetProcessCommandLine contains "🥼" or TargetProcessCommandLine contains "🦺" or TargetProcessCommandLine contains "👔" or TargetProcessCommandLine contains "👕" or TargetProcessCommandLine contains "👖" or TargetProcessCommandLine contains "🧣" or TargetProcessCommandLine contains "🧤" or TargetProcessCommandLine contains "🧥" or TargetProcessCommandLine contains "🧦" or TargetProcessCommandLine contains "👗" or TargetProcessCommandLine contains "👘" or TargetProcessCommandLine contains "🥻" or TargetProcessCommandLine contains "🩴" or TargetProcessCommandLine contains "🩱" or TargetProcessCommandLine contains "🩲" or TargetProcessCommandLine contains "🩳" or TargetProcessCommandLine contains "👙" or TargetProcessCommandLine contains "👚" or TargetProcessCommandLine contains "👛" or TargetProcessCommandLine contains "👜" or TargetProcessCommandLine contains "👝" or TargetProcessCommandLine contains "🎒" or TargetProcessCommandLine contains "👞" or TargetProcessCommandLine contains "👟" or TargetProcessCommandLine contains "🥾" or TargetProcessCommandLine contains "🥿" or TargetProcessCommandLine contains "👠" or TargetProcessCommandLine contains "👡" or TargetProcessCommandLine contains "🩰" or TargetProcessCommandLine contains "👢" or TargetProcessCommandLine contains "👑" or TargetProcessCommandLine contains "👒" or TargetProcessCommandLine contains "🎩" or TargetProcessCommandLine contains "🎓" or TargetProcessCommandLine contains "🧢" or TargetProcessCommandLine contains "⛑" or TargetProcessCommandLine contains "🪖" or TargetProcessCommandLine contains "💄" or TargetProcessCommandLine contains "💍" or TargetProcessCommandLine contains "💼" or TargetProcessCommandLine contains "👋🏻" or TargetProcessCommandLine contains "🤚🏻" or TargetProcessCommandLine contains "🖐🏻" or TargetProcessCommandLine contains "✋🏻" or TargetProcessCommandLine contains "🖖🏻" or TargetProcessCommandLine contains "👌🏻" or TargetProcessCommandLine contains "🤌🏻" or TargetProcessCommandLine contains "🤏🏻" or TargetProcessCommandLine contains "✌🏻" or TargetProcessCommandLine contains "🤞🏻" or TargetProcessCommandLine contains "🫰🏻" or TargetProcessCommandLine contains "🤟🏻" or TargetProcessCommandLine contains "🤘🏻" or TargetProcessCommandLine contains "🤙🏻" or TargetProcessCommandLine contains "🫵🏻" or TargetProcessCommandLine contains "🫱🏻" or TargetProcessCommandLine contains "🫲🏻" or TargetProcessCommandLine contains "🫳🏻" or TargetProcessCommandLine contains "🫴🏻" or TargetProcessCommandLine contains "👈🏻" or TargetProcessCommandLine contains "👉🏻" or TargetProcessCommandLine contains "👆🏻" or TargetProcessCommandLine contains "🖕🏻" or TargetProcessCommandLine contains "👇🏻" or TargetProcessCommandLine contains "☝🏻" or TargetProcessCommandLine contains "👍🏻" or TargetProcessCommandLine contains "👎🏻" or TargetProcessCommandLine contains "✊🏻" or TargetProcessCommandLine contains "👊🏻" or TargetProcessCommandLine contains "🤛🏻" or TargetProcessCommandLine contains "🤜🏻" or TargetProcessCommandLine contains "👏🏻" or TargetProcessCommandLine contains "🫶🏻" or TargetProcessCommandLine contains "🙌🏻" or TargetProcessCommandLine contains "👐🏻" or TargetProcessCommandLine contains "🤲🏻" or TargetProcessCommandLine contains "🙏🏻" or TargetProcessCommandLine contains "✍🏻" or TargetProcessCommandLine contains "💪🏻" or TargetProcessCommandLine contains "🦵🏻" or TargetProcessCommandLine contains "🦶🏻" or TargetProcessCommandLine contains "👂🏻" or TargetProcessCommandLine contains "🦻🏻" or TargetProcessCommandLine contains "👃🏻" or TargetProcessCommandLine contains "👶🏻" or TargetProcessCommandLine contains "👧🏻" or TargetProcessCommandLine contains "🧒🏻" or TargetProcessCommandLine contains "👦🏻" or TargetProcessCommandLine contains "👩🏻" or TargetProcessCommandLine contains "🧑🏻" or TargetProcessCommandLine contains "👨🏻" or TargetProcessCommandLine contains "👩🏻‍🦱" or TargetProcessCommandLine contains "🧑🏻‍🦱" or TargetProcessCommandLine contains "👨🏻‍🦱" or TargetProcessCommandLine contains "👩🏻‍🦰" or TargetProcessCommandLine contains "🧑🏻‍🦰" or TargetProcessCommandLine contains "👨🏻‍🦰" or TargetProcessCommandLine contains "👱🏻‍♀️" or TargetProcessCommandLine contains "👱🏻" or TargetProcessCommandLine contains "👱🏻‍♂️" or TargetProcessCommandLine contains "👩🏻‍🦳" or TargetProcessCommandLine contains "🧑🏻‍🦳" or TargetProcessCommandLine contains "👨🏻‍🦳" or TargetProcessCommandLine contains "👩🏻‍🦲" or TargetProcessCommandLine contains "🧑🏻‍🦲" or TargetProcessCommandLine contains "👨🏻‍🦲" or TargetProcessCommandLine contains "🧔🏻‍♀️" or TargetProcessCommandLine contains "🧔🏻" or TargetProcessCommandLine contains "🧔🏻‍♂️" or TargetProcessCommandLine contains "👵🏻" or TargetProcessCommandLine contains "🧓🏻" or TargetProcessCommandLine contains "👴🏻" or TargetProcessCommandLine contains "👲🏻" or TargetProcessCommandLine contains "👳🏻‍♀️" or TargetProcessCommandLine contains "👳🏻" or TargetProcessCommandLine contains "👳🏻‍♂️" or TargetProcessCommandLine contains "🧕🏻" or TargetProcessCommandLine contains "👮🏻‍♀️" or TargetProcessCommandLine contains "👮🏻" or TargetProcessCommandLine contains "👮🏻‍♂️" or TargetProcessCommandLine contains "👷🏻‍♀️" or TargetProcessCommandLine contains "👷🏻" or TargetProcessCommandLine contains "👷🏻‍♂️" or TargetProcessCommandLine contains "💂🏻‍♀️" or TargetProcessCommandLine contains "💂🏻" or TargetProcessCommandLine contains "💂🏻‍♂️" or TargetProcessCommandLine contains "🕵🏻‍♀️" or TargetProcessCommandLine contains "🕵🏻" or TargetProcessCommandLine contains "🕵🏻‍♂️" or TargetProcessCommandLine contains "👩🏻‍⚕️" or TargetProcessCommandLine contains "🧑🏻‍⚕️" or TargetProcessCommandLine contains "👨🏻‍⚕️" or TargetProcessCommandLine contains "👩🏻‍🌾" or TargetProcessCommandLine contains "🧑🏻‍🌾" or TargetProcessCommandLine contains "👨🏻‍🌾" or TargetProcessCommandLine contains "👩🏻‍🍳" or TargetProcessCommandLine contains "🧑🏻‍🍳" or TargetProcessCommandLine contains "👨🏻‍🍳" or TargetProcessCommandLine contains "👩🏻‍🎓" or TargetProcessCommandLine contains "🧑🏻‍🎓" or TargetProcessCommandLine contains "👨🏻‍🎓" or TargetProcessCommandLine contains "👩🏻‍🎤" or TargetProcessCommandLine contains "🧑🏻‍🎤" or TargetProcessCommandLine contains "👨🏻‍🎤" or TargetProcessCommandLine contains "👩🏻‍🏫" or TargetProcessCommandLine contains "🧑🏻‍🏫" or TargetProcessCommandLine contains "👨🏻‍🏫" or TargetProcessCommandLine contains "👩🏻‍🏭" or TargetProcessCommandLine contains "🧑🏻‍🏭" or TargetProcessCommandLine contains "👨🏻‍🏭" or TargetProcessCommandLine contains "👩🏻‍💻" or TargetProcessCommandLine contains "🧑🏻‍💻" or TargetProcessCommandLine contains "👨🏻‍💻" or TargetProcessCommandLine contains "👩🏻‍💼" or TargetProcessCommandLine contains "🧑🏻‍💼" or TargetProcessCommandLine contains "👨🏻‍💼" or TargetProcessCommandLine contains "👩🏻‍🔧" or TargetProcessCommandLine contains "🧑🏻‍🔧" or TargetProcessCommandLine contains "👨🏻‍🔧" or TargetProcessCommandLine contains "👩🏻‍🔬" or TargetProcessCommandLine contains "🧑🏻‍🔬" or TargetProcessCommandLine contains "👨🏻‍🔬" or TargetProcessCommandLine contains "👩🏻‍🎨" or TargetProcessCommandLine contains "🧑🏻‍🎨" or TargetProcessCommandLine contains "👨🏻‍🎨" or TargetProcessCommandLine contains "👩🏻‍🚒" or TargetProcessCommandLine contains "🧑🏻‍🚒" or TargetProcessCommandLine contains "👨🏻‍🚒" or TargetProcessCommandLine contains "👩🏻‍✈️" or TargetProcessCommandLine contains "🧑🏻‍✈️" or TargetProcessCommandLine contains "👨🏻‍✈️" or TargetProcessCommandLine contains "👩🏻‍🚀" or TargetProcessCommandLine contains "🧑🏻‍🚀" or TargetProcessCommandLine contains "👨🏻‍🚀" or TargetProcessCommandLine contains "👩🏻‍⚖️" or TargetProcessCommandLine contains "🧑🏻‍⚖️" or TargetProcessCommandLine contains "👨🏻‍⚖️" or TargetProcessCommandLine contains "👰🏻‍♀️" or TargetProcessCommandLine contains "👰🏻" or TargetProcessCommandLine contains "👰🏻‍♂️" or TargetProcessCommandLine contains "🤵🏻‍♀️" or TargetProcessCommandLine contains "🤵🏻" or TargetProcessCommandLine contains "🤵🏻‍♂️" or TargetProcessCommandLine contains "👸🏻" or TargetProcessCommandLine contains "🫅🏻" or TargetProcessCommandLine contains "🤴🏻" or TargetProcessCommandLine contains "🥷🏻" or TargetProcessCommandLine contains "🦸🏻‍♀️" or TargetProcessCommandLine contains "🦸🏻" or TargetProcessCommandLine contains "🦸🏻‍♂️" or TargetProcessCommandLine contains "🦹🏻‍♀️" or TargetProcessCommandLine contains "🦹🏻" or TargetProcessCommandLine contains "🦹🏻‍♂️" or TargetProcessCommandLine contains "🤶🏻" or TargetProcessCommandLine contains "🧑🏻‍🎄" or TargetProcessCommandLine contains "🎅🏻" or TargetProcessCommandLine contains "🧙🏻‍♀️" or TargetProcessCommandLine contains "🧙🏻" or TargetProcessCommandLine contains "🧙🏻‍♂️" or TargetProcessCommandLine contains "🧝🏻‍♀️" or TargetProcessCommandLine contains "🧝🏻" or TargetProcessCommandLine contains "🧝🏻‍♂️" or TargetProcessCommandLine contains "🧛🏻‍♀️" or TargetProcessCommandLine contains "🧛🏻" or TargetProcessCommandLine contains "🧛🏻‍♂️" or TargetProcessCommandLine contains "🧜🏻‍♀️" or TargetProcessCommandLine contains "🧜🏻" or TargetProcessCommandLine contains "🧜🏻‍♂️" or TargetProcessCommandLine contains "🧚🏻‍♀️" or TargetProcessCommandLine contains "🧚🏻" or TargetProcessCommandLine contains "🧚🏻‍♂️" or TargetProcessCommandLine contains "👼🏻" or TargetProcessCommandLine contains "🤰🏻" or TargetProcessCommandLine contains "🫄🏻" or TargetProcessCommandLine contains "🫃🏻" or TargetProcessCommandLine contains "🤱🏻" or TargetProcessCommandLine contains "👩🏻‍🍼" or TargetProcessCommandLine contains "🧑🏻‍🍼" or TargetProcessCommandLine contains "👨🏻‍🍼" or TargetProcessCommandLine contains "🙇🏻‍♀️" or TargetProcessCommandLine contains "🙇🏻" or TargetProcessCommandLine contains "🙇🏻‍♂️" or TargetProcessCommandLine contains "💁🏻‍♀️" or TargetProcessCommandLine contains "💁🏻" or TargetProcessCommandLine contains "💁🏻‍♂️" or TargetProcessCommandLine contains "🙅🏻‍♀️" or TargetProcessCommandLine contains "🙅🏻" or TargetProcessCommandLine contains "🙅🏻‍♂️" or TargetProcessCommandLine contains "🙆🏻‍♀️" or TargetProcessCommandLine contains "🙆🏻" or TargetProcessCommandLine contains "🙆🏻‍♂️" or TargetProcessCommandLine contains "🙋🏻‍♀️" or TargetProcessCommandLine contains "🙋🏻" or TargetProcessCommandLine contains "🙋🏻‍♂️" or TargetProcessCommandLine contains "🧏🏻‍♀️" or TargetProcessCommandLine contains "🧏🏻" or TargetProcessCommandLine contains "🧏🏻‍♂️" or TargetProcessCommandLine contains "🤦🏻‍♀️" or TargetProcessCommandLine contains "🤦🏻" or TargetProcessCommandLine contains "🤦🏻‍♂️" or TargetProcessCommandLine contains "🤷🏻‍♀️" or TargetProcessCommandLine contains "🤷🏻" or TargetProcessCommandLine contains "🤷🏻‍♂️" or TargetProcessCommandLine contains "🙎🏻‍♀️" or TargetProcessCommandLine contains "🙎🏻" or TargetProcessCommandLine contains "🙎🏻‍♂️" or TargetProcessCommandLine contains "🙍🏻‍♀️" or TargetProcessCommandLine contains "🙍🏻" or TargetProcessCommandLine contains "🙍🏻‍♂️" or TargetProcessCommandLine contains "💇🏻‍♀️" or TargetProcessCommandLine contains "💇🏻" or TargetProcessCommandLine contains "💇🏻‍♂️" or TargetProcessCommandLine contains "💆🏻‍♀️" or TargetProcessCommandLine contains "💆🏻" or TargetProcessCommandLine contains "💆🏻‍♂️" or TargetProcessCommandLine contains "🧖🏻‍♀️" or TargetProcessCommandLine contains "🧖🏻" or TargetProcessCommandLine contains "🧖🏻‍♂️" or TargetProcessCommandLine contains "💃🏻" or TargetProcessCommandLine contains "🕺🏻" or TargetProcessCommandLine contains "🕴🏻" or TargetProcessCommandLine contains "👩🏻‍🦽" or TargetProcessCommandLine contains "🧑🏻‍🦽" or TargetProcessCommandLine contains "👨🏻‍🦽" or TargetProcessCommandLine contains "👩🏻‍🦼" or TargetProcessCommandLine contains "🧑🏻‍🦼" or TargetProcessCommandLine contains "👨🏻‍🦼" or TargetProcessCommandLine contains "🚶🏻‍♀️" or TargetProcessCommandLine contains "🚶🏻" or TargetProcessCommandLine contains "🚶🏻‍♂️" or TargetProcessCommandLine contains "👩🏻‍🦯" or TargetProcessCommandLine contains "🧑🏻‍🦯" or TargetProcessCommandLine contains "👨🏻‍🦯" or TargetProcessCommandLine contains "🧎🏻‍♀️" or TargetProcessCommandLine contains "🧎🏻" or TargetProcessCommandLine contains "🧎🏻‍♂️" or TargetProcessCommandLine contains "🏃🏻‍♀️" or TargetProcessCommandLine contains "🏃🏻" or TargetProcessCommandLine contains "🏃🏻‍♂️" or TargetProcessCommandLine contains "🧍🏻‍♀️" or TargetProcessCommandLine contains "🧍🏻" or TargetProcessCommandLine contains "🧍🏻‍♂️" or TargetProcessCommandLine contains "👭🏻" or TargetProcessCommandLine contains "🧑🏻‍🤝‍🧑🏻" or TargetProcessCommandLine contains "👬🏻" or TargetProcessCommandLine contains "👫🏻" or TargetProcessCommandLine contains "🧗🏻‍♀️" or TargetProcessCommandLine contains "🧗🏻" or TargetProcessCommandLine contains "🧗🏻‍♂️" or TargetProcessCommandLine contains "🏇🏻" or TargetProcessCommandLine contains "🏂🏻" or TargetProcessCommandLine contains "🏌🏻‍♀️" or TargetProcessCommandLine contains "🏌🏻" or TargetProcessCommandLine contains "🏌🏻‍♂️" or TargetProcessCommandLine contains "🏄🏻‍♀️" or TargetProcessCommandLine contains "🏄🏻" or TargetProcessCommandLine contains "🏄🏻‍♂️" or TargetProcessCommandLine contains "🚣🏻‍♀️" or TargetProcessCommandLine contains "🚣🏻" or TargetProcessCommandLine contains "🚣🏻‍♂️" or TargetProcessCommandLine contains "🏊🏻‍♀️" or TargetProcessCommandLine contains "🏊🏻" or TargetProcessCommandLine contains "🏊🏻‍♂️" or TargetProcessCommandLine contains "⛹🏻‍♀️" or TargetProcessCommandLine contains "⛹🏻" or TargetProcessCommandLine contains "⛹🏻‍♂️" or TargetProcessCommandLine contains "🏋🏻‍♀️" or TargetProcessCommandLine contains "🏋🏻" or TargetProcessCommandLine contains "🏋🏻‍♂️" or TargetProcessCommandLine contains "🚴🏻‍♀️" or TargetProcessCommandLine contains "🚴🏻" or TargetProcessCommandLine contains "🚴🏻‍♂️" or TargetProcessCommandLine contains "🚵🏻‍♀️" or TargetProcessCommandLine contains "🚵🏻" or TargetProcessCommandLine contains "🚵🏻‍♂️" or TargetProcessCommandLine contains "🤸🏻‍♀️" or TargetProcessCommandLine contains "🤸🏻" or TargetProcessCommandLine contains "🤸🏻‍♂️" or TargetProcessCommandLine contains "🤽🏻‍♀️" or TargetProcessCommandLine contains "🤽🏻" or TargetProcessCommandLine contains "🤽🏻‍♂️" or TargetProcessCommandLine contains "🤾🏻‍♀️" or TargetProcessCommandLine contains "🤾🏻" or TargetProcessCommandLine contains "🤾🏻‍♂️" or TargetProcessCommandLine contains "🤹🏻‍♀️" or TargetProcessCommandLine contains "🤹🏻" or TargetProcessCommandLine contains "🤹🏻‍♂️" or TargetProcessCommandLine contains "🧘🏻‍♀️" or TargetProcessCommandLine contains "🧘🏻" or TargetProcessCommandLine contains "🧘🏻‍♂️" or TargetProcessCommandLine contains "🛀🏻" or TargetProcessCommandLine contains "🛌🏻" or TargetProcessCommandLine contains "👋🏼" or TargetProcessCommandLine contains "🤚🏼" or TargetProcessCommandLine contains "🖐🏼" or TargetProcessCommandLine contains "✋🏼" or TargetProcessCommandLine contains "🖖🏼" or TargetProcessCommandLine contains "👌🏼" or TargetProcessCommandLine contains "🤌🏼" or TargetProcessCommandLine contains "🤏🏼" or TargetProcessCommandLine contains "✌🏼" or TargetProcessCommandLine contains "🤞🏼" or TargetProcessCommandLine contains "🫰🏼" or TargetProcessCommandLine contains "🤟🏼" or TargetProcessCommandLine contains "🤘🏼" or TargetProcessCommandLine contains "🤙🏼" or TargetProcessCommandLine contains "🫵🏼" or TargetProcessCommandLine contains "🫱🏼" or TargetProcessCommandLine contains "🫲🏼" or TargetProcessCommandLine contains "🫳🏼" or TargetProcessCommandLine contains "🫴🏼" or TargetProcessCommandLine contains "👈🏼" or TargetProcessCommandLine contains "👉🏼" or TargetProcessCommandLine contains "👆🏼" or TargetProcessCommandLine contains "🖕🏼" or TargetProcessCommandLine contains "👇🏼" or TargetProcessCommandLine contains "☝🏼" or TargetProcessCommandLine contains "👍🏼" or TargetProcessCommandLine contains "👎🏼" or TargetProcessCommandLine contains "✊🏼" or TargetProcessCommandLine contains "👊🏼" or TargetProcessCommandLine contains "🤛🏼" or TargetProcessCommandLine contains "🤜🏼" or TargetProcessCommandLine contains "👏🏼" or TargetProcessCommandLine contains "🫶🏼" or TargetProcessCommandLine contains "🙌🏼" or TargetProcessCommandLine contains "👐🏼" or TargetProcessCommandLine contains "🤲🏼" or TargetProcessCommandLine contains "🙏🏼" or TargetProcessCommandLine contains "✍🏼" or TargetProcessCommandLine contains "💪🏼" or TargetProcessCommandLine contains "🦵🏼" or TargetProcessCommandLine contains "🦶🏼" or TargetProcessCommandLine contains "👂🏼" or TargetProcessCommandLine contains "🦻🏼" or TargetProcessCommandLine contains "👃🏼" or TargetProcessCommandLine contains "👶🏼" or TargetProcessCommandLine contains "👧🏼" or TargetProcessCommandLine contains "🧒🏼" or TargetProcessCommandLine contains "👦🏼" or TargetProcessCommandLine contains "👩🏼" or TargetProcessCommandLine contains "🧑🏼" or TargetProcessCommandLine contains "👨🏼" or TargetProcessCommandLine contains "👩🏼‍🦱" or TargetProcessCommandLine contains "🧑🏼‍🦱" or TargetProcessCommandLine contains "👨🏼‍🦱" or TargetProcessCommandLine contains "👩🏼‍🦰" or TargetProcessCommandLine contains "🧑🏼‍🦰" or TargetProcessCommandLine contains "👨🏼‍🦰" or TargetProcessCommandLine contains "👱🏼‍♀️" or TargetProcessCommandLine contains "👱🏼" or TargetProcessCommandLine contains "👱🏼‍♂️" or TargetProcessCommandLine contains "👩🏼‍🦳" or TargetProcessCommandLine contains "🧑🏼‍🦳" or TargetProcessCommandLine contains "👨🏼‍🦳" or TargetProcessCommandLine contains "👩🏼‍🦲" or TargetProcessCommandLine contains "🧑🏼‍🦲" or TargetProcessCommandLine contains "👨🏼‍🦲" or TargetProcessCommandLine contains "🧔🏼‍♀️" or TargetProcessCommandLine contains "🧔🏼" or TargetProcessCommandLine contains "🧔🏼‍♂️" or TargetProcessCommandLine contains "👵🏼" or TargetProcessCommandLine contains "🧓🏼" or TargetProcessCommandLine contains "👴🏼" or TargetProcessCommandLine contains "👲🏼" or TargetProcessCommandLine contains "👳🏼‍♀️" or TargetProcessCommandLine contains "👳🏼" or TargetProcessCommandLine contains "👳🏼‍♂️" or TargetProcessCommandLine contains "🧕🏼" or TargetProcessCommandLine contains "👮🏼‍♀️" or TargetProcessCommandLine contains "👮🏼" or TargetProcessCommandLine contains "👮🏼‍♂️" or TargetProcessCommandLine contains "👷🏼‍♀️" or TargetProcessCommandLine contains "👷🏼" or TargetProcessCommandLine contains "👷🏼‍♂️" or TargetProcessCommandLine contains "💂🏼‍♀️" or TargetProcessCommandLine contains "💂🏼" or TargetProcessCommandLine contains "💂🏼‍♂️" or TargetProcessCommandLine contains "🕵🏼‍♀️" or TargetProcessCommandLine contains "🕵🏼" or TargetProcessCommandLine contains "🕵🏼‍♂️" or TargetProcessCommandLine contains "👩🏼‍⚕️" or TargetProcessCommandLine contains "🧑🏼‍⚕️" or TargetProcessCommandLine contains "👨🏼‍⚕️" or TargetProcessCommandLine contains "👩🏼‍🌾" or TargetProcessCommandLine contains "🧑🏼‍🌾" or TargetProcessCommandLine contains "👨🏼‍🌾" or TargetProcessCommandLine contains "👩🏼‍🍳" or TargetProcessCommandLine contains "🧑🏼‍🍳" or TargetProcessCommandLine contains "👨🏼‍🍳" or TargetProcessCommandLine contains "👩🏼‍🎓" or TargetProcessCommandLine contains "🧑🏼‍🎓" or TargetProcessCommandLine contains "👨🏼‍🎓" or TargetProcessCommandLine contains "👩🏼‍🎤" or TargetProcessCommandLine contains "🧑🏼‍🎤" or TargetProcessCommandLine contains "👨🏼‍🎤" or TargetProcessCommandLine contains "👩🏼‍🏫" or TargetProcessCommandLine contains "🧑🏼‍🏫" or TargetProcessCommandLine contains "👨🏼‍🏫" or TargetProcessCommandLine contains "👩🏼‍🏭" or TargetProcessCommandLine contains "🧑🏼‍🏭" or TargetProcessCommandLine contains "👨🏼‍🏭" or TargetProcessCommandLine contains "👩🏼‍💻" or TargetProcessCommandLine contains "🧑🏼‍💻" or TargetProcessCommandLine contains "👨🏼‍💻" or TargetProcessCommandLine contains "👩🏼‍💼" or TargetProcessCommandLine contains "🧑🏼‍💼" or TargetProcessCommandLine contains "👨🏼‍💼" or TargetProcessCommandLine contains "👩🏼‍🔧" or TargetProcessCommandLine contains "🧑🏼‍🔧" or TargetProcessCommandLine contains "👨🏼‍🔧" or TargetProcessCommandLine contains "👩🏼‍🔬" or TargetProcessCommandLine contains "🧑🏼‍🔬" or TargetProcessCommandLine contains "👨🏼‍🔬" or TargetProcessCommandLine contains "👩🏼‍🎨" or TargetProcessCommandLine contains "🧑🏼‍🎨" or TargetProcessCommandLine contains "👨🏼‍🎨" or TargetProcessCommandLine contains "👩🏼‍🚒" or TargetProcessCommandLine contains "🧑🏼‍🚒" or TargetProcessCommandLine contains "👨🏼‍🚒" or TargetProcessCommandLine contains "👩🏼‍✈️" or TargetProcessCommandLine contains "🧑🏼‍✈️" or TargetProcessCommandLine contains "👨🏼‍✈️" or TargetProcessCommandLine contains "👩🏼‍🚀" or TargetProcessCommandLine contains "🧑🏼‍🚀" or TargetProcessCommandLine contains "👨🏼‍🚀" or TargetProcessCommandLine contains "👩🏼‍⚖️" or TargetProcessCommandLine contains "🧑🏼‍⚖️" or TargetProcessCommandLine contains "👨🏼‍⚖️" or TargetProcessCommandLine contains "👰🏼‍♀️" or TargetProcessCommandLine contains "👰🏼" or TargetProcessCommandLine contains "👰🏼‍♂️" or TargetProcessCommandLine contains "🤵🏼‍♀️" or TargetProcessCommandLine contains "🤵🏼" or TargetProcessCommandLine contains "🤵🏼‍♂️" or TargetProcessCommandLine contains "👸🏼" or TargetProcessCommandLine contains "🫅🏼" or TargetProcessCommandLine contains "🤴🏼" or TargetProcessCommandLine contains "🥷🏼" or TargetProcessCommandLine contains "🦸🏼‍♀️" or TargetProcessCommandLine contains "🦸🏼" or TargetProcessCommandLine contains "🦸🏼‍♂️" or TargetProcessCommandLine contains "🦹🏼‍♀️" or TargetProcessCommandLine contains "🦹🏼" or TargetProcessCommandLine contains "🦹🏼‍♂️" or TargetProcessCommandLine contains "🤶🏼" or TargetProcessCommandLine contains "🧑🏼‍🎄" or TargetProcessCommandLine contains "🎅🏼" or TargetProcessCommandLine contains "🧙🏼‍♀️" or TargetProcessCommandLine contains "🧙🏼" or TargetProcessCommandLine contains "🧙🏼‍♂️" or TargetProcessCommandLine contains "🧝🏼‍♀️" or TargetProcessCommandLine contains "🧝🏼" or TargetProcessCommandLine contains "🧝🏼‍♂️" or TargetProcessCommandLine contains "🧛🏼‍♀️" or TargetProcessCommandLine contains "🧛🏼" or TargetProcessCommandLine contains "🧛🏼‍♂️" or TargetProcessCommandLine contains "🧜🏼‍♀️" or TargetProcessCommandLine contains "🧜🏼" or TargetProcessCommandLine contains "🧜🏼‍♂️" or TargetProcessCommandLine contains "🧚🏼‍♀️" or TargetProcessCommandLine contains "🧚🏼" or TargetProcessCommandLine contains "🧚🏼‍♂️" or TargetProcessCommandLine contains "👼🏼" or TargetProcessCommandLine contains "🤰🏼" or TargetProcessCommandLine contains "🫄🏼" or TargetProcessCommandLine contains "🫃🏼" or TargetProcessCommandLine contains "🤱🏼" or TargetProcessCommandLine contains "👩🏼‍🍼" or TargetProcessCommandLine contains "🧑🏼‍🍼" or TargetProcessCommandLine contains "👨🏼‍🍼" or TargetProcessCommandLine contains "🙇🏼‍♀️" or TargetProcessCommandLine contains "🙇🏼" or TargetProcessCommandLine contains "🙇🏼‍♂️" or TargetProcessCommandLine contains "💁🏼‍♀️" or TargetProcessCommandLine contains "💁🏼" or TargetProcessCommandLine contains "💁🏼‍♂️" or TargetProcessCommandLine contains "🙅🏼‍♀️" or TargetProcessCommandLine contains "🙅🏼" or TargetProcessCommandLine contains "🙅🏼‍♂️" or TargetProcessCommandLine contains "🙆🏼‍♀️" or TargetProcessCommandLine contains "🙆🏼" or TargetProcessCommandLine contains "🙆🏼‍♂️" or TargetProcessCommandLine contains "🙋🏼‍♀️" or TargetProcessCommandLine contains "🙋🏼" or TargetProcessCommandLine contains "🙋🏼‍♂️" or TargetProcessCommandLine contains "🧏🏼‍♀️" or TargetProcessCommandLine contains "🧏🏼" or TargetProcessCommandLine contains "🧏🏼‍♂️" or TargetProcessCommandLine contains "🤦🏼‍♀️" or TargetProcessCommandLine contains "🤦🏼" or TargetProcessCommandLine contains "🤦🏼‍♂️" or TargetProcessCommandLine contains "🤷🏼‍♀️"

Required Data Sources

False Positive Guidance

• Unknown

References

• Internal Research
• SigmaHQ Rule