Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 3

Hunt Hypothesis

Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.

Detection Rule

Sigma (Original)

title: Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 3
id: f9578658-9e71-4711-b634-3f9b50cd3c06
status: test
description: Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.
author: '@Kostastsale, TheDFIRReport'
references:
    - Internal Research
tags:
    - attack.stealth
date: 2022-12-05
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        CommandLine|contains:
            - '🦆'
            - '🦅'
            - '🦉'
            - '🦇'
            - '🐺'
            - '🐗'
            - '🐴'
            - '🦄'
            - '🐝'
            - '🪱'
            - '🐛'
            - '🦋'
            - '🐌'
            - '🐞'
            - '🐜'
            - '🪰'
            - '🪲'
            - '🪳'
            - '🦟'
            - '🦗'
            - '🕷'
            - '🕸'
            - '🦂'
            - '🐢'
            - '🐍'
            - '🦎'
            - '🦖'
            - '🦕'
            - '🐙'
            - '🦑'
            - '🦐'
            - '🦞'
            - '🦀'
            - '🪸'
            - '🐡'
            - '🐠'
            - '🐟'
            - '🐬'
            - '🐳'
            - '🐋'
            - '🦈'
            - '🐊'
            - '🐅'
            - '🐆'
            - '🦓'
            - '🦍'
            - '🦧'
            - '🦣'
            - '🐘'
            - '🦛'
            - '🦏'
            - '🐪'
            - '🐫'
            - '🦒'
            - '🦘'
            - '🦬'
            - '🐃'
            - '🐂'
            - '🐄'
            - '🐎'
            - '🐖'
            - '🐏'
            - '🐑'
            - '🦙'
            - '🐐'
            - '🦌'
            - '🐕'
            - '🐩'
            - '🦮'
            - '🐕‍🦺'
            - '🐈'
            - '🐈‍⬛'
            - '🪶'
            - '🐓'
            - '🦃'
            - '🦤'
            - '🦚'
            - '🦜'
            - '🦢'
            - '🦩'
            - '🕊'
            - '🐇'
            - '🦝'
            - '🦨'
            - '🦡'
            - '🦫'
            - '🦦'
            - '🦥'
            - '🐁'
            - '🐀'
            - '🐿'
            - '🦔'
            - '🐾'
            - '🐉'
            - '🐲'
            - '🌵'
            - '🎄'
            - '🌲'
            - '🌳'
            - '🌴'
            - '🪹'
            - '🪺'
            - '🪵'
            - '🌱'
            - '🌿'
            - '☘️'
            - '🍀'
            - '🎍'
            - '🪴'
            - '🎋'
            - '🍃'
            - '🍂'
            - '🍁'
            - '🍄'
            - '🐚'
            - '🪨'
            - '🌾'
            - '💐'
            - '🌷'
            - '🪷'
            - '🌹'
            - '🥀'
            - '🌺'
            - '🌸'
            - '🌼'
            - '🌻'
            - '🌞'
            - '🌝'
            - '🌛'
            - '🌜'
            - '🌚'
            - '🌕'
            - '🌖'
            - '🌗'
            - '🌘'
            - '🌑'
            - '🌒'
            - '🌓'
            - '🌔'
            - '🌙'
            - '🌎'
            - '🌍'
            - '🌏'
            - '🪐'
            - '💫'
            - '⭐️'
            - '🌟'
            - '✨'
            - '⚡️'
            - '☄️'
            - '💥'
            - '🔥'
            - '🌪'
            - '🌈'
            - '☀️'
            - '🌤'
            - '⛅️'
            - '🌥'
            - '☁️'
            - '🌦'
            - '🌧'
            - '⛈'
            - '🌩'
            - '🌨'
            - '❄️'
            - '☃️'
            - '⛄️'
            - '🌬'
            - '💨'
            - '💧'
            - '💦'
            - '🫧'
            - '☔️'
            - '☂️'
            - '🌊'
            - '🌫🍏'
            - '🍎'
            - '🍐'
            - '🍊'
            - '🍋'
            - '🍌'
            - '🍉'
            - '🍇'
            - '🍓'
            - '🫐'
            - '🍈'
            - '🍒'
            - '🍑'
            - '🥭'
            - '🍍'
            - '🥥'
            - '🥝'
            - '🍅'
            - '🍆'
            - '🥑'
            - '🥦'
            - '🥬'
            - '🥒'
            - '🌶'
            - '🫑'
            - '🌽'
            - '🥕'
            - '🫒'
            - '🧄'
            - '🧅'
            - '🥔'
            - '🍠'
            - '🫘'
            - '🥐'
            - '🥯'
            - '🍞'
            - '🥖'
            - '🥨'
            - '🧀'
            - '🥚'
            - '🍳'
            - '🧈'
            - '🥞'
            - '🧇'
            - '🥓'
            - '🥩'
            - '🍗'
            - '🍖'
            - '🦴'
            - '🌭'
            - '🍔'
            - '🍟'
            - '🍕'
            - '🫓'
            - '🥪'
            - '🥙'
            - '🧆'
            - '🌮'
            - '🌯'
            - '🫔'
            - '🥗'
            - '🥘'
            - '🫕'
            - '🥫'
            - '🍝'
            - '🍜'
            - '🍲'
            - '🍛'
            - '🍣'
            - '🍱'
            - '🥟'
            - '🦪'
            - '🍤'
            - '🍙'
            - '🍚'
            - '🍘'
            - '🍥'
            - '🥠'
            - '🥮'
            - '🍢'
            - '🍡'
            - '🍧'
            - '🍨'
            - '🍦'
            - '🥧'
            - '🧁'
            - '🍰'
            - '🎂'
            - '🍮'
            - '🍭'
            - '🍬'
            - '🍫'
            - '🍿'
            - '🍩'
            - '🍪'
            - '🌰'
            - '🥜'
            - '🍯'
            - '🥛'
            - '🍼'
            - '🫖'
            - '☕️'
            - '🍵'
            - '🧃'
            - '🥤'
            - '🧋'
            - '🫙'
            - '🍶'
            - '🍺'
            - '🍻'
            - '🥂'
            - '🍷'
            - '🫗'
            - '🥃'
            - '🍸'
            - '🍹'
            - '🧉'
            - '🍾'
            - '🧊'
            - '🥄'
            - '🍴'
            - '🍽'
            - '🥣'
            - '🥡'
            - '🥢'
            - '🧂'
            - '⚽️'
            - '🏀'
            - '🏈'
            - '⚾️'
            - '🥎'
            - '🎾'
            - '🏐'
            - '🏉'
            - '🥏'
            - '🎱'
            - '🪀'
            - '🏓'
            - '🏸'
            - '🏒'
            - '🏑'
            - '🥍'
            - '🏏'
            - '🪃'
            - '🥅'
            - '⛳️'
            - '🪁'
            - '🏹'
            - '🎣'
            - '🤿'
            - '🥊'
            - '🥋'
            - '🎽'
            - '🛹'
            - '🛼'
            - '🛷'
            - '⛸'
            - '🥌'
            - '🎿'
            - '⛷'
            - '🏂'
            - '🪂'
            - '🏋️‍♀️'
            - '🏋️'
            - '🏋️‍♂️'
            - '🤼‍♀️'
            - '🤼'
            - '🤼‍♂️'
            - '🤸‍♀️'
            - '🤸'
            - '🤸‍♂️'
            - '⛹️‍♀️'
            - '⛹️'
            - '⛹️‍♂️'
            - '🤺'
            - '🤾‍♀️'
            - '🤾'
            - '🤾‍♂️'
            - '🏌️‍♀️'
            - '🏌️'
            - '🏌️‍♂️'
            - '🏇'
            - '🧘‍♀️'
            - '🧘'
            - '🧘‍♂️'
            - '🏄‍♀️'
            - '🏄'
            - '🏄‍♂️'
            - '🏊‍♀️'
            - '🏊'
            - '🏊‍♂️'
            - '🤽‍♀️'
            - '🤽'
            - '🤽‍♂️'
            - '🚣‍♀️'
            - '🚣'
            - '🚣‍♂️'
            - '🧗‍♀️'
            - '🧗'
            - '🧗‍♂️'
            - '🚵‍♀️'
            - '🚵'
            - '🚵‍♂️'
            - '🚴‍♀️'
            - '🚴'
            - '🚴‍♂️'
            - '🏆'
            - '🥇'
            - '🥈'
            - '🥉'
            - '🏅'
            - '🎖'
            - '🏵'
            - '🎗'
            - '🎫'
            - '🎟'
            - '🎪'
            - '🤹'
            - '🤹‍♂️'
            - '🤹‍♀️'
            - '🎭'
            - '🩰'
            - '🎨'
            - '🎬'
            - '🎤'
            - '🎧'
            - '🎼'
            - '🎹'
            - '🥁'
            - '🪘'
            - '🎷'
            - '🎺'
            - '🪗'
            - '🎸'
            - '🪕'
            - '🎻'
            - '🎲'
            - '♟'
            - '🎯'
            - '🎳'
            - '🎮'
            - '🎰'
            - '🧩'
            - '🚗'
            - '🚕'
            - '🚙'
            - '🚌'
            - '🚎'
            - '🏎'
            - '🚓'
            - '🚑'
            - '🚒'
            - '🚐'
            - '🛻'
            - '🚚'
            - '🚛'
            - '🚜'
            - '🦯'
            - '🦽'
            - '🦼'
            - '🛴'
            - '🚲'
            - '🛵'
            - '🏍'
            - '🛺'
            - '🚨'
            - '🚔'
            - '🚍'
            - '🚘'
            - '🚖'
            - '🛞'
            - '🚡'
            - '🚠'
            - '🚟'
            - '🚃'
            - '🚋'
            - '🚞'
            - '🚝'
            - '🚄'
            - '🚅'
            - '🚈'
            - '🚂'
            - '🚆'
            - '🚇'
            - '🚊'
            - '🚉'
            - '✈️'
            - '🛫'
            - '🛬'
            - '🛩'
            - '💺'
            - '🛰'
            - '🚀'
            - '🛸'
            - '🚁'
            - '🛶'
            - '⛵️'
            - '🚤'
            - '🛥'
            - '🛳'
            - '⛴'
            - '🚢'
            - '⚓️'
            - '🛟'
            - '🪝'
            - '⛽️'
            - '🚧'
            - '🚦'
            - '🚥'
            - '🚏'
            - '🗺'
            - '🗿'
            - '🗽'
            - '🗼'
            - '🏰'
            - '🏯'
            - '🏟'
            - '🎡'
            - '🎢'
            - '🛝'
            - '🎠'
            - '⛲️'
            - '⛱'
            - '🏖'
            - '🏝'
            - '🏜'
            - '🌋'
            - '⛰'
            - '🏔'
            - '🗻'
            - '🏕'
            - '⛺️'
            - '🛖'
            - '🏠'
            - '🏡'
            - '🏘'
            - '🏚'
            - '🏗'
            - '🏭'
            - '🏢'
            - '🏬'
            - '🏣'
            - '🏤'
            - '🏥'
            - '🏦'
            - '🏨'
            - '🏪'
            - '🏫'
            - '🏩'
            - '💒'
            - '🏛'
            - '⛪️'
            - '🕌'
            - '🕍'
            - '🛕'
            - '🕋'
            - '⛩'
            - '🛤'
            - '🛣'
            - '🗾'
            - '🎑'
            - '🏞'
            - '🌅'
            - '🌄'
            - '🌠'
            - '🎇'
            - '🎆'
            - '🌇'
            - '🌆'
            - '🏙'
            - '🌃'
            - '🌌'
            - '🌉'
            - '🌁'
            - '⌚️'
            - '📱'
            - '📲'
            - '💻'
            - '⌨️'
            - '🖥'
            - '🖨'
            - '🖱'
            - '🖲'
            - '🕹'
            - '🗜'
            - '💽'
            - '💾'
            - '💿'
            - '📀'
            - '📼'
            - '📷'
            - '📸'
            - '📹'
            - '🎥'
            - '📽'
            - '🎞'
            - '📞'
            - '☎️'
            - '📟'
            - '📠'
            - '📺'
            - '📻'
            - '🎙'
            - '🎚'
            - '🎛'
            - '🧭'
            - '⏱'
            - '⏲'
            - '⏰'
            - '🕰'
            - '⌛️'
            - '⏳'
            - '📡'
            - '🔋'
            - '🪫'
            - '🔌'
            - '💡'
            - '🔦'
            - '🕯'
            - '🪔'
            - '🧯'
            - '🛢'
            - '💸'
            - '💵'
            - '💴'
            - '💶'
            - '💷'
            - '🪙'
            - '💰'
            - '💳'
            - '💎'
            - '⚖️'
            - '🪜'
            - '🧰'
            - '🪛'
            - '🔧'
            - '🔨'
            - '⚒'
            - '🛠'
            - '⛏'
            - '🪚'
            - '🔩'
            - '⚙️'
            - '🪤'
            - '🧱'
            - '⛓'
            - '🧲'
            - '🔫'
            - '💣'
            - '🧨'
            - '🪓'
            - '🔪'
            - '🗡'
            - '⚔️'
            - '🛡'
            - '🚬'
            - '⚰️'
            - '🪦'
            - '⚱️'
            - '🏺'
            - '🔮'
            - '📿'
            - '🧿'
            - '🪬'
            - '💈'
            - '⚗️'
            - '🔭'
            - '🔬'
            - '🕳'
            - '🩹'
            - '🩺'
            - '🩻'
            - '🩼'
            - '💊'
            - '💉'
            - '🩸'
            - '🧬'
            - '🦠'
            - '🧫'
            - '🧪'
            - '🌡'
            - '🧹'
            - '🪠'
            - '🧺'
            - '🧻'
            - '🚽'
            - '🚰'
            - '🚿'
            - '🛁'
            - '🛀'
            - '🧼'
            - '🪥'
            - '🪒'
            - '🧽'
            - '🪣'
            - '🧴'
            - '🛎'
            - '🔑'
            - '🗝'
            - '🚪'
            - '🪑'
            - '🛋'
            - '🛏'
            - '🛌'
            - '🧸'
            - '🪆'
            - '🖼'
            - '🪞'
            - '🪟'
            - '🛍'
            - '🛒'
            - '🎁'
            - '🎈'
            - '🎏'
            - '🎀'
            - '🪄'
            - '🪅'
            - '🎊'
            - '🎉'
            - '🪩'
            - '🎎'
            - '🏮'
            - '🎐'
            - '🧧'
            - '✉️'
            - '📩'
            - '📨'
            - '📧'
            - '💌'
            - '📥'
            - '📤'
            - '📦'
            - '🏷'
            - '🪧'
            - '📪'
            - '📫'
            - '📬'
            - '📭'
            - '📮'
            - '📯'
            - '📜'
            - '📃'
            - '📄'
            - '📑'
            - '🧾'
            - '📊'
            - '📈'
            - '📉'
            - '🗒'
            - '🗓'
            - '📆'
            - '📅'
            - '🗑'
            - '🪪'
            - '📇'
            - '🗃'
            - '🗳'
            - '🗄'
            - '📋'
            - '📁'
            - '📂'
            - '🗂'
            - '🗞'
            - '📰'
            - '📓'
            - '📔'
            - '📒'
            - '📕'
            - '📗'
            - '📘'
            - '📙'
            - '📚'
            - '📖'
            - '🔖'
            - '🧷'
            - '🔗'
            - '📎'
            - '🖇'
            - '📐'
            - '📏'
            - '🧮'
            - '📌'
            - '📍'
            - '✂️'
            - '🖊'
            - '🖋'
            - '✒️'
            - '🖌'
            - '🖍'
            - '📝'
            - '✏️'
            - '🔍'
            - '🔎'
            - '🔏'
            - '🔐'
            - '🔒'
            - '🔓❤️'
            - '🧡'
            - '💛'
            - '💚'
            - '💙'
            - '💜'
            - '🖤'
            - '🤍'
            - '🤎'
            - '❤️‍🔥'
            - '❤️‍🩹'
            - '💔'
            - '❣️'
            - '💕'
            - '💞'
            - '💓'
            - '💗'
            - '💖'
            - '💘'
            - '💝'
            - '💟'
            - '☮️'
            - '✝️'
            - '☪️'
            - '🕉'
            - '☸️'
            - '✡️'
            - '🔯'
            - '🕎'
            - '☯️'
            - '☦️'
            - '🛐'
            - '⛎'
            - '♈️'
            - '♉️'
            - '♊️'
            - '♋️'
            - '♌️'
            - '♍️'
            - '♎️'
            - '♏️'
            - '♐️'
            - '♑️'
            - '♒️'
            - '♓️'
            - '🆔'
            - '⚛️'
            - '🉑'
            - '☢️'
            - '☣️'
            - '📴'
            - '📳'
            - '🈶'
            - '🈚️'
            - '🈸'
            - '🈺'
            - '🈷️'
            - '✴️'
            - '🆚'
            - '💮'
            - '🉐'
            - '㊙️'
            - '㊗️'
            - '🈴'
            - '🈵'
            - '🈹'
            - '🈲'
            - '🅰️'
            - '🅱️'
            - '🆎'
            - '🆑'
            - '🅾️'
            - '🆘'
            - '❌'
            - '⭕️'
            - '🛑'
            - '⛔️'
            - '📛'
            - '🚫'
            - '💯'
            - '💢'
            - '♨️'
            - '🚷'
            - '🚯'
            - '🚳'
            - '🚱'
            - '🔞'
            - '📵'
            - '🚭'
            - '❗️'
            - '❕'
            - '❓'
            - '❔'
            - '‼️'
            - '⁉️'
            - '🔅'
            - '🔆'
            - '〽️'
            - '⚠️'
            - '🚸'
            - '🔱'
            - '⚜️'
            - '🔰'
            - '♻️'
            - '✅'
            - '🈯️'
            - '💹'
            - '❇️'
            - '✳️'
            - '❎'
            - '🌐'
            - '💠'
            - 'Ⓜ️'
            - '🌀'
            - '💤'
            - '🏧'
            - '🚾'
            - '♿️'
            - '🅿️'
            - '🛗'
            - '🈳'
            - '🈂️'
            - '🛂'
            - '🛃'
            - '🛄'
            - '🛅'
            - '🚹'
            - '🚺'
            - '🚼'
            - '⚧'
            - '🚻'
            - '🚮'
            - '🎦'
            - '📶'
            - '🈁'
            - '🔣'
            - 'ℹ️'
            - '🔤'
            - '🔡'
            - '🔠'
            - '🆖'
            - '🆗'
            - '🆙'
            - '🆒'
            - '🆕'
            - '🆓'
            - '0️⃣'
            - '1️⃣'
            - '2️⃣'
            - '3️⃣'
            - '4️⃣'
            - '5️⃣'
            - '6️⃣'
            - '7️⃣'
            - '8️⃣'
            - '9️⃣'
            - '🔟'
            - '🔢'
            - '#️⃣'
            - '*️⃣'
            - '⏏️'
            - '▶️'
            - '⏸'
            - '⏯'
            - '⏹'
            - '⏺'
            - '⏭'
            - '⏮'
            - '⏩'
            - '⏪'
            - '⏫'
            - '⏬'
            - '◀️'
            - '🔼'
            - '🔽'
            - '➡️'
            - '⬅️'
            - '⬆️'
            - '⬇️'
            - '↗️'
            - '↘️'
            - '↙️'
            - '↖️'
            - '↕️'
            - '↔️'
            - '↪️'
            - '↩️'
            - '⤴️'
            - '⤵️'
            - '🔀'
            - '🔁'
            - '🔂'
            - '🔄'
            - '🔃'
            - '🎵'
            - '🎶'
            - '➕'
            - '➖'
            - '➗'
            - '✖️'
            - '🟰'
            - '♾'
            - '💲'
            - '💱'
            - '™️'
            - '©️'
            - '®️'
            - '〰️'
            - '➰'
            - '➿'
            - '🔚'
            - '🔙'
            - '🔛'
            - '🔝'
            - '🔜'
            - '✔️'
            - '☑️'
            - '🔘'
            - '🔴'
            - '🟠'
            - '🟡'
            - '🟢'
            - '🔵'
            - '🟣'
            - '⚫️'
            - '⚪️'
            - '🟤'
            - '🔺'
            - '🔻'
    condition: selection
falsepositives:
    - Unknown
level: high

KQL (Azure Sentinel)

imProcessCreate
| where TargetProcessCommandLine contains "🦆" or TargetProcessCommandLine contains "🦅" or TargetProcessCommandLine contains "🦉" or TargetProcessCommandLine contains "🦇" or TargetProcessCommandLine contains "🐺" or TargetProcessCommandLine contains "🐗" or TargetProcessCommandLine contains "🐴" or TargetProcessCommandLine contains "🦄" or TargetProcessCommandLine contains "🐝" or TargetProcessCommandLine contains "🪱" or TargetProcessCommandLine contains "🐛" or TargetProcessCommandLine contains "🦋" or TargetProcessCommandLine contains "🐌" or TargetProcessCommandLine contains "🐞" or TargetProcessCommandLine contains "🐜" or TargetProcessCommandLine contains "🪰" or TargetProcessCommandLine contains "🪲" or TargetProcessCommandLine contains "🪳" or TargetProcessCommandLine contains "🦟" or TargetProcessCommandLine contains "🦗" or TargetProcessCommandLine contains "🕷" or TargetProcessCommandLine contains "🕸" or TargetProcessCommandLine contains "🦂" or TargetProcessCommandLine contains "🐢" or TargetProcessCommandLine contains "🐍" or TargetProcessCommandLine contains "🦎" or TargetProcessCommandLine contains "🦖" or TargetProcessCommandLine contains "🦕" or TargetProcessCommandLine contains "🐙" or TargetProcessCommandLine contains "🦑" or TargetProcessCommandLine contains "🦐" or TargetProcessCommandLine contains "🦞" or TargetProcessCommandLine contains "🦀" or TargetProcessCommandLine contains "🪸" or TargetProcessCommandLine contains "🐡" or TargetProcessCommandLine contains "🐠" or TargetProcessCommandLine contains "🐟" or TargetProcessCommandLine contains "🐬" or TargetProcessCommandLine contains "🐳" or TargetProcessCommandLine contains "🐋" or TargetProcessCommandLine contains "🦈" or TargetProcessCommandLine contains "🐊" or TargetProcessCommandLine contains "🐅" or TargetProcessCommandLine contains "🐆" or TargetProcessCommandLine contains "🦓" or TargetProcessCommandLine contains "🦍" or TargetProcessCommandLine contains "🦧" or TargetProcessCommandLine contains "🦣" or TargetProcessCommandLine contains "🐘" or TargetProcessCommandLine contains "🦛" or TargetProcessCommandLine contains "🦏" or TargetProcessCommandLine contains "🐪" or TargetProcessCommandLine contains "🐫" or TargetProcessCommandLine contains "🦒" or TargetProcessCommandLine contains "🦘" or TargetProcessCommandLine contains "🦬" or TargetProcessCommandLine contains "🐃" or TargetProcessCommandLine contains "🐂" or TargetProcessCommandLine contains "🐄" or TargetProcessCommandLine contains "🐎" or TargetProcessCommandLine contains "🐖" or TargetProcessCommandLine contains "🐏" or TargetProcessCommandLine contains "🐑" or TargetProcessCommandLine contains "🦙" or TargetProcessCommandLine contains "🐐" or TargetProcessCommandLine contains "🦌" or TargetProcessCommandLine contains "🐕" or TargetProcessCommandLine contains "🐩" or TargetProcessCommandLine contains "🦮" or TargetProcessCommandLine contains "🐕‍🦺" or TargetProcessCommandLine contains "🐈" or TargetProcessCommandLine contains "🐈‍⬛" or TargetProcessCommandLine contains "🪶" or TargetProcessCommandLine contains "🐓" or TargetProcessCommandLine contains "🦃" or TargetProcessCommandLine contains "🦤" or TargetProcessCommandLine contains "🦚" or TargetProcessCommandLine contains "🦜" or TargetProcessCommandLine contains "🦢" or TargetProcessCommandLine contains "🦩" or TargetProcessCommandLine contains "🕊" or TargetProcessCommandLine contains "🐇" or TargetProcessCommandLine contains "🦝" or TargetProcessCommandLine contains "🦨" or TargetProcessCommandLine contains "🦡" or TargetProcessCommandLine contains "🦫" or TargetProcessCommandLine contains "🦦" or TargetProcessCommandLine contains "🦥" or TargetProcessCommandLine contains "🐁" or TargetProcessCommandLine contains "🐀" or TargetProcessCommandLine contains "🐿" or TargetProcessCommandLine contains "🦔" or TargetProcessCommandLine contains "🐾" or TargetProcessCommandLine contains "🐉" or TargetProcessCommandLine contains "🐲" or TargetProcessCommandLine contains "🌵" or TargetProcessCommandLine contains "🎄" or TargetProcessCommandLine contains "🌲" or TargetProcessCommandLine contains "🌳" or TargetProcessCommandLine contains "🌴" or TargetProcessCommandLine contains "🪹" or TargetProcessCommandLine contains "🪺" or TargetProcessCommandLine contains "🪵" or TargetProcessCommandLine contains "🌱" or TargetProcessCommandLine contains "🌿" or TargetProcessCommandLine contains "☘️" or TargetProcessCommandLine contains "🍀" or TargetProcessCommandLine contains "🎍" or TargetProcessCommandLine contains "🪴" or TargetProcessCommandLine contains "🎋" or TargetProcessCommandLine contains "🍃" or TargetProcessCommandLine contains "🍂" or TargetProcessCommandLine contains "🍁" or TargetProcessCommandLine contains "🍄" or TargetProcessCommandLine contains "🐚" or TargetProcessCommandLine contains "🪨" or TargetProcessCommandLine contains "🌾" or TargetProcessCommandLine contains "💐" or TargetProcessCommandLine contains "🌷" or TargetProcessCommandLine contains "🪷" or TargetProcessCommandLine contains "🌹" or TargetProcessCommandLine contains "🥀" or TargetProcessCommandLine contains "🌺" or TargetProcessCommandLine contains "🌸" or TargetProcessCommandLine contains "🌼" or TargetProcessCommandLine contains "🌻" or TargetProcessCommandLine contains "🌞" or TargetProcessCommandLine contains "🌝" or TargetProcessCommandLine contains "🌛" or TargetProcessCommandLine contains "🌜" or TargetProcessCommandLine contains "🌚" or TargetProcessCommandLine contains "🌕" or TargetProcessCommandLine contains "🌖" or TargetProcessCommandLine contains "🌗" or TargetProcessCommandLine contains "🌘" or TargetProcessCommandLine contains "🌑" or TargetProcessCommandLine contains "🌒" or TargetProcessCommandLine contains "🌓" or TargetProcessCommandLine contains "🌔" or TargetProcessCommandLine contains "🌙" or TargetProcessCommandLine contains "🌎" or TargetProcessCommandLine contains "🌍" or TargetProcessCommandLine contains "🌏" or TargetProcessCommandLine contains "🪐" or TargetProcessCommandLine contains "💫" or TargetProcessCommandLine contains "⭐️" or TargetProcessCommandLine contains "🌟" or TargetProcessCommandLine contains "✨" or TargetProcessCommandLine contains "⚡️" or TargetProcessCommandLine contains "☄️" or TargetProcessCommandLine contains "💥" or TargetProcessCommandLine contains "🔥" or TargetProcessCommandLine contains "🌪" or TargetProcessCommandLine contains "🌈" or TargetProcessCommandLine contains "☀️" or TargetProcessCommandLine contains "🌤" or TargetProcessCommandLine contains "⛅️" or TargetProcessCommandLine contains "🌥" or TargetProcessCommandLine contains "☁️" or TargetProcessCommandLine contains "🌦" or TargetProcessCommandLine contains "🌧" or TargetProcessCommandLine contains "⛈" or TargetProcessCommandLine contains "🌩" or TargetProcessCommandLine contains "🌨" or TargetProcessCommandLine contains "❄️" or TargetProcessCommandLine contains "☃️" or TargetProcessCommandLine contains "⛄️" or TargetProcessCommandLine contains "🌬" or TargetProcessCommandLine contains "💨" or TargetProcessCommandLine contains "💧" or TargetProcessCommandLine contains "💦" or TargetProcessCommandLine contains "🫧" or TargetProcessCommandLine contains "☔️" or TargetProcessCommandLine contains "☂️" or TargetProcessCommandLine contains "🌊" or TargetProcessCommandLine contains "🌫🍏" or TargetProcessCommandLine contains "🍎" or TargetProcessCommandLine contains "🍐" or TargetProcessCommandLine contains "🍊" or TargetProcessCommandLine contains "🍋" or TargetProcessCommandLine contains "🍌" or TargetProcessCommandLine contains "🍉" or TargetProcessCommandLine contains "🍇" or TargetProcessCommandLine contains "🍓" or TargetProcessCommandLine contains "🫐" or TargetProcessCommandLine contains "🍈" or TargetProcessCommandLine contains "🍒" or TargetProcessCommandLine contains "🍑" or TargetProcessCommandLine contains "🥭" or TargetProcessCommandLine contains "🍍" or TargetProcessCommandLine contains "🥥" or TargetProcessCommandLine contains "🥝" or TargetProcessCommandLine contains "🍅" or TargetProcessCommandLine contains "🍆" or TargetProcessCommandLine contains "🥑" or TargetProcessCommandLine contains "🥦" or TargetProcessCommandLine contains "🥬" or TargetProcessCommandLine contains "🥒" or TargetProcessCommandLine contains "🌶" or TargetProcessCommandLine contains "🫑" or TargetProcessCommandLine contains "🌽" or TargetProcessCommandLine contains "🥕" or TargetProcessCommandLine contains "🫒" or TargetProcessCommandLine contains "🧄" or TargetProcessCommandLine contains "🧅" or TargetProcessCommandLine contains "🥔" or TargetProcessCommandLine contains "🍠" or TargetProcessCommandLine contains "🫘" or TargetProcessCommandLine contains "🥐" or TargetProcessCommandLine contains "🥯" or TargetProcessCommandLine contains "🍞" or TargetProcessCommandLine contains "🥖" or TargetProcessCommandLine contains "🥨" or TargetProcessCommandLine contains "🧀" or TargetProcessCommandLine contains "🥚" or TargetProcessCommandLine contains "🍳" or TargetProcessCommandLine contains "🧈" or TargetProcessCommandLine contains "🥞" or TargetProcessCommandLine contains "🧇" or TargetProcessCommandLine contains "🥓" or TargetProcessCommandLine contains "🥩" or TargetProcessCommandLine contains "🍗" or TargetProcessCommandLine contains "🍖" or TargetProcessCommandLine contains "🦴" or TargetProcessCommandLine contains "🌭" or TargetProcessCommandLine contains "🍔" or TargetProcessCommandLine contains "🍟" or TargetProcessCommandLine contains "🍕" or TargetProcessCommandLine contains "🫓" or TargetProcessCommandLine contains "🥪" or TargetProcessCommandLine contains "🥙" or TargetProcessCommandLine contains "🧆" or TargetProcessCommandLine contains "🌮" or TargetProcessCommandLine contains "🌯" or TargetProcessCommandLine contains "🫔" or TargetProcessCommandLine contains "🥗" or TargetProcessCommandLine contains "🥘" or TargetProcessCommandLine contains "🫕" or TargetProcessCommandLine contains "🥫" or TargetProcessCommandLine contains "🍝" or TargetProcessCommandLine contains "🍜" or TargetProcessCommandLine contains "🍲" or TargetProcessCommandLine contains "🍛" or TargetProcessCommandLine contains "🍣" or TargetProcessCommandLine contains "🍱" or TargetProcessCommandLine contains "🥟" or TargetProcessCommandLine contains "🦪" or TargetProcessCommandLine contains "🍤" or TargetProcessCommandLine contains "🍙" or TargetProcessCommandLine contains "🍚" or TargetProcessCommandLine contains "🍘" or TargetProcessCommandLine contains "🍥" or TargetProcessCommandLine contains "🥠" or TargetProcessCommandLine contains "🥮" or TargetProcessCommandLine contains "🍢" or TargetProcessCommandLine contains "🍡" or TargetProcessCommandLine contains "🍧" or TargetProcessCommandLine contains "🍨" or TargetProcessCommandLine contains "🍦" or TargetProcessCommandLine contains "🥧" or TargetProcessCommandLine contains "🧁" or TargetProcessCommandLine contains "🍰" or TargetProcessCommandLine contains "🎂" or TargetProcessCommandLine contains "🍮" or TargetProcessCommandLine contains "🍭" or TargetProcessCommandLine contains "🍬" or TargetProcessCommandLine contains "🍫" or TargetProcessCommandLine contains "🍿" or TargetProcessCommandLine contains "🍩" or TargetProcessCommandLine contains "🍪" or TargetProcessCommandLine contains "🌰" or TargetProcessCommandLine contains "🥜" or TargetProcessCommandLine contains "🍯" or TargetProcessCommandLine contains "🥛" or TargetProcessCommandLine contains "🍼" or TargetProcessCommandLine contains "🫖" or TargetProcessCommandLine contains "☕️" or TargetProcessCommandLine contains "🍵" or TargetProcessCommandLine contains "🧃" or TargetProcessCommandLine contains "🥤" or TargetProcessCommandLine contains "🧋" or TargetProcessCommandLine contains "🫙" or TargetProcessCommandLine contains "🍶" or TargetProcessCommandLine contains "🍺" or TargetProcessCommandLine contains "🍻" or TargetProcessCommandLine contains "🥂" or TargetProcessCommandLine contains "🍷" or TargetProcessCommandLine contains "🫗" or TargetProcessCommandLine contains "🥃" or TargetProcessCommandLine contains "🍸" or TargetProcessCommandLine contains "🍹" or TargetProcessCommandLine contains "🧉" or TargetProcessCommandLine contains "🍾" or TargetProcessCommandLine contains "🧊" or TargetProcessCommandLine contains "🥄" or TargetProcessCommandLine contains "🍴" or TargetProcessCommandLine contains "🍽" or TargetProcessCommandLine contains "🥣" or TargetProcessCommandLine contains "🥡" or TargetProcessCommandLine contains "🥢" or TargetProcessCommandLine contains "🧂" or TargetProcessCommandLine contains "⚽️" or TargetProcessCommandLine contains "🏀" or TargetProcessCommandLine contains "🏈" or TargetProcessCommandLine contains "⚾️" or TargetProcessCommandLine contains "🥎" or TargetProcessCommandLine contains "🎾" or TargetProcessCommandLine contains "🏐" or TargetProcessCommandLine contains "🏉" or TargetProcessCommandLine contains "🥏" or TargetProcessCommandLine contains "🎱" or TargetProcessCommandLine contains "🪀" or TargetProcessCommandLine contains "🏓" or TargetProcessCommandLine contains "🏸" or TargetProcessCommandLine contains "🏒" or TargetProcessCommandLine contains "🏑" or TargetProcessCommandLine contains "🥍" or TargetProcessCommandLine contains "🏏" or TargetProcessCommandLine contains "🪃" or TargetProcessCommandLine contains "🥅" or TargetProcessCommandLine contains "⛳️" or TargetProcessCommandLine contains "🪁" or TargetProcessCommandLine contains "🏹" or TargetProcessCommandLine contains "🎣" or TargetProcessCommandLine contains "🤿" or TargetProcessCommandLine contains "🥊" or TargetProcessCommandLine contains "🥋" or TargetProcessCommandLine contains "🎽" or TargetProcessCommandLine contains "🛹" or TargetProcessCommandLine contains "🛼" or TargetProcessCommandLine contains "🛷" or TargetProcessCommandLine contains "⛸" or TargetProcessCommandLine contains "🥌" or TargetProcessCommandLine contains "🎿" or TargetProcessCommandLine contains "⛷" or TargetProcessCommandLine contains "🏂" or TargetProcessCommandLine contains "🪂" or TargetProcessCommandLine contains "🏋️‍♀️" or TargetProcessCommandLine contains "🏋️" or TargetProcessCommandLine contains "🏋️‍♂️" or TargetProcessCommandLine contains "🤼‍♀️" or TargetProcessCommandLine contains "🤼" or TargetProcessCommandLine contains "🤼‍♂️" or TargetProcessCommandLine contains "🤸‍♀️" or TargetProcessCommandLine contains "🤸" or TargetProcessCommandLine contains "🤸‍♂️" or TargetProcessCommandLine contains "⛹️‍♀️" or TargetProcessCommandLine contains "⛹️" or TargetProcessCommandLine contains "⛹️‍♂️" or TargetProcessCommandLine contains "🤺" or TargetProcessCommandLine contains "🤾‍♀️" or TargetProcessCommandLine contains "🤾" or TargetProcessCommandLine contains "🤾‍♂️" or TargetProcessCommandLine contains "🏌️‍♀️" or TargetProcessCommandLine contains "🏌️" or TargetProcessCommandLine contains "🏌️‍♂️" or TargetProcessCommandLine contains "🏇" or TargetProcessCommandLine contains "🧘‍♀️" or TargetProcessCommandLine contains "🧘" or TargetProcessCommandLine contains "🧘‍♂️" or TargetProcessCommandLine contains "🏄‍♀️" or TargetProcessCommandLine contains "🏄" or TargetProcessCommandLine contains "🏄‍♂️" or TargetProcessCommandLine contains "🏊‍♀️" or TargetProcessCommandLine contains "🏊" or TargetProcessCommandLine contains "🏊‍♂️" or TargetProcessCommandLine contains "🤽‍♀️" or TargetProcessCommandLine contains "🤽" or TargetProcessCommandLine contains "🤽‍♂️" or TargetProcessCommandLine contains "🚣‍♀️" or TargetProcessCommandLine contains "🚣" or TargetProcessCommandLine contains "🚣‍♂️" or TargetProcessCommandLine contains "🧗‍♀️" or TargetProcessCommandLine contains "🧗" or TargetProcessCommandLine contains "🧗‍♂️" or TargetProcessCommandLine contains "🚵‍♀️" or TargetProcessCommandLine contains "🚵" or TargetProcessCommandLine contains "🚵‍♂️" or TargetProcessCommandLine contains "🚴‍♀️" or TargetProcessCommandLine contains "🚴" or TargetProcessCommandLine contains "🚴‍♂️" or TargetProcessCommandLine contains "🏆" or TargetProcessCommandLine contains "🥇" or TargetProcessCommandLine contains "🥈" or TargetProcessCommandLine contains "🥉" or TargetProcessCommandLine contains "🏅" or TargetProcessCommandLine contains "🎖" or TargetProcessCommandLine contains "🏵" or TargetProcessCommandLine contains "🎗" or TargetProcessCommandLine contains "🎫" or TargetProcessCommandLine contains "🎟" or TargetProcessCommandLine contains "🎪" or TargetProcessCommandLine contains "🤹" or TargetProcessCommandLine contains "🤹‍♂️" or TargetProcessCommandLine contains "🤹‍♀️" or TargetProcessCommandLine contains "🎭" or TargetProcessCommandLine contains "🩰" or TargetProcessCommandLine contains "🎨" or TargetProcessCommandLine contains "🎬" or TargetProcessCommandLine contains "🎤" or TargetProcessCommandLine contains "🎧" or TargetProcessCommandLine contains "🎼" or TargetProcessCommandLine contains "🎹" or TargetProcessCommandLine contains "🥁" or TargetProcessCommandLine contains "🪘" or TargetProcessCommandLine contains "🎷" or TargetProcessCommandLine contains "🎺" or TargetProcessCommandLine contains "🪗" or TargetProcessCommandLine contains "🎸" or TargetProcessCommandLine contains "🪕" or TargetProcessCommandLine contains "🎻" or TargetProcessCommandLine contains "🎲" or TargetProcessCommandLine contains "♟" or TargetProcessCommandLine contains "🎯" or TargetProcessCommandLine contains "🎳" or TargetProcessCommandLine contains "🎮" or TargetProcessCommandLine contains "🎰" or TargetProcessCommandLine contains "🧩" or TargetProcessCommandLine contains "🚗" or TargetProcessCommandLine contains "🚕" or TargetProcessCommandLine contains "🚙" or TargetProcessCommandLine contains "🚌" or TargetProcessCommandLine contains "🚎" or TargetProcessCommandLine contains "🏎" or TargetProcessCommandLine contains "🚓" or TargetProcessCommandLine contains "🚑" or TargetProcessCommandLine contains "🚒" or TargetProcessCommandLine contains "🚐" or TargetProcessCommandLine contains "🛻" or TargetProcessCommandLine contains "🚚" or TargetProcessCommandLine contains "🚛" or TargetProcessCommandLine contains "🚜" or TargetProcessCommandLine contains "🦯" or TargetProcessCommandLine contains "🦽" or TargetProcessCommandLine contains "🦼" or TargetProcessCommandLine contains "🛴" or TargetProcessCommandLine contains "🚲" or TargetProcessCommandLine contains "🛵" or TargetProcessCommandLine contains "🏍" or TargetProcessCommandLine contains "🛺" or TargetProcessCommandLine contains "🚨" or TargetProcessCommandLine contains "🚔" or TargetProcessCommandLine contains "🚍" or TargetProcessCommandLine contains "🚘" or TargetProcessCommandLine contains "🚖" or TargetProcessCommandLine contains "🛞" or TargetProcessCommandLine contains "🚡" or TargetProcessCommandLine contains "🚠" or TargetProcessCommandLine contains "🚟" or TargetProcessCommandLine contains "🚃" or TargetProcessCommandLine contains "🚋" or TargetProcessCommandLine contains "🚞" or TargetProcessCommandLine contains "🚝" or TargetProcessCommandLine contains "🚄" or TargetProcessCommandLine contains "🚅" or TargetProcessCommandLine contains "🚈" or TargetProcessCommandLine contains "🚂" or TargetProcessCommandLine contains "🚆" or TargetProcessCommandLine contains "🚇" or TargetProcessCommandLine contains "🚊" or TargetProcessCommandLine contains "🚉" or TargetProcessCommandLine contains "✈️" or TargetProcessCommandLine contains "🛫" or TargetProcessCommandLine contains "🛬" or TargetProcessCommandLine contains "🛩" or TargetProcessCommandLine contains "💺" or TargetProcessCommandLine contains "🛰" or TargetProcessCommandLine contains "🚀" or TargetProcessCommandLine contains "🛸" or TargetProcessCommandLine contains "🚁" or TargetProcessCommandLine contains "🛶" or TargetProcessCommandLine contains "⛵️" or TargetProcessCommandLine contains "🚤" or TargetProcessCommandLine contains "🛥" or TargetProcessCommandLine contains "🛳" or TargetProcessCommandLine contains "⛴" or TargetProcessCommandLine contains "🚢" or TargetProcessCommandLine contains "⚓️" or TargetProcessCommandLine contains "🛟" or TargetProcessCommandLine contains "🪝" or TargetProcessCommandLine contains "⛽️" or TargetProcessCommandLine contains "🚧" or TargetProcessCommandLine contains "🚦" or TargetProcessCommandLine contains "🚥" or TargetProcessCommandLine contains "🚏" or TargetProcessCommandLine contains "🗺" or TargetProcessCommandLine contains "🗿" or TargetProcessCommandLine contains "🗽" or TargetProcessCommandLine contains "🗼" or TargetProcessCommandLine contains "🏰" or TargetProcessCommandLine contains "🏯" or TargetProcessCommandLine contains "🏟" or TargetProcessCommandLine contains "🎡" or TargetProcessCommandLine contains "🎢" or TargetProcessCommandLine contains "🛝" or TargetProcessCommandLine contains "🎠" or TargetProcessCommandLine contains "⛲️" or TargetProcessCommandLine contains "⛱" or TargetProcessCommandLine contains "🏖" or TargetProcessCommandLine contains "🏝" or TargetProcessCommandLine contains "🏜" or TargetProcessCommandLine contains "🌋" or TargetProcessCommandLine contains "⛰" or TargetProcessCommandLine contains "🏔" or TargetProcessCommandLine contains "🗻" or TargetProcessCommandLine contains "🏕" or TargetProcessCommandLine contains "⛺️" or TargetProcessCommandLine contains "🛖" or TargetProcessCommandLine contains "🏠" or TargetProcessCommandLine contains "🏡" or TargetProcessCommandLine contains "🏘" or TargetProcessCommandLine contains "🏚" or TargetProcessCommandLine contains "🏗" or TargetProcessCommandLine contains "🏭" or TargetProcessCommandLine contains "🏢" or TargetProcessCommandLine contains "🏬" or TargetProcessCommandLine contains "🏣" or TargetProcessCommandLine contains "🏤" or TargetProcessCommandLine contains "🏥" or TargetProcessCommandLine contains "🏦" or TargetProcessCommandLine contains "🏨" or TargetProcessCommandLine contains "🏪" or TargetProcessCommandLine contains "🏫" or TargetProcessCommandLine contains "🏩" or TargetProcessCommandLine contains "💒" or TargetProcessCommandLine contains "🏛" or TargetProcessCommandLine contains "⛪️" or TargetProcessCommandLine contains "🕌" or TargetProcessCommandLine contains "🕍" or TargetProcessCommandLine contains "🛕" or TargetProcessCommandLine contains "🕋" or TargetProcessCommandLine contains "⛩" or TargetProcessCommandLine contains "🛤" or TargetProcessCommandLine contains "🛣" or TargetProcessCommandLine contains "🗾" or TargetProcessCommandLine contains "🎑" or TargetProcessCommandLine contains "🏞" or TargetProcessCommandLine contains "🌅" or TargetProcessCommandLine contains "🌄" or TargetProcessCommandLine contains "🌠" or TargetProcessCommandLine contains "🎇" or TargetProcessCommandLine contains "🎆" or TargetProcessCommandLine contains "🌇" or TargetProcessCommandLine contains "🌆" or TargetProcessCommandLine contains "🏙" or TargetProcessCommandLine contains "🌃" or TargetProcessCommandLine contains "🌌" or TargetProcessCommandLine contains "🌉" or TargetProcessCommandLine contains "🌁" or TargetProcessCommandLine contains "⌚️" or TargetProcessCommandLine contains "📱" or TargetProcessCommandLine contains "📲" or TargetProcessCommandLine contains "💻" or TargetProcessCommandLine contains "⌨️" or TargetProcessCommandLine contains "🖥" or TargetProcessCommandLine contains "🖨" or TargetProcessCommandLine contains "🖱" or TargetProcessCommandLine contains "🖲" or TargetProcessCommandLine contains "🕹" or TargetProcessCommandLine contains "🗜" or TargetProcessCommandLine contains "💽" or TargetProcessCommandLine contains "💾" or TargetProcessCommandLine contains "💿" or TargetProcessCommandLine contains "📀" or TargetProcessCommandLine contains "📼" or TargetProcessCommandLine contains "📷" or TargetProcessCommandLine contains "📸" or TargetProcessCommandLine contains "📹" or TargetProcessCommandLine contains "🎥" or TargetProcessCommandLine contains "📽" or TargetProcessCommandLine contains "🎞" or TargetProcessCommandLine contains "📞" or TargetProcessCommandLine contains "☎️" or TargetProcessCommandLine contains "📟" or TargetProcessCommandLine contains "📠" or TargetProcessCommandLine contains "📺" or TargetProcessCommandLine contains "📻" or TargetProcessCommandLine contains "🎙" or TargetProcessCommandLine contains "🎚" or TargetProcessCommandLine contains "🎛" or TargetProcessCommandLine contains "🧭" or TargetProcessCommandLine contains "⏱" or TargetProcessCommandLine contains "⏲" or TargetProcessCommandLine contains "⏰" or TargetProcessCommandLine contains "🕰" or TargetProcessCommandLine contains "⌛️" or TargetProcessCommandLine contains "⏳" or TargetProcessCommandLine contains "📡" or TargetProcessCommandLine contains "🔋" or TargetProcessCommandLine contains "🪫" or TargetProcessCommandLine contains "🔌" or TargetProcessCommandLine contains "💡" or TargetProcessCommandLine contains "🔦" or TargetProcessCommandLine contains "🕯" or TargetProcessCommandLine contains "🪔" or TargetProcessCommandLine contains "🧯" or TargetProcessCommandLine contains "🛢" or TargetProcessCommandLine contains "💸" or TargetProcessCommandLine contains "💵" or TargetProcessCommandLine contains "💴" or TargetProcessCommandLine contains "💶" or TargetProcessCommandLine contains "💷" or TargetProcessCommandLine contains "🪙" or TargetProcessCommandLine contains "💰" or TargetProcessCommandLine contains "💳" or TargetProcessCommandLine contains "💎" or TargetProcessCommandLine contains "⚖️" or TargetProcessCommandLine contains "🪜" or TargetProcessCommandLine contains "🧰" or TargetProcessCommandLine contains "🪛" or TargetProcessCommandLine contains "🔧" or TargetProcessCommandLine contains "🔨" or TargetProcessCommandLine contains "⚒" or TargetProcessCommandLine contains "🛠" or TargetProcessCommandLine contains "⛏" or TargetProcessCommandLine contains "🪚" or TargetProcessCommandLine contains "🔩" or TargetProcessCommandLine contains "⚙️" or TargetProcessCommandLine contains "🪤" or TargetProcessCommandLine contains "🧱" or TargetProcessCommandLine contains "⛓" or TargetProcessCommandLine contains "🧲" or TargetProcessCommandLine contains "🔫" or TargetProcessCommandLine contains "💣" or TargetProcessCommandLine contains "🧨" or TargetProcessCommandLine contains "🪓" or TargetProcessCommandLine contains "🔪" or TargetProcessCommandLine contains "🗡" or TargetProcessCommandLine contains "⚔️" or TargetProcessCommandLine contains "🛡" or TargetProcessCommandLine contains "🚬" or TargetProcessCommandLine contains "⚰️" or TargetProcessCommandLine contains "🪦" or TargetProcessCommandLine contains "⚱️" or TargetProcessCommandLine contains "🏺" or TargetProcessCommandLine contains "🔮" or TargetProcessCommandLine contains "📿" or TargetProcessCommandLine contains "🧿" or TargetProcessCommandLine contains "🪬" or TargetProcessCommandLine contains "💈" or TargetProcessCommandLine contains "⚗️" or TargetProcessCommandLine contains "🔭" or TargetProcessCommandLine contains "🔬" or TargetProcessCommandLine contains "🕳" or TargetProcessCommandLine contains "🩹" or TargetProcessCommandLine contains "🩺" or TargetProcessCommandLine contains "🩻" or TargetProcessCommandLine contains "🩼" or TargetProcessCommandLine contains "💊" or TargetProcessCommandLine contains "💉" or TargetProcessCommandLine contains "🩸" or TargetProcessCommandLine contains "🧬" or TargetProcessCommandLine contains "🦠" or TargetProcessCommandLine contains "🧫" or TargetProcessCommandLine contains "🧪" or TargetProcessCommandLine contains "🌡" or TargetProcessCommandLine contains "🧹" or TargetProcessCommandLine contains "🪠" or TargetProcessCommandLine contains "🧺" or TargetProcessCommandLine contains "🧻" or TargetProcessCommandLine contains "🚽" or TargetProcessCommandLine contains "🚰" or TargetProcessCommandLine contains "🚿" or TargetProcessCommandLine contains "🛁" or TargetProcessCommandLine contains "🛀" or TargetProcessCommandLine contains "🧼" or TargetProcessCommandLine contains "🪥" or TargetProcessCommandLine contains "🪒" or TargetProcessCommandLine contains "🧽" or TargetProcessCommandLine contains "🪣" or TargetProcessCommandLine contains "🧴" or TargetProcessCommandLine contains "🛎" or TargetProcessCommandLine contains "🔑" or TargetProcessCommandLine contains "🗝" or TargetProcessCommandLine contains "🚪" or TargetProcessCommandLine contains "🪑" or TargetProcessCommandLine contains "🛋" or TargetProcessCommandLine contains "🛏" or TargetProcessCommandLine contains "🛌" or TargetProcessCommandLine contains "🧸" or TargetProcessCommandLine contains "🪆" or TargetProcessCommandLine contains "🖼" or TargetProcessCommandLine contains "🪞" or TargetProcessCommandLine contains "🪟" or TargetProcessCommandLine contains "🛍" or TargetProcessCommandLine contains "🛒" or TargetProcessCommandLine contains "🎁" or TargetProcessCommandLine contains "🎈" or TargetProcessCommandLine contains "🎏" or TargetProcessCommandLine contains "🎀" or TargetProcessCommandLine contains "🪄" or TargetProcessCommandLine contains "🪅" or TargetProcessCommandLine contains "🎊" or TargetProcessCommandLine contains "🎉" or TargetProcessCommandLine contains "🪩" or TargetProcessCommandLine contains "🎎" or TargetProcessCommandLine contains "🏮" or TargetProcessCommandLine contains "🎐" or TargetProcessCommandLine contains "🧧" or TargetProcessCommandLine contains "✉️" or TargetProcessCommandLine contains "📩" or TargetProcessCommandLine contains "📨" or TargetProcessCommandLine contains "📧" or TargetProcessCommandLine contains "💌" or TargetProcessCommandLine contains "📥" or TargetProcessCommandLine contains "📤" or TargetProcessCommandLine contains "📦" or TargetProcessCommandLine contains "🏷" or TargetProcessCommandLine contains "🪧" or TargetProcessCommandLine contains "📪" or TargetProcessCommandLine contains "📫" or TargetProcessCommandLine contains "📬" or TargetProcessCommandLine contains "📭" or TargetProcessCommandLine contains "📮" or TargetProcessCommandLine contains "📯" or TargetProcessCommandLine contains "📜" or TargetProcessCommandLine contains "📃" or TargetProcessCommandLine contains "📄" or TargetProcessCommandLine contains "📑" or TargetProcessCommandLine contains "🧾" or TargetProcessCommandLine contains "📊" or TargetProcessCommandLine contains "📈" or TargetProcessCommandLine contains "📉" or TargetProcessCommandLine contains "🗒" or TargetProcessCommandLine contains "🗓" or TargetProcessCommandLine contains "📆" or TargetProcessCommandLine contains "📅" or TargetProcessCommandLine contains "🗑" or TargetProcessCommandLine contains "🪪" or TargetProcessCommandLine contains "📇" or TargetProcessCommandLine contains "🗃" or TargetProcessCommandLine contains "🗳" or TargetProcessCommandLine contains "🗄" or TargetProcessCommandLine contains "📋" or TargetProcessCommandLine contains "📁" or TargetProcessCommandLine contains "📂" or TargetProcessCommandLine contains "🗂" or TargetProcessCommandLine contains "🗞" or TargetProcessCommandLine contains "📰" or TargetProcessCommandLine contains "📓" or TargetProcessCommandLine contains "📔" or TargetProcessCommandLine contains "📒" or TargetProcessCommandLine contains "📕" or TargetProcessCommandLine contains "📗" or TargetProcessCommandLine contains "📘" or TargetProcessCommandLine contains "📙" or TargetProcessCommandLine contains "📚" or TargetProcessCommandLine contains "📖" or TargetProcessCommandLine contains "🔖" or TargetProcessCommandLine contains "🧷" or TargetProcessCommandLine contains "🔗" or TargetProcessCommandLine contains "📎" or TargetProcessCommandLine contains "🖇" or TargetProcessCommandLine contains "📐" or TargetProcessCommandLine contains "📏" or TargetProcessCommandLine contains "🧮" or TargetProcessCommandLine contains "📌" or TargetProcessCommandLine contains "📍" or TargetProcessCommandLine contains "✂️" or TargetProcessCommandLine contains "🖊" or TargetProcessCommandLine contains "🖋" or TargetProcessCommandLine contains "✒️" or TargetProcessCommandLine contains "🖌" or TargetProcessCommandLine contains "🖍" or TargetProcessCommandLine contains "📝" or TargetProcessCommandLine contains "✏️" or TargetProcessCommandLine contains "🔍" or TargetProcessCommandLine contains "🔎" or TargetProcessCommandLine contains "🔏" or TargetProcessCommandLine contains "🔐" or TargetProcessCommandLine contains "🔒" or TargetProcessCommandLine contains "🔓❤️" or TargetProcessCommandLine contains "🧡" or TargetProcessCommandLine contains "💛" or TargetProcessCommandLine contains "💚" or TargetProcessCommandLine contains "💙" or TargetProcessCommandLine contains "💜" or TargetProcessCommandLine contains "🖤" or TargetProcessCommandLine contains "🤍" or TargetProcessCommandLine contains "🤎" or TargetProcessCommandLine contains "❤️‍🔥" or TargetProcessCommandLine contains "❤️‍🩹" or TargetProcessCommandLine contains "💔" or TargetProcessCommandLine contains "❣️" or TargetProcessCommandLine contains "💕" or TargetProcessCommandLine contains "💞" or TargetProcessCommandLine contains "💓" or TargetProcessCommandLine contains "💗" or TargetProcessCommandLine contains "💖" or TargetProcessCommandLine contains "💘" or TargetProcessCommandLine contains "💝" or TargetProcessCommandLine contains "💟" or TargetProcessCommandLine contains "☮️" or TargetProcessCommandLine contains "✝️" or TargetProcessCommandLine contains "☪️" or TargetProcessCommandLine contains "🕉" or TargetProcessCommandLine contains "☸️" or TargetProcessCommandLine contains "✡️" or TargetProcessCommandLine contains "🔯" or TargetProcessCommandLine contains "🕎" or TargetProcessCommandLine contains "☯️" or TargetProcessCommandLine contains "☦️" or TargetProcessCommandLine contains "🛐" or TargetProcessCommandLine contains "⛎" or TargetProcessCommandLine contains "♈️" or TargetProcessCommandLine contains "♉️" or TargetProcessCommandLine contains "♊️" or TargetProcessCommandLine contains "♋️" or TargetProcessCommandLine contains "♌️" or TargetProcessCommandLine contains "♍️" or TargetProcessCommandLine contains "♎️" or TargetProcessCommandLine contains "♏️" or TargetProcessCommandLine contains "♐️" or TargetProcessCommandLine contains "♑️" or TargetProcessCommandLine contains "♒️" or TargetProcessCommandLine contains "♓️" or TargetProcessCommandLine contains "🆔" or TargetProcessCommandLine contains "⚛️" or TargetProcessCommandLine contains "🉑" or TargetProcessCommandLine contains "☢️" or TargetProcessCommandLine contains "☣️" or TargetProcessCommandLine contains "📴" or TargetProcessCommandLine contains "📳" or TargetProcessCommandLine contains "🈶" or TargetProcessCommandLine contains "🈚️" or TargetProcessCommandLine contains "🈸" or TargetProcessCommandLine contains "🈺" or TargetProcessCommandLine contains "🈷️" or TargetProcessCommandLine contains "✴️" or TargetProcessCommandLine contains "🆚" or TargetProcessCommandLine contains "💮" or TargetProcessCommandLine contains "🉐" or TargetProcessCommandLine contains "㊙️" or TargetProcessCommandLine contains "㊗️" or TargetProcessCommandLine contains "🈴" or TargetProcessCommandLine contains "🈵" or TargetProcessCommandLine contains "🈹" or TargetProcessCommandLine contains "🈲" or TargetProcessCommandLine contains "🅰️" or TargetProcessCommandLine contains "🅱️" or TargetProcessCommandLine contains "🆎" or TargetProcessCommandLine contains "🆑" or TargetProcessCommandLine contains "🅾️" or TargetProcessCommandLine contains "🆘" or TargetProcessCommandLine contains "❌" or TargetProcessCommandLine contains "⭕️" or TargetProcessCommandLine contains "🛑" or TargetProcessCommandLine contains "⛔️" or TargetProcessCommandLine contains "📛" or TargetProcessCommandLine contains "🚫" or TargetProcessCommandLine contains "💯" or TargetProcessCommandLine contains "💢" or TargetProcessCommandLine contains "♨️" or TargetProcessCommandLine contains "🚷" or TargetProcessCommandLine contains "🚯" or TargetProcessCommandLine contains "🚳" or TargetProcessCommandLine contains "🚱" or TargetProcessCommandLine contains "🔞" or TargetProcessCommandLine contains "📵" or TargetProcessCommandLine contains "🚭" or TargetProcessCommandLine contains "❗️" or TargetProcessCommandLine contains "❕" or TargetProcessCommandLine contains "❓" or TargetProcessCommandLine contains "❔" or TargetProcessCommandLine contains "‼️" or TargetProcessCommandLine contains "⁉️" or TargetProcessCommandLine contains "🔅" or TargetProcessCommandLine contains "🔆" or TargetProcessCommandLine contains "〽️" or TargetProcessCommandLine contains "⚠️" or TargetProcessCommandLine contains "🚸" or TargetProcessCommandLine contains "🔱" or TargetProcessCommandLine contains "⚜️" or TargetProcessCommandLine contains "🔰" or TargetProcessCommandLine contains "♻️" or TargetProcessCommandLine contains "✅" or TargetProcessCommandLine contains "🈯️" or TargetProcessCommandLine contains "💹" or TargetProcessCommandLine contains "❇️" or TargetProcessCommandLine contains "✳️" or TargetProcessCommandLine contains "❎" or TargetProcessCommandLine contains "🌐" or TargetProcessCommandLine contains "💠" or TargetProcessCommandLine contains "Ⓜ️" or TargetProcessCommandLine contains "🌀" or TargetProcessCommandLine contains "💤" or TargetProcessCommandLine contains "🏧" or TargetProcessCommandLine contains "🚾" or TargetProcessCommandLine contains "♿️" or TargetProcessCommandLine contains "🅿️" or TargetProcessCommandLine contains "🛗" or TargetProcessCommandLine contains "🈳" or TargetProcessCommandLine contains "🈂️" or TargetProcessCommandLine contains "🛂" or TargetProcessCommandLine contains "🛃" or TargetProcessCommandLine contains "🛄" or TargetProcessCommandLine contains "🛅" or TargetProcessCommandLine contains "🚹" or TargetProcessCommandLine contains "🚺" or TargetProcessCommandLine contains "🚼" or TargetProcessCommandLine contains "⚧" or TargetProcessCommandLine contains "🚻" or TargetProcessCommandLine contains "🚮" or TargetProcessCommandLine contains "🎦" or TargetProcessCommandLine contains "📶" or TargetProcessCommandLine contains "🈁" or TargetProcessCommandLine contains "🔣" or TargetProcessCommandLine contains "ℹ️" or TargetProcessCommandLine contains "🔤" or TargetProcessCommandLine contains "🔡" or TargetProcessCommandLine contains "🔠" or TargetProcessCommandLine contains "🆖" or TargetProcessCommandLine contains "🆗" or TargetProcessCommandLine contains "🆙" or TargetProcessCommandLine contains "🆒" or TargetProcessCommandLine contains "🆕" or TargetProcessCommandLine contains "🆓" or TargetProcessCommandLine contains "0️⃣" or TargetProcessCommandLine contains "1️⃣" or TargetProcessCommandLine contains "2️⃣" or TargetProcessCommandLine contains "3️⃣" or TargetProcessCommandLine contains "4️⃣" or TargetProcessCommandLine contains "5️⃣" or TargetProcessCommandLine contains "6️⃣" or TargetProcessCommandLine contains "7️⃣" or TargetProcessCommandLine contains "8️⃣" or TargetProcessCommandLine contains "9️⃣" or TargetProcessCommandLine contains "🔟" or TargetProcessCommandLine contains "🔢" or TargetProcessCommandLine contains "#️⃣" or TargetProcessCommandLine contains "️⃣" or TargetProcessCommandLine contains "⏏️" or TargetProcessCommandLine contains "▶️" or TargetProcessCommandLine contains "⏸" or TargetProcessCommandLine contains "⏯" or TargetProcessCommandLine contains "⏹" or TargetProcessCommandLine contains "⏺" or TargetProcessCommandLine contains "⏭" or TargetProcessCommandLine contains "⏮" or TargetProcessCommandLine contains "⏩" or TargetProcessCommandLine contains "⏪" or TargetProcessCommandLine contains "⏫" or TargetProcessCommandLine contains "⏬" or TargetProcessCommandLine contains "◀️" or TargetProcessCommandLine contains "🔼" or TargetProcessCommandLine contains "🔽" or TargetProcessCommandLine contains "➡️" or TargetProcessCommandLine contains "⬅️" or TargetProcessCommandLine contains "⬆️" or TargetProcessCommandLine contains "⬇️" or TargetProcessCommandLine contains "↗️" or TargetProcessCommandLine contains "↘️" or TargetProcessCommandLine contains "↙️" or TargetProcessCommandLine contains "↖️" or TargetProcessCommandLine contains "↕️" or TargetProcessCommandLine contains "↔️" or TargetProcessCommandLine contains "↪️" or TargetProcessCommandLine contains "↩️" or TargetProcessCommandLine contains "⤴️" or TargetProcessCommandLine contains "⤵️" or TargetProcessCommandLine contains "🔀" or TargetProcessCommandLine contains "🔁" or TargetProcessCommandLine contains "🔂" or TargetProcessCommandLine contains "🔄" or TargetProcessCommandLine contains "🔃" or TargetProcessCommandLine contains "🎵" or TargetProcessCommandLine contains "🎶" or TargetProcessCommandLine contains "➕" or TargetProcessCommandLine contains "➖" or TargetProcessCommandLine contains "➗" or TargetProcessCommandLine contains "✖️" or TargetProcessCommandLine contains "🟰" or TargetProcessCommandLine contains "♾" or TargetProcessCommandLine contains "💲" or TargetProcessCommandLine contains "💱" or TargetProcessCommandLine contains "™️" or TargetProcessCommandLine contains "©️" or TargetProcessCommandLine contains "®️" or TargetProcessCommandLine contains "〰️" or TargetProcessCommandLine contains "➰" or TargetProcessCommandLine contains "➿" or TargetProcessCommandLine contains "🔚" or TargetProcessCommandLine contains "🔙" or TargetProcessCommandLine contains "🔛" or TargetProcessCommandLine contains "🔝" or TargetProcessCommandLine contains "🔜" or TargetProcessCommandLine contains "✔️" or TargetProcessCommandLine contains "☑️" or TargetProcessCommandLine contains "🔘" or TargetProcessCommandLine contains "🔴" or TargetProcessCommandLine contains "🟠" or TargetProcessCommandLine contains "🟡" or TargetProcessCommandLine contains "🟢" or TargetProcessCommandLine contains "🔵" or TargetProcessCommandLine contains "🟣" or TargetProcessCommandLine contains "⚫️" or TargetProcessCommandLine contains "⚪️" or TargetProcessCommandLine contains "🟤" or TargetProcessCommandLine contains "🔺" or TargetProcessCommandLine contains "🔻"

Required Data Sources

False Positive Guidance

• Unknown

References

• Internal Research
• SigmaHQ Rule