Phoenix Studio
Convert indexed Sigma rules into analyst-ready detections.
This studio is built around Phoenix's own rule corpus, not a blank editor. Search by title or rule id, choose a live sigma-cli backend, then reveal pipelines only when you actually need them.
Indexed Rules
3,707
Ready to search
Backends
17
Live from sigconverter.io
CLI Versions
10
Newest: 2.0.2
Translation Workspace
Shape the rule before it leaves Phoenix
Tune Translation
Active Rule
Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 3
Target Profile
Splunk
Splunk SPL & tstats data model queries
Format Mode
Default
Plain SPL queries
Conversion Output
Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 3
Using Splunk ยท Default ยท sigma-cli 2.0.2
Translation controls
Adjust the rule on the left, then regenerate when you want a fresh backend-native query.
BackendSplunkFormatDefaultVersion2.0.2
title: Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 3
id: f9578658-9e71-4711-b634-3f9b50cd3c06
status: test
description: Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.
author: '@Kostastsale, TheDFIRReport'
references:
- Internal Research
tags:
- attack.defense-evasion
date: 2022-12-05
logsource:
product: windows
category: process_creation
detection:
selection:
CommandLine|contains:
- '๐ฆ'
- '๐ฆ
'
- '๐ฆ'
- '๐ฆ'
- '๐บ'
- '๐'
- '๐ด'
- '๐ฆ'
- '๐'
- '๐ชฑ'
- '๐'
- '๐ฆ'
- '๐'
- '๐'
- '๐'
- '๐ชฐ'
- '๐ชฒ'
- '๐ชณ'
- '๐ฆ'
- '๐ฆ'
- '๐ท'
- '๐ธ'
- '๐ฆ'
- '๐ข'
- '๐'
- '๐ฆ'
- '๐ฆ'
- '๐ฆ'
- '๐'
- '๐ฆ'
- '๐ฆ'
- '๐ฆ'
- '๐ฆ'
- '๐ชธ'
- '๐ก'
- '๐ '
- '๐'
- '๐ฌ'
- '๐ณ'
- '๐'
- '๐ฆ'
- '๐'
- '๐
'
- '๐'
- '๐ฆ'
- '๐ฆ'
- '๐ฆง'
- '๐ฆฃ'
- '๐'
- '๐ฆ'
- '๐ฆ'
- '๐ช'
- '๐ซ'
- '๐ฆ'
- '๐ฆ'
- '๐ฆฌ'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐ฆ'
- '๐'
- '๐ฆ'
- '๐'
- '๐ฉ'
- '๐ฆฎ'
- '๐โ๐ฆบ'
- '๐'
- '๐โโฌ'
- '๐ชถ'
- '๐'
- '๐ฆ'
- '๐ฆค'
- '๐ฆ'
- '๐ฆ'
- '๐ฆข'
- '๐ฆฉ'
- '๐'
- '๐'
- '๐ฆ'
- '๐ฆจ'
- '๐ฆก'
- '๐ฆซ'
- '๐ฆฆ'
- '๐ฆฅ'
- '๐'
- '๐'
- '๐ฟ'
- '๐ฆ'
- '๐พ'
- '๐'
- '๐ฒ'
- '๐ต'
- '๐'
- '๐ฒ'
- '๐ณ'
- '๐ด'
- '๐ชน'
- '๐ชบ'
- '๐ชต'
- '๐ฑ'
- '๐ฟ'
- 'โ๏ธ'
- '๐'
- '๐'
- '๐ชด'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐ชจ'
- '๐พ'
- '๐'
- '๐ท'
- '๐ชท'
- '๐น'
- '๐ฅ'
- '๐บ'
- '๐ธ'
- '๐ผ'
- '๐ป'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐ช'
- '๐ซ'
- 'โญ๏ธ'
- '๐'
- 'โจ'
- 'โก๏ธ'
- 'โ๏ธ'
- '๐ฅ'
- '๐ฅ'
- '๐ช'
- '๐'
- 'โ๏ธ'
- '๐ค'
- 'โ
๏ธ'
- '๐ฅ'
- 'โ๏ธ'
- '๐ฆ'
- '๐ง'
- 'โ'
- '๐ฉ'
- '๐จ'
- 'โ๏ธ'
- 'โ๏ธ'
- 'โ๏ธ'
- '๐ฌ'
- '๐จ'
- '๐ง'
- '๐ฆ'
- '๐ซง'
- 'โ๏ธ'
- 'โ๏ธ'
- '๐'
- '๐ซ๐'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐ซ'
- '๐'
- '๐'
- '๐'
- '๐ฅญ'
- '๐'
- '๐ฅฅ'
- '๐ฅ'
- '๐
'
- '๐'
- '๐ฅ'
- '๐ฅฆ'
- '๐ฅฌ'
- '๐ฅ'
- '๐ถ'
- '๐ซ'
- '๐ฝ'
- '๐ฅ'
- '๐ซ'
- '๐ง'
- '๐ง
'
- '๐ฅ'
- '๐ '
- '๐ซ'
- '๐ฅ'
- '๐ฅฏ'
- '๐'
- '๐ฅ'
- '๐ฅจ'
- '๐ง'
- '๐ฅ'
- '๐ณ'
- '๐ง'
- '๐ฅ'
- '๐ง'
- '๐ฅ'
- '๐ฅฉ'
- '๐'
- '๐'
- '๐ฆด'
- '๐ญ'
- '๐'
- '๐'
- '๐'
- '๐ซ'
- '๐ฅช'
- '๐ฅ'
- '๐ง'
- '๐ฎ'
- '๐ฏ'
- '๐ซ'
- '๐ฅ'
- '๐ฅ'
- '๐ซ'
- '๐ฅซ'
- '๐'
- '๐'
- '๐ฒ'
- '๐'
- '๐ฃ'
- '๐ฑ'
- '๐ฅ'
- '๐ฆช'
- '๐ค'
- '๐'
- '๐'
- '๐'
- '๐ฅ'
- '๐ฅ '
- '๐ฅฎ'
- '๐ข'
- '๐ก'
- '๐ง'
- '๐จ'
- '๐ฆ'
- '๐ฅง'
- '๐ง'
- '๐ฐ'
- '๐'
- '๐ฎ'
- '๐ญ'
- '๐ฌ'
- '๐ซ'
- '๐ฟ'
- '๐ฉ'
- '๐ช'
- '๐ฐ'
- '๐ฅ'
- '๐ฏ'
- '๐ฅ'
- '๐ผ'
- '๐ซ'
- 'โ๏ธ'
- '๐ต'
- '๐ง'
- '๐ฅค'
- '๐ง'
- '๐ซ'
- '๐ถ'
- '๐บ'
- '๐ป'
- '๐ฅ'
- '๐ท'
- '๐ซ'
- '๐ฅ'
- '๐ธ'
- '๐น'
- '๐ง'
- '๐พ'
- '๐ง'
- '๐ฅ'
- '๐ด'
- '๐ฝ'
- '๐ฅฃ'
- '๐ฅก'
- '๐ฅข'
- '๐ง'
- 'โฝ๏ธ'
- '๐'
- '๐'
- 'โพ๏ธ'
- '๐ฅ'
- '๐พ'
- '๐'
- '๐'
- '๐ฅ'
- '๐ฑ'
- '๐ช'
- '๐'
- '๐ธ'
- '๐'
- '๐'
- '๐ฅ'
- '๐'
- '๐ช'
- '๐ฅ
'
- 'โณ๏ธ'
- '๐ช'
- '๐น'
- '๐ฃ'
- '๐คฟ'
- '๐ฅ'
- '๐ฅ'
- '๐ฝ'
- '๐น'
- '๐ผ'
- '๐ท'
- 'โธ'
- '๐ฅ'
- '๐ฟ'
- 'โท'
- '๐'
- '๐ช'
- '๐๏ธโโ๏ธ'
- '๐๏ธ'
- '๐๏ธโโ๏ธ'
- '๐คผโโ๏ธ'
- '๐คผ'
- '๐คผโโ๏ธ'
- '๐คธโโ๏ธ'
- '๐คธ'
- '๐คธโโ๏ธ'
- 'โน๏ธโโ๏ธ'
- 'โน๏ธ'
- 'โน๏ธโโ๏ธ'
- '๐คบ'
- '๐คพโโ๏ธ'
- '๐คพ'
- '๐คพโโ๏ธ'
- '๐๏ธโโ๏ธ'
- '๐๏ธ'
- '๐๏ธโโ๏ธ'
- '๐'
- '๐งโโ๏ธ'
- '๐ง'
- '๐งโโ๏ธ'
- '๐โโ๏ธ'
- '๐'
- '๐โโ๏ธ'
- '๐โโ๏ธ'
- '๐'
- '๐โโ๏ธ'
- '๐คฝโโ๏ธ'
- '๐คฝ'
- '๐คฝโโ๏ธ'
- '๐ฃโโ๏ธ'
- '๐ฃ'
- '๐ฃโโ๏ธ'
- '๐งโโ๏ธ'
- '๐ง'
- '๐งโโ๏ธ'
- '๐ตโโ๏ธ'
- '๐ต'
- '๐ตโโ๏ธ'
- '๐ดโโ๏ธ'
- '๐ด'
- '๐ดโโ๏ธ'
- '๐'
- '๐ฅ'
- '๐ฅ'
- '๐ฅ'
- '๐
'
- '๐'
- '๐ต'
- '๐'
- '๐ซ'
- '๐'
- '๐ช'
- '๐คน'
- '๐คนโโ๏ธ'
- '๐คนโโ๏ธ'
- '๐ญ'
- '๐ฉฐ'
- '๐จ'
- '๐ฌ'
- '๐ค'
- '๐ง'
- '๐ผ'
- '๐น'
- '๐ฅ'
- '๐ช'
- '๐ท'
- '๐บ'
- '๐ช'
- '๐ธ'
- '๐ช'
- '๐ป'
- '๐ฒ'
- 'โ'
- '๐ฏ'
- '๐ณ'
- '๐ฎ'
- '๐ฐ'
- '๐งฉ'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐ป'
- '๐'
- '๐'
- '๐'
- '๐ฆฏ'
- '๐ฆฝ'
- '๐ฆผ'
- '๐ด'
- '๐ฒ'
- '๐ต'
- '๐'
- '๐บ'
- '๐จ'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐ก'
- '๐ '
- '๐'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐
'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐'
- 'โ๏ธ'
- '๐ซ'
- '๐ฌ'
- '๐ฉ'
- '๐บ'
- '๐ฐ'
- '๐'
- '๐ธ'
- '๐'
- '๐ถ'
- 'โต๏ธ'
- '๐ค'
- '๐ฅ'
- '๐ณ'
- 'โด'
- '๐ข'
- 'โ๏ธ'
- '๐'
- '๐ช'
- 'โฝ๏ธ'
- '๐ง'
- '๐ฆ'
- '๐ฅ'
- '๐'
- '๐บ'
- '๐ฟ'
- '๐ฝ'
- '๐ผ'
- '๐ฐ'
- '๐ฏ'
- '๐'
- '๐ก'
- '๐ข'
- '๐'
- '๐ '
- 'โฒ๏ธ'
- 'โฑ'
- '๐'
- '๐'
- '๐'
- '๐'
- 'โฐ'
- '๐'
- '๐ป'
- '๐'
- 'โบ๏ธ'
- '๐'
- '๐ '
- '๐ก'
- '๐'
- '๐'
- '๐'
- '๐ญ'
- '๐ข'
- '๐ฌ'
- '๐ฃ'
- '๐ค'
- '๐ฅ'
- '๐ฆ'
- '๐จ'
- '๐ช'
- '๐ซ'
- '๐ฉ'
- '๐'
- '๐'
- 'โช๏ธ'
- '๐'
- '๐'
- '๐'
- '๐'
- 'โฉ'
- '๐ค'
- '๐ฃ'
- '๐พ'
- '๐'
- '๐'
- '๐
'
- '๐'
- '๐ '
- '๐'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐'
- 'โ๏ธ'
- '๐ฑ'
- '๐ฒ'
- '๐ป'
- 'โจ๏ธ'
- '๐ฅ'
- '๐จ'
- '๐ฑ'
- '๐ฒ'
- '๐น'
- '๐'
- '๐ฝ'
- '๐พ'
- '๐ฟ'
- '๐'
- '๐ผ'
- '๐ท'
- '๐ธ'
- '๐น'
- '๐ฅ'
- '๐ฝ'
- '๐'
- '๐'
- 'โ๏ธ'
- '๐'
- '๐ '
- '๐บ'
- '๐ป'
- '๐'
- '๐'
- '๐'
- '๐งญ'
- 'โฑ'
- 'โฒ'
- 'โฐ'
- '๐ฐ'
- 'โ๏ธ'
- 'โณ'
- '๐ก'
- '๐'
- '๐ชซ'
- '๐'
- '๐ก'
- '๐ฆ'
- '๐ฏ'
- '๐ช'
- '๐งฏ'
- '๐ข'
- '๐ธ'
- '๐ต'
- '๐ด'
- '๐ถ'
- '๐ท'
- '๐ช'
- '๐ฐ'
- '๐ณ'
- '๐'
- 'โ๏ธ'
- '๐ช'
- '๐งฐ'
- '๐ช'
- '๐ง'
- '๐จ'
- 'โ'
- '๐ '
- 'โ'
- '๐ช'
- '๐ฉ'
- 'โ๏ธ'
- '๐ชค'
- '๐งฑ'
- 'โ'
- '๐งฒ'
- '๐ซ'
- '๐ฃ'
- '๐งจ'
- '๐ช'
- '๐ช'
- '๐ก'
- 'โ๏ธ'
- '๐ก'
- '๐ฌ'
- 'โฐ๏ธ'
- '๐ชฆ'
- 'โฑ๏ธ'
- '๐บ'
- '๐ฎ'
- '๐ฟ'
- '๐งฟ'
- '๐ชฌ'
- '๐'
- 'โ๏ธ'
- '๐ญ'
- '๐ฌ'
- '๐ณ'
- '๐ฉน'
- '๐ฉบ'
- '๐ฉป'
- '๐ฉผ'
- '๐'
- '๐'
- '๐ฉธ'
- '๐งฌ'
- '๐ฆ '
- '๐งซ'
- '๐งช'
- '๐ก'
- '๐งน'
- '๐ช '
- '๐งบ'
- '๐งป'
- '๐ฝ'
- '๐ฐ'
- '๐ฟ'
- '๐'
- '๐'
- '๐งผ'
- '๐ชฅ'
- '๐ช'
- '๐งฝ'
- '๐ชฃ'
- '๐งด'
- '๐'
- '๐'
- '๐'
- '๐ช'
- '๐ช'
- '๐'
- '๐'
- '๐'
- '๐งธ'
- '๐ช'
- '๐ผ'
- '๐ช'
- '๐ช'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐ช'
- '๐ช
'
- '๐'
- '๐'
- '๐ชฉ'
- '๐'
- '๐ฎ'
- '๐'
- '๐งง'
- 'โ๏ธ'
- '๐ฉ'
- '๐จ'
- '๐ง'
- '๐'
- '๐ฅ'
- '๐ค'
- '๐ฆ'
- '๐ท'
- '๐ชง'
- '๐ช'
- '๐ซ'
- '๐ฌ'
- '๐ญ'
- '๐ฎ'
- '๐ฏ'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐งพ'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐
'
- '๐'
- '๐ชช'
- '๐'
- '๐'
- '๐ณ'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐ฐ'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐งท'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐งฎ'
- '๐'
- '๐'
- 'โ๏ธ'
- '๐'
- '๐'
- 'โ๏ธ'
- '๐'
- '๐'
- '๐'
- 'โ๏ธ'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐โค๏ธ'
- '๐งก'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐ค'
- '๐ค'
- '๐ค'
- 'โค๏ธโ๐ฅ'
- 'โค๏ธโ๐ฉน'
- '๐'
- 'โฃ๏ธ'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐'
- 'โฎ๏ธ'
- 'โ๏ธ'
- 'โช๏ธ'
- '๐'
- 'โธ๏ธ'
- 'โก๏ธ'
- '๐ฏ'
- '๐'
- 'โฏ๏ธ'
- 'โฆ๏ธ'
- '๐'
- 'โ'
- 'โ๏ธ'
- 'โ๏ธ'
- 'โ๏ธ'
- 'โ๏ธ'
- 'โ๏ธ'
- 'โ๏ธ'
- 'โ๏ธ'
- 'โ๏ธ'
- 'โ๏ธ'
- 'โ๏ธ'
- 'โ๏ธ'
- 'โ๏ธ'
- '๐'
- 'โ๏ธ'
- '๐'
- 'โข๏ธ'
- 'โฃ๏ธ'
- '๐ด'
- '๐ณ'
- '๐ถ'
- '๐๏ธ'
- '๐ธ'
- '๐บ'
- '๐ท๏ธ'
- 'โด๏ธ'
- '๐'
- '๐ฎ'
- '๐'
- 'ใ๏ธ'
- 'ใ๏ธ'
- '๐ด'
- '๐ต'
- '๐น'
- '๐ฒ'
- '๐
ฐ๏ธ'
- '๐
ฑ๏ธ'
- '๐'
- '๐'
- '๐
พ๏ธ'
- '๐'
- 'โ'
- 'โญ๏ธ'
- '๐'
- 'โ๏ธ'
- '๐'
- '๐ซ'
- '๐ฏ'
- '๐ข'
- 'โจ๏ธ'
- '๐ท'
- '๐ฏ'
- '๐ณ'
- '๐ฑ'
- '๐'
- '๐ต'
- '๐ญ'
- 'โ๏ธ'
- 'โ'
- 'โ'
- 'โ'
- 'โผ๏ธ'
- 'โ๏ธ'
- '๐
'
- '๐'
- 'ใฝ๏ธ'
- 'โ ๏ธ'
- '๐ธ'
- '๐ฑ'
- 'โ๏ธ'
- '๐ฐ'
- 'โป๏ธ'
- 'โ
'
- '๐ฏ๏ธ'
- '๐น'
- 'โ๏ธ'
- 'โณ๏ธ'
- 'โ'
- '๐'
- '๐ '
- 'โ๏ธ'
- '๐'
- '๐ค'
- '๐ง'
- '๐พ'
- 'โฟ๏ธ'
- '๐
ฟ๏ธ'
- '๐'
- '๐ณ'
- '๐๏ธ'
- '๐'
- '๐'
- '๐'
- '๐
'
- '๐น'
- '๐บ'
- '๐ผ'
- 'โง'
- '๐ป'
- '๐ฎ'
- '๐ฆ'
- '๐ถ'
- '๐'
- '๐ฃ'
- 'โน๏ธ'
- '๐ค'
- '๐ก'
- '๐ '
- '๐'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐'
- '0๏ธโฃ'
- '1๏ธโฃ'
- '2๏ธโฃ'
- '3๏ธโฃ'
- '4๏ธโฃ'
- '5๏ธโฃ'
- '6๏ธโฃ'
- '7๏ธโฃ'
- '8๏ธโฃ'
- '9๏ธโฃ'
- '๐'
- '๐ข'
- '#๏ธโฃ'
- '*๏ธโฃ'
- 'โ๏ธ'
- 'โถ๏ธ'
- 'โธ'
- 'โฏ'
- 'โน'
- 'โบ'
- 'โญ'
- 'โฎ'
- 'โฉ'
- 'โช'
- 'โซ'
- 'โฌ'
- 'โ๏ธ'
- '๐ผ'
- '๐ฝ'
- 'โก๏ธ'
- 'โฌ
๏ธ'
- 'โฌ๏ธ'
- 'โฌ๏ธ'
- 'โ๏ธ'
- 'โ๏ธ'
- 'โ๏ธ'
- 'โ๏ธ'
- 'โ๏ธ'
- 'โ๏ธ'
- 'โช๏ธ'
- 'โฉ๏ธ'
- 'โคด๏ธ'
- 'โคต๏ธ'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐ต'
- '๐ถ'
- 'โ'
- 'โ'
- 'โ'
- 'โ๏ธ'
- '๐ฐ'
- 'โพ'
- '๐ฒ'
- '๐ฑ'
- 'โข๏ธ'
- 'ยฉ๏ธ'
- 'ยฎ๏ธ'
- 'ใฐ๏ธ'
- 'โฐ'
- 'โฟ'
- '๐'
- '๐'
- '๐'
- '๐'
- '๐'
- 'โ๏ธ'
- 'โ๏ธ'
- '๐'
- '๐ด'
- '๐ '
- '๐ก'
- '๐ข'
- '๐ต'
- '๐ฃ'
- 'โซ๏ธ'
- 'โช๏ธ'
- '๐ค'
- '๐บ'
- '๐ป'
condition: selection
falsepositives:
- Unknown
level: high
CLI command
Copy the exact command to reproduce this translation locally.
sigma convert --without-pipeline -t splunk -f default rules/windows/process_creation/proc_creation_win_susp_emoji_usage_in_cli_3.yml