Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 2

Hunt Hypothesis

Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.

Detection Rule

Sigma (Original)

title: Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 2
id: c98f2a0d-e1b8-4f76-90d3-359caf88d6b9
status: test
description: Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.
author: '@Kostastsale, TheDFIRReport'
references:
    - Internal Research
tags:
    - attack.stealth
date: 2022-12-05
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        CommandLine|contains:
            - '🤷🏼'
            - '🤷🏼‍♂️'
            - '🙎🏼‍♀️'
            - '🙎🏼'
            - '🙎🏼‍♂️'
            - '🙍🏼‍♀️'
            - '🙍🏼'
            - '🙍🏼‍♂️'
            - '💇🏼‍♀️'
            - '💇🏼'
            - '💇🏼‍♂️'
            - '💆🏼‍♀️'
            - '💆🏼'
            - '💆🏼‍♂️'
            - '🧖🏼‍♀️'
            - '🧖🏼'
            - '🧖🏼‍♂️'
            - '💃🏼'
            - '🕺🏼'
            - '🕴🏼'
            - '👩🏼‍🦽'
            - '🧑🏼‍🦽'
            - '👨🏼‍🦽'
            - '👩🏼‍🦼'
            - '🧑🏼‍🦼'
            - '👨🏼‍🦼'
            - '🚶🏼‍♀️'
            - '🚶🏼'
            - '🚶🏼‍♂️'
            - '👩🏼‍🦯'
            - '🧑🏼‍🦯'
            - '👨🏼‍🦯'
            - '🧎🏼‍♀️'
            - '🧎🏼'
            - '🧎🏼‍♂️'
            - '🏃🏼‍♀️'
            - '🏃🏼'
            - '🏃🏼‍♂️'
            - '🧍🏼‍♀️'
            - '🧍🏼'
            - '🧍🏼‍♂️'
            - '👭🏼'
            - '🧑🏼‍🤝‍🧑🏼'
            - '👬🏼'
            - '👫🏼'
            - '🧗🏼‍♀️'
            - '🧗🏼'
            - '🧗🏼‍♂️'
            - '🏇🏼'
            - '🏂🏼'
            - '🏌🏼‍♀️'
            - '🏌🏼'
            - '🏌🏼‍♂️'
            - '🏄🏼‍♀️'
            - '🏄🏼'
            - '🏄🏼‍♂️'
            - '🚣🏼‍♀️'
            - '🚣🏼'
            - '🚣🏼‍♂️'
            - '🏊🏼‍♀️'
            - '🏊🏼'
            - '🏊🏼‍♂️'
            - '⛹🏼‍♀️'
            - '⛹🏼'
            - '⛹🏼‍♂️'
            - '🏋🏼‍♀️'
            - '🏋🏼'
            - '🏋🏼‍♂️'
            - '🚴🏼‍♀️'
            - '🚴🏼'
            - '🚴🏼‍♂️'
            - '🚵🏼‍♀️'
            - '🚵🏼'
            - '🚵🏼‍♂️'
            - '🤸🏼‍♀️'
            - '🤸🏼'
            - '🤸🏼‍♂️'
            - '🤽🏼‍♀️'
            - '🤽🏼'
            - '🤽🏼‍♂️'
            - '🤾🏼‍♀️'
            - '🤾🏼'
            - '🤾🏼‍♂️'
            - '🤹🏼‍♀️'
            - '🤹🏼'
            - '🤹🏼‍♂️'
            - '🧘🏼‍♀️'
            - '🧘🏼'
            - '🧘🏼‍♂️'
            - '🛀🏼'
            - '🛌🏼'
            - '👋🏽'
            - '🤚🏽'
            - '🖐🏽'
            - '✋🏽'
            - '🖖🏽'
            - '👌🏽'
            - '🤌🏽'
            - '🤏🏽'
            - '✌🏽'
            - '🤞🏽'
            - '🫰🏽'
            - '🤟🏽'
            - '🤘🏽'
            - '🤙🏽'
            - '🫵🏽'
            - '🫱🏽'
            - '🫲🏽'
            - '🫳🏽'
            - '🫴🏽'
            - '👈🏽'
            - '👉🏽'
            - '👆🏽'
            - '🖕🏽'
            - '👇🏽'
            - '☝🏽'
            - '👍🏽'
            - '👎🏽'
            - '✊🏽'
            - '👊🏽'
            - '🤛🏽'
            - '🤜🏽'
            - '👏🏽'
            - '🫶🏽'
            - '🙌🏽'
            - '👐🏽'
            - '🤲🏽'
            - '🙏🏽'
            - '✍🏽'
            - '💪🏽'
            - '🦵🏽'
            - '🦶🏽'
            - '👂🏽'
            - '🦻🏽'
            - '👃🏽'
            - '👶🏽'
            - '👧🏽'
            - '🧒🏽'
            - '👦🏽'
            - '👩🏽'
            - '🧑🏽'
            - '👨🏽'
            - '👩🏽‍🦱'
            - '🧑🏽‍🦱'
            - '👨🏽‍🦱'
            - '👩🏽‍🦰'
            - '🧑🏽‍🦰'
            - '👨🏽‍🦰'
            - '👱🏽‍♀️'
            - '👱🏽'
            - '👱🏽‍♂️'
            - '👩🏽‍🦳'
            - '🧑🏽‍🦳'
            - '👨🏽‍🦳'
            - '👩🏽‍🦲'
            - '🧑🏽‍🦲'
            - '👨🏽‍🦲'
            - '🧔🏽‍♀️'
            - '🧔🏽'
            - '🧔🏽‍♂️'
            - '👵🏽'
            - '🧓🏽'
            - '👴🏽'
            - '👲🏽'
            - '👳🏽‍♀️'
            - '👳🏽'
            - '👳🏽‍♂️'
            - '🧕🏽'
            - '👮🏽‍♀️'
            - '👮🏽'
            - '👮🏽‍♂️'
            - '👷🏽‍♀️'
            - '👷🏽'
            - '👷🏽‍♂️'
            - '💂🏽‍♀️'
            - '💂🏽'
            - '💂🏽‍♂️'
            - '🕵🏽‍♀️'
            - '🕵🏽'
            - '🕵🏽‍♂️'
            - '👩🏽‍⚕️'
            - '🧑🏽‍⚕️'
            - '👨🏽‍⚕️'
            - '👩🏽‍🌾'
            - '🧑🏽‍🌾'
            - '👨🏽‍🌾'
            - '👩🏽‍🍳'
            - '🧑🏽‍🍳'
            - '👨🏽‍🍳'
            - '👩🏽‍🎓'
            - '🧑🏽‍🎓'
            - '👨🏽‍🎓'
            - '👩🏽‍🎤'
            - '🧑🏽‍🎤'
            - '👨🏽‍🎤'
            - '👩🏽‍🏫'
            - '🧑🏽‍🏫'
            - '👨🏽‍🏫'
            - '👩🏽‍🏭'
            - '🧑🏽‍🏭'
            - '👨🏽‍🏭'
            - '👩🏽‍💻'
            - '🧑🏽‍💻'
            - '👨🏽‍💻'
            - '👩🏽‍💼'
            - '🧑🏽‍💼'
            - '👨🏽‍💼'
            - '👩🏽‍🔧'
            - '🧑🏽‍🔧'
            - '👨🏽‍🔧'
            - '👩🏽‍🔬'
            - '🧑🏽‍🔬'
            - '👨🏽‍🔬'
            - '👩🏽‍🎨'
            - '🧑🏽‍🎨'
            - '👨🏽‍🎨'
            - '👩🏽‍🚒'
            - '🧑🏽‍🚒'
            - '👨🏽‍🚒'
            - '👩🏽‍✈️'
            - '🧑🏽‍✈️'
            - '👨🏽‍✈️'
            - '👩🏽‍🚀'
            - '🧑🏽‍🚀'
            - '👨🏽‍🚀'
            - '👩🏽‍⚖️'
            - '🧑🏽‍⚖️'
            - '👨🏽‍⚖️'
            - '👰🏽‍♀️'
            - '👰🏽'
            - '👰🏽‍♂️'
            - '🤵🏽‍♀️'
            - '🤵🏽'
            - '🤵🏽‍♂️'
            - '👸🏽'
            - '🫅🏽'
            - '🤴🏽'
            - '🥷🏽'
            - '🦸🏽‍♀️'
            - '🦸🏽'
            - '🦸🏽‍♂️'
            - '🦹🏽‍♀️'
            - '🦹🏽'
            - '🦹🏽‍♂️'
            - '🤶🏽'
            - '🧑🏽‍🎄'
            - '🎅🏽'
            - '🧙🏽‍♀️'
            - '🧙🏽'
            - '🧙🏽‍♂️'
            - '🧝🏽‍♀️'
            - '🧝🏽'
            - '🧝🏽‍♂️'
            - '🧛🏽‍♀️'
            - '🧛🏽'
            - '🧛🏽‍♂️'
            - '🧜🏽‍♀️'
            - '🧜🏽'
            - '🧜🏽‍♂️'
            - '🧚🏽‍♀️'
            - '🧚🏽'
            - '🧚🏽‍♂️'
            - '👼🏽'
            - '🤰🏽'
            - '🫄🏽'
            - '🫃🏽'
            - '🤱🏽'
            - '👩🏽‍🍼'
            - '🧑🏽‍🍼'
            - '👨🏽‍🍼'
            - '🙇🏽‍♀️'
            - '🙇🏽'
            - '🙇🏽‍♂️'
            - '💁🏽‍♀️'
            - '💁🏽'
            - '💁🏽‍♂️'
            - '🙅🏽‍♀️'
            - '🙅🏽'
            - '🙅🏽‍♂️'
            - '🙆🏽‍♀️'
            - '🙆🏽'
            - '🙆🏽‍♂️'
            - '🙋🏽‍♀️'
            - '🙋🏽'
            - '🙋🏽‍♂️'
            - '🧏🏽‍♀️'
            - '🧏🏽'
            - '🧏🏽‍♂️'
            - '🤦🏽‍♀️'
            - '🤦🏽'
            - '🤦🏽‍♂️'
            - '🤷🏽‍♀️'
            - '🤷🏽'
            - '🤷🏽‍♂️'
            - '🙎🏽‍♀️'
            - '🙎🏽'
            - '🙎🏽‍♂️'
            - '🙍🏽‍♀️'
            - '🙍🏽'
            - '🙍🏽‍♂️'
            - '💇🏽‍♀️'
            - '💇🏽'
            - '💇🏽‍♂️'
            - '💆🏽‍♀️'
            - '💆🏽'
            - '💆🏽‍♂️'
            - '🧖🏽‍♀️'
            - '🧖🏽'
            - '🧖🏽‍♂️'
            - '💃🏽'
            - '🕺🏽'
            - '🕴🏽'
            - '👩🏽‍🦽'
            - '🧑🏽‍🦽'
            - '👨🏽‍🦽'
            - '👩🏽‍🦼'
            - '🧑🏽‍🦼'
            - '👨🏽‍🦼'
            - '🚶🏽‍♀️'
            - '🚶🏽'
            - '🚶🏽‍♂️'
            - '👩🏽‍🦯'
            - '🧑🏽‍🦯'
            - '👨🏽‍🦯'
            - '🧎🏽‍♀️'
            - '🧎🏽'
            - '🧎🏽‍♂️'
            - '🏃🏽‍♀️'
            - '🏃🏽'
            - '🏃🏽‍♂️'
            - '🧍🏽‍♀️'
            - '🧍🏽'
            - '🧍🏽‍♂️'
            - '👭🏽'
            - '🧑🏽‍🤝‍🧑🏽'
            - '👬🏽'
            - '👫🏽'
            - '🧗🏽‍♀️'
            - '🧗🏽'
            - '🧗🏽‍♂️'
            - '🏇🏽'
            - '🏂🏽'
            - '🏌🏽‍♀️'
            - '🏌🏽'
            - '🏌🏽‍♂️'
            - '🏄🏽‍♀️'
            - '🏄🏽'
            - '🏄🏽‍♂️'
            - '🚣🏽‍♀️'
            - '🚣🏽'
            - '🚣🏽‍♂️'
            - '🏊🏽‍♀️'
            - '🏊🏽'
            - '🏊🏽‍♂️'
            - '⛹🏽‍♀️'
            - '⛹🏽'
            - '⛹🏽‍♂️'
            - '🏋🏽‍♀️'
            - '🏋🏽'
            - '🏋🏽‍♂️'
            - '🚴🏽‍♀️'
            - '🚴🏽'
            - '🚴🏽‍♂️'
            - '🚵🏽‍♀️'
            - '🚵🏽'
            - '🚵🏽‍♂️'
            - '🤸🏽‍♀️'
            - '🤸🏽'
            - '🤸🏽‍♂️'
            - '🤽🏽‍♀️'
            - '🤽🏽'
            - '🤽🏽‍♂️'
            - '🤾🏽‍♀️'
            - '🤾🏽'
            - '🤾🏽‍♂️'
            - '🤹🏽‍♀️'
            - '🤹🏽'
            - '🤹🏽‍♂️'
            - '🧘🏽‍♀️'
            - '🧘🏽'
            - '🧘🏽‍♂️'
            - '🛀🏽'
            - '🛌🏽'
            - '👋🏾'
            - '🤚🏾'
            - '🖐🏾'
            - '✋🏾'
            - '🖖🏾'
            - '👌🏾'
            - '🤌🏾'
            - '🤏🏾'
            - '✌🏾'
            - '🤞🏾'
            - '🫰🏾'
            - '🤟🏾'
            - '🤘🏾'
            - '🤙🏾'
            - '🫵🏾'
            - '🫱🏾'
            - '🫲🏾'
            - '🫳🏾'
            - '🫴🏾'
            - '👈🏾'
            - '👉🏾'
            - '👆🏾'
            - '🖕🏾'
            - '👇🏾'
            - '☝🏾'
            - '👍🏾'
            - '👎🏾'
            - '✊🏾'
            - '👊🏾'
            - '🤛🏾'
            - '🤜🏾'
            - '👏🏾'
            - '🫶🏾'
            - '🙌🏾'
            - '👐🏾'
            - '🤲🏾'
            - '🙏🏾'
            - '✍🏾'
            - '💪🏾'
            - '🦵🏾'
            - '🦶🏾'
            - '👂🏾'
            - '🦻🏾'
            - '👃🏾'
            - '👶🏾'
            - '👧🏾'
            - '🧒🏾'
            - '👦🏾'
            - '👩🏾'
            - '🧑🏾'
            - '👨🏾'
            - '👩🏾‍🦱'
            - '🧑🏾‍🦱'
            - '👨🏾‍🦱'
            - '👩🏾‍🦰'
            - '🧑🏾‍🦰'
            - '👨🏾‍🦰'
            - '👱🏾‍♀️'
            - '👱🏾'
            - '👱🏾‍♂️'
            - '👩🏾‍🦳'
            - '🧑🏾‍🦳'
            - '👨🏾‍🦳'
            - '👩🏾‍🦲'
            - '🧑🏾‍🦲'
            - '👨🏾‍🦲'
            - '🧔🏾‍♀️'
            - '🧔🏾'
            - '🧔🏾‍♂️'
            - '👵🏾'
            - '🧓🏾'
            - '👴🏾'
            - '👲🏾'
            - '👳🏾‍♀️'
            - '👳🏾'
            - '👳🏾‍♂️'
            - '🧕🏾'
            - '👮🏾‍♀️'
            - '👮🏾'
            - '👮🏾‍♂️'
            - '👷🏾‍♀️'
            - '👷🏾'
            - '👷🏾‍♂️'
            - '💂🏾‍♀️'
            - '💂🏾'
            - '💂🏾‍♂️'
            - '🕵🏾‍♀️'
            - '🕵🏾'
            - '🕵🏾‍♂️'
            - '👩🏾‍⚕️'
            - '🧑🏾‍⚕️'
            - '👨🏾‍⚕️'
            - '👩🏾‍🌾'
            - '🧑🏾‍🌾'
            - '👨🏾‍🌾'
            - '👩🏾‍🍳'
            - '🧑🏾‍🍳'
            - '👨🏾‍🍳'
            - '👩🏾‍🎓'
            - '🧑🏾‍🎓'
            - '👨🏾‍🎓'
            - '👩🏾‍🎤'
            - '🧑🏾‍🎤'
            - '👨🏾‍🎤'
            - '👩🏾‍🏫'
            - '🧑🏾‍🏫'
            - '👨🏾‍🏫'
            - '👩🏾‍🏭'
            - '🧑🏾‍🏭'
            - '👨🏾‍🏭'
            - '👩🏾‍💻'
            - '🧑🏾‍💻'
            - '👨🏾‍💻'
            - '👩🏾‍💼'
            - '🧑🏾‍💼'
            - '👨🏾‍💼'
            - '👩🏾‍🔧'
            - '🧑🏾‍🔧'
            - '👨🏾‍🔧'
            - '👩🏾‍🔬'
            - '🧑🏾‍🔬'
            - '👨🏾‍🔬'
            - '👩🏾‍🎨'
            - '🧑🏾‍🎨'
            - '👨🏾‍🎨'
            - '👩🏾‍🚒'
            - '🧑🏾‍🚒'
            - '👨🏾‍🚒'
            - '👩🏾‍✈️'
            - '🧑🏾‍✈️'
            - '👨🏾‍✈️'
            - '👩🏾‍🚀'
            - '🧑🏾‍🚀'
            - '👨🏾‍🚀'
            - '👩🏾‍⚖️'
            - '🧑🏾‍⚖️'
            - '👨🏾‍⚖️'
            - '👰🏾‍♀️'
            - '👰🏾'
            - '👰🏾‍♂️'
            - '🤵🏾‍♀️'
            - '🤵🏾'
            - '🤵🏾‍♂️'
            - '👸🏾'
            - '🫅🏾'
            - '🤴🏾'
            - '🥷🏾'
            - '🦸🏾‍♀️'
            - '🦸🏾'
            - '🦸🏾‍♂️'
            - '🦹🏾‍♀️'
            - '🦹🏾'
            - '🦹🏾‍♂️'
            - '🤶🏾'
            - '🧑🏾‍🎄'
            - '🎅🏾'
            - '🧙🏾‍♀️'
            - '🧙🏾'
            - '🧙🏾‍♂️'
            - '🧝🏾‍♀️'
            - '🧝🏾'
            - '🧝🏾‍♂️'
            - '🧛🏾‍♀️'
            - '🧛🏾'
            - '🧛🏾‍♂️'
            - '🧜🏾‍♀️'
            - '🧜🏾'
            - '🧜🏾‍♂️'
            - '🧚🏾‍♀️'
            - '🧚🏾'
            - '🧚🏾‍♂️'
            - '👼🏾'
            - '🤰🏾'
            - '🫄🏾'
            - '🫃🏾'
            - '🤱🏾'
            - '👩🏾‍🍼'
            - '🧑🏾‍🍼'
            - '👨🏾‍🍼'
            - '🙇🏾‍♀️'
            - '🙇🏾'
            - '🙇🏾‍♂️'
            - '💁🏾‍♀️'
            - '💁🏾'
            - '💁🏾‍♂️'
            - '🙅🏾‍♀️'
            - '🙅🏾'
            - '🙅🏾‍♂️'
            - '🙆🏾‍♀️'
            - '🙆🏾'
            - '🙆🏾‍♂️'
            - '🙋🏾‍♀️'
            - '🙋🏾'
            - '🙋🏾‍♂️'
            - '🧏🏾‍♀️'
            - '🧏🏾'
            - '🧏🏾‍♂️'
            - '🤦🏾‍♀️'
            - '🤦🏾'
            - '🤦🏾‍♂️'
            - '🤷🏾‍♀️'
            - '🤷🏾'
            - '🤷🏾‍♂️'
            - '🙎🏾‍♀️'
            - '🙎🏾'
            - '🙎🏾‍♂️'
            - '🙍🏾‍♀️'
            - '🙍🏾'
            - '🙍🏾‍♂️'
            - '💇🏾‍♀️'
            - '💇🏾'
            - '💇🏾‍♂️'
            - '💆🏾‍♀️'
            - '💆🏾'
            - '💆🏾‍♂️'
            - '🧖🏾‍♀️'
            - '🧖🏾'
            - '🧖🏾‍♂️'
            - '💃🏾'
            - '🕺🏾'
            - '👩🏾‍🦽'
            - '🧑🏾‍🦽'
            - '👨🏾‍🦽'
            - '👩🏾‍🦼'
            - '🧑🏾‍🦼'
            - '👨🏾‍🦼'
            - '🚶🏾‍♀️'
            - '🚶🏾'
            - '🚶🏾‍♂️'
            - '👩🏾‍🦯'
            - '🧑🏾‍🦯'
            - '👨🏾‍🦯'
            - '🧎🏾‍♀️'
            - '🧎🏾'
            - '🧎🏾‍♂️'
            - '🏃🏾‍♀️'
            - '🏃🏾'
            - '🏃🏾‍♂️'
            - '🧍🏾‍♀️'
            - '🧍🏾'
            - '🧍🏾‍♂️'
            - '👭🏾'
            - '🧑🏾‍🤝‍🧑🏾'
            - '👬🏾'
            - '👫🏾'
            - '🧗🏾‍♀️'
            - '🧗🏾'
            - '🧗🏾‍♂️'
            - '🏇🏾'
            - '🏂🏾'
            - '🏌🏾‍♀️'
            - '🏌🏾'
            - '🏌🏾‍♂️'
            - '🏄🏾‍♀️'
            - '🏄🏾'
            - '🏄🏾‍♂️'
            - '🚣🏾‍♀️'
            - '🚣🏾'
            - '🚣🏾‍♂️'
            - '🏊🏾‍♀️'
            - '🏊🏾'
            - '🏊🏾‍♂️'
            - '⛹🏾‍♀️'
            - '⛹🏾'
            - '⛹🏾‍♂️'
            - '🏋🏾‍♀️'
            - '🏋🏾'
            - '🏋🏾‍♂️'
            - '🚴🏾‍♀️'
            - '🚴🏾'
            - '🚴🏾‍♂️'
            - '🚵🏾‍♀️'
            - '🚵🏾'
            - '🚵🏾‍♂️'
            - '🤸🏾‍♀️'
            - '🤸🏾'
            - '🤸🏾‍♂️'
            - '🤽🏾‍♀️'
            - '🤽🏾'
            - '🤽🏾‍♂️'
            - '🤾🏾‍♀️'
            - '🤾🏾'
            - '🤾🏾‍♂️'
            - '🤹🏾‍♀️'
            - '🤹🏾'
            - '🤹🏾‍♂️'
            - '🧘🏾‍♀️'
            - '🧘🏾'
            - '🧘🏾‍♂️'
            - '🛀🏾'
            - '🛌🏾'
            - '👋🏿'
            - '🤚🏿'
            - '🖐🏿'
            - '✋🏿'
            - '🖖🏿'
            - '👌🏿'
            - '🤌🏿'
            - '🤏🏿'
            - '✌🏿'
            - '🤞🏿'
            - '🫰🏿'
            - '🤟🏿'
            - '🤘🏿'
            - '🤙🏿'
            - '🫵🏿'
            - '🫱🏿'
            - '🫲🏿'
            - '🫳🏿'
            - '🫴🏿'
            - '👈🏿'
            - '👉🏿'
            - '👆🏿'
            - '🖕🏿'
            - '👇🏿'
            - '☝🏿'
            - '👍🏿'
            - '👎🏿'
            - '✊🏿'
            - '👊🏿'
            - '🤛🏿'
            - '🤜🏿'
            - '👏🏿'
            - '🫶🏿'
            - '🙌🏿'
            - '👐🏿'
            - '🤲🏿'
            - '🙏🏿'
            - '✍🏿'
            - '🤳🏿'
            - '💪🏿'
            - '🦵🏿'
            - '🦶🏿'
            - '👂🏿'
            - '🦻🏿'
            - '👃🏿'
            - '👶🏿'
            - '👧🏿'
            - '🧒🏿'
            - '👦🏿'
            - '👩🏿'
            - '🧑🏿'
            - '👨🏿'
            - '👩🏿‍🦱'
            - '🧑🏿‍🦱'
            - '👨🏿‍🦱'
            - '👩🏿‍🦰'
            - '🧑🏿‍🦰'
            - '👨🏿‍🦰'
            - '👱🏿‍♀️'
            - '👱🏿'
            - '👱🏿‍♂️'
            - '👩🏿‍🦳'
            - '🧑🏿‍🦳'
            - '👨🏿‍🦳'
            - '👩🏿‍🦲'
            - '🧑🏿‍🦲'
            - '👨🏿‍🦲'
            - '🧔🏿‍♀️'
            - '🧔🏿'
            - '🧔🏿‍♂️'
            - '👵🏿'
            - '🧓🏿'
            - '👴🏿'
            - '👲🏿'
            - '👳🏿‍♀️'
            - '👳🏿'
            - '👳🏿‍♂️'
            - '🧕🏿'
            - '👮🏿‍♀️'
            - '👮🏿'
            - '👮🏿‍♂️'
            - '👷🏿‍♀️'
            - '👷🏿'
            - '👷🏿‍♂️'
            - '💂🏿‍♀️'
            - '💂🏿'
            - '💂🏿‍♂️'
            - '🕵🏿‍♀️'
            - '🕵🏿'
            - '🕵🏿‍♂️'
            - '👩🏿‍⚕️'
            - '🧑🏿‍⚕️'
            - '👨🏿‍⚕️'
            - '👩🏿‍🌾'
            - '🧑🏿‍🌾'
            - '👨🏿‍🌾'
            - '👩🏿‍🍳'
            - '🧑🏿‍🍳'
            - '👨🏿‍🍳'
            - '👩🏿‍🎓'
            - '🧑🏿‍🎓'
            - '👨🏿‍🎓'
            - '👩🏿‍🎤'
            - '🧑🏿‍🎤'
            - '👨🏿‍🎤'
            - '👩🏿‍🏫'
            - '🧑🏿‍🏫'
            - '👨🏿‍🏫'
            - '👩🏿‍🏭'
            - '🧑🏿‍🏭'
            - '👨🏿‍🏭'
            - '👩🏿‍💻'
            - '🧑🏿‍💻'
            - '👨🏿‍💻'
            - '👩🏿‍💼'
            - '🧑🏿‍💼'
            - '👨🏿‍💼'
            - '👩🏿‍🔧'
            - '🧑🏿‍🔧'
            - '👨🏿‍🔧'
            - '👩🏿‍🔬'
            - '🧑🏿‍🔬'
            - '👨🏿‍🔬'
            - '👩🏿‍🎨'
            - '🧑🏿‍🎨'
            - '👨🏿‍🎨'
            - '👩🏿‍🚒'
            - '🧑🏿‍🚒'
            - '👨🏿‍🚒'
            - '👩🏿‍✈️'
            - '🧑🏿‍✈️'
            - '👨🏿‍✈️'
            - '👩🏿‍🚀'
            - '🧑🏿‍🚀'
            - '👨🏿‍🚀'
            - '👩🏿‍⚖️'
            - '🧑🏿‍⚖️'
            - '👨🏿‍⚖️'
            - '👰🏿‍♀️'
            - '👰🏿'
            - '👰🏿‍♂️'
            - '🤵🏿‍♀️'
            - '🤵🏿'
            - '🤵🏿‍♂️'
            - '👸🏿'
            - '🫅🏿'
            - '🤴🏿'
            - '🥷🏿'
            - '🦸🏿‍♀️'
            - '🦸🏿'
            - '🦸🏿‍♂️'
            - '🦹🏿‍♀️'
            - '🦹🏿'
            - '🦹🏿‍♂️'
            - '🤶🏿'
            - '🧑🏿‍🎄'
            - '🎅🏿'
            - '🧙🏿‍♀️'
            - '🧙🏿'
            - '🧙🏿‍♂️'
            - '🧝🏿‍♀️'
            - '🧝🏿'
            - '🧝🏿‍♂️'
            - '🧛🏿‍♀️'
            - '🧛🏿'
            - '🧛🏿‍♂️'
            - '🧜🏿‍♀️'
            - '🧜🏿'
            - '🧜🏿‍♂️'
            - '🧚🏿‍♀️'
            - '🧚🏿'
            - '🧚🏿‍♂️'
            - '👼🏿'
            - '🤰🏿'
            - '🫄🏿'
            - '🫃🏿'
            - '🤱🏿'
            - '👩🏿‍🍼'
            - '🧑🏿‍🍼'
            - '👨🏿‍🍼'
            - '🙇🏿‍♀️'
            - '🙇🏿'
            - '🙇🏿‍♂️'
            - '💁🏿‍♀️'
            - '💁🏿'
            - '💁🏿‍♂️'
            - '🙅🏿‍♀️'
            - '🙅🏿'
            - '🙅🏿‍♂️'
            - '🙆🏿‍♀️'
            - '🙆🏿'
            - '🙆🏿‍♂️'
            - '🙋🏿‍♀️'
            - '🙋🏿'
            - '🙋🏿‍♂️'
            - '🧏🏿‍♀️'
            - '🧏🏿'
            - '🧏🏿‍♂️'
            - '🤦🏿‍♀️'
            - '🤦🏿'
            - '🤦🏿‍♂️'
            - '🤷🏿‍♀️'
            - '🤷🏿'
            - '🤷🏿‍♂️'
            - '🙎🏿‍♀️'
            - '🙎🏿'
            - '🙎🏿‍♂️'
            - '🙍🏿‍♀️'
            - '🙍🏿'
            - '🙍🏿‍♂️'
            - '💇🏿‍♀️'
            - '💇🏿'
            - '💇🏿‍♂️'
            - '💆🏿‍♀️'
            - '💆🏿'
            - '💆🏿‍♂️'
            - '🧖🏿‍♀️'
            - '🧖🏿'
            - '🧖🏿‍♂️'
            - '💃🏿'
            - '🕺🏿'
            - '🕴🏿'
            - '👩🏿‍🦽'
            - '🧑🏿‍🦽'
            - '👨🏿‍🦽'
            - '👩🏿‍🦼'
            - '🧑🏿‍🦼'
            - '👨🏿‍🦼'
            - '🚶🏿‍♀️'
            - '🚶🏿'
            - '🚶🏿‍♂️'
            - '👩🏿‍🦯'
            - '🧑🏿‍🦯'
            - '👨🏿‍🦯'
            - '🧎🏿‍♀️'
            - '🧎🏿'
            - '🧎🏿‍♂️'
            - '🏃🏿‍♀️'
            - '🏃🏿'
            - '🏃🏿‍♂️'
            - '🧍🏿‍♀️'
            - '🧍🏿'
            - '🧍🏿‍♂️'
            - '👭🏿'
            - '🧑🏿‍🤝‍🧑🏿'
            - '👬🏿'
            - '👫🏿'
            - '🧗🏿‍♀️'
            - '🧗🏿'
            - '🧗🏿‍♂️'
            - '🏇🏿'
            - '🏂🏿'
            - '🏌🏿‍♀️'
            - '🏌🏿'
            - '🏌🏿‍♂️'
            - '🏄🏿‍♀️'
            - '🏄🏿'
            - '🏄🏿‍♂️'
            - '🚣🏿‍♀️'
            - '🚣🏿'
            - '🚣🏿‍♂️'
            - '🏊🏿‍♀️'
            - '🏊🏿'
            - '🏊🏿‍♂️'
            - '⛹🏿‍♀️'
            - '⛹🏿'
            - '⛹🏿‍♂️'
            - '🏋🏿‍♀️'
            - '🏋🏿'
            - '🏋🏿‍♂️'
            - '🚴🏿‍♀️'
            - '🚴🏿'
            - '🚴🏿‍♂️'
            - '🚵🏿‍♀️'
            - '🚵🏿'
            - '🚵🏿‍♂️'
            - '🤸🏿‍♀️'
            - '🤸🏿'
            - '🤸🏿‍♂️'
            - '🤽🏿‍♀️'
            - '🤽🏿'
            - '🤽🏿‍♂️'
            - '🤾🏿‍♀️'
            - '🤾🏿'
            - '🤾🏿‍♂️'
            - '🤹🏿‍♀️'
            - '🤹🏿'
            - '🤹🏿‍♂️'
            - '🧘🏿‍♀️'
            - '🧘🏿'
            - '🧘🏿‍♂️'
            - '🛀🏿'
            - '🛌🏿'
            - '🐶'
            - '🐱'
            - '🐭'
            - '🐹'
            - '🐰'
            - '🦊'
            - '🐻'
            - '🐼'
            - '🐻‍❄️'
            - '🐨'
            - '🐯'
            - '🦁'
            - '🐮'
            - '🐷'
            - '🐽'
            - '🐸'
            - '🐵'
            - '🙈'
            - '🙉'
            - '🙊'
            - '🐒'
            - '🐔'
            - '🐧'
            - '🐦'
            - '🐤'
            - '🐣'
            - '🐥'
    condition: selection
falsepositives:
    - Unknown
level: high

KQL (Azure Sentinel)

imProcessCreate
| where TargetProcessCommandLine contains "🤷🏼" or TargetProcessCommandLine contains "🤷🏼‍♂️" or TargetProcessCommandLine contains "🙎🏼‍♀️" or TargetProcessCommandLine contains "🙎🏼" or TargetProcessCommandLine contains "🙎🏼‍♂️" or TargetProcessCommandLine contains "🙍🏼‍♀️" or TargetProcessCommandLine contains "🙍🏼" or TargetProcessCommandLine contains "🙍🏼‍♂️" or TargetProcessCommandLine contains "💇🏼‍♀️" or TargetProcessCommandLine contains "💇🏼" or TargetProcessCommandLine contains "💇🏼‍♂️" or TargetProcessCommandLine contains "💆🏼‍♀️" or TargetProcessCommandLine contains "💆🏼" or TargetProcessCommandLine contains "💆🏼‍♂️" or TargetProcessCommandLine contains "🧖🏼‍♀️" or TargetProcessCommandLine contains "🧖🏼" or TargetProcessCommandLine contains "🧖🏼‍♂️" or TargetProcessCommandLine contains "💃🏼" or TargetProcessCommandLine contains "🕺🏼" or TargetProcessCommandLine contains "🕴🏼" or TargetProcessCommandLine contains "👩🏼‍🦽" or TargetProcessCommandLine contains "🧑🏼‍🦽" or TargetProcessCommandLine contains "👨🏼‍🦽" or TargetProcessCommandLine contains "👩🏼‍🦼" or TargetProcessCommandLine contains "🧑🏼‍🦼" or TargetProcessCommandLine contains "👨🏼‍🦼" or TargetProcessCommandLine contains "🚶🏼‍♀️" or TargetProcessCommandLine contains "🚶🏼" or TargetProcessCommandLine contains "🚶🏼‍♂️" or TargetProcessCommandLine contains "👩🏼‍🦯" or TargetProcessCommandLine contains "🧑🏼‍🦯" or TargetProcessCommandLine contains "👨🏼‍🦯" or TargetProcessCommandLine contains "🧎🏼‍♀️" or TargetProcessCommandLine contains "🧎🏼" or TargetProcessCommandLine contains "🧎🏼‍♂️" or TargetProcessCommandLine contains "🏃🏼‍♀️" or TargetProcessCommandLine contains "🏃🏼" or TargetProcessCommandLine contains "🏃🏼‍♂️" or TargetProcessCommandLine contains "🧍🏼‍♀️" or TargetProcessCommandLine contains "🧍🏼" or TargetProcessCommandLine contains "🧍🏼‍♂️" or TargetProcessCommandLine contains "👭🏼" or TargetProcessCommandLine contains "🧑🏼‍🤝‍🧑🏼" or TargetProcessCommandLine contains "👬🏼" or TargetProcessCommandLine contains "👫🏼" or TargetProcessCommandLine contains "🧗🏼‍♀️" or TargetProcessCommandLine contains "🧗🏼" or TargetProcessCommandLine contains "🧗🏼‍♂️" or TargetProcessCommandLine contains "🏇🏼" or TargetProcessCommandLine contains "🏂🏼" or TargetProcessCommandLine contains "🏌🏼‍♀️" or TargetProcessCommandLine contains "🏌🏼" or TargetProcessCommandLine contains "🏌🏼‍♂️" or TargetProcessCommandLine contains "🏄🏼‍♀️" or TargetProcessCommandLine contains "🏄🏼" or TargetProcessCommandLine contains "🏄🏼‍♂️" or TargetProcessCommandLine contains "🚣🏼‍♀️" or TargetProcessCommandLine contains "🚣🏼" or TargetProcessCommandLine contains "🚣🏼‍♂️" or TargetProcessCommandLine contains "🏊🏼‍♀️" or TargetProcessCommandLine contains "🏊🏼" or TargetProcessCommandLine contains "🏊🏼‍♂️" or TargetProcessCommandLine contains "⛹🏼‍♀️" or TargetProcessCommandLine contains "⛹🏼" or TargetProcessCommandLine contains "⛹🏼‍♂️" or TargetProcessCommandLine contains "🏋🏼‍♀️" or TargetProcessCommandLine contains "🏋🏼" or TargetProcessCommandLine contains "🏋🏼‍♂️" or TargetProcessCommandLine contains "🚴🏼‍♀️" or TargetProcessCommandLine contains "🚴🏼" or TargetProcessCommandLine contains "🚴🏼‍♂️" or TargetProcessCommandLine contains "🚵🏼‍♀️" or TargetProcessCommandLine contains "🚵🏼" or TargetProcessCommandLine contains "🚵🏼‍♂️" or TargetProcessCommandLine contains "🤸🏼‍♀️" or TargetProcessCommandLine contains "🤸🏼" or TargetProcessCommandLine contains "🤸🏼‍♂️" or TargetProcessCommandLine contains "🤽🏼‍♀️" or TargetProcessCommandLine contains "🤽🏼" or TargetProcessCommandLine contains "🤽🏼‍♂️" or TargetProcessCommandLine contains "🤾🏼‍♀️" or TargetProcessCommandLine contains "🤾🏼" or TargetProcessCommandLine contains "🤾🏼‍♂️" or TargetProcessCommandLine contains "🤹🏼‍♀️" or TargetProcessCommandLine contains "🤹🏼" or TargetProcessCommandLine contains "🤹🏼‍♂️" or TargetProcessCommandLine contains "🧘🏼‍♀️" or TargetProcessCommandLine contains "🧘🏼" or TargetProcessCommandLine contains "🧘🏼‍♂️" or TargetProcessCommandLine contains "🛀🏼" or TargetProcessCommandLine contains "🛌🏼" or TargetProcessCommandLine contains "👋🏽" or TargetProcessCommandLine contains "🤚🏽" or TargetProcessCommandLine contains "🖐🏽" or TargetProcessCommandLine contains "✋🏽" or TargetProcessCommandLine contains "🖖🏽" or TargetProcessCommandLine contains "👌🏽" or TargetProcessCommandLine contains "🤌🏽" or TargetProcessCommandLine contains "🤏🏽" or TargetProcessCommandLine contains "✌🏽" or TargetProcessCommandLine contains "🤞🏽" or TargetProcessCommandLine contains "🫰🏽" or TargetProcessCommandLine contains "🤟🏽" or TargetProcessCommandLine contains "🤘🏽" or TargetProcessCommandLine contains "🤙🏽" or TargetProcessCommandLine contains "🫵🏽" or TargetProcessCommandLine contains "🫱🏽" or TargetProcessCommandLine contains "🫲🏽" or TargetProcessCommandLine contains "🫳🏽" or TargetProcessCommandLine contains "🫴🏽" or TargetProcessCommandLine contains "👈🏽" or TargetProcessCommandLine contains "👉🏽" or TargetProcessCommandLine contains "👆🏽" or TargetProcessCommandLine contains "🖕🏽" or TargetProcessCommandLine contains "👇🏽" or TargetProcessCommandLine contains "☝🏽" or TargetProcessCommandLine contains "👍🏽" or TargetProcessCommandLine contains "👎🏽" or TargetProcessCommandLine contains "✊🏽" or TargetProcessCommandLine contains "👊🏽" or TargetProcessCommandLine contains "🤛🏽" or TargetProcessCommandLine contains "🤜🏽" or TargetProcessCommandLine contains "👏🏽" or TargetProcessCommandLine contains "🫶🏽" or TargetProcessCommandLine contains "🙌🏽" or TargetProcessCommandLine contains "👐🏽" or TargetProcessCommandLine contains "🤲🏽" or TargetProcessCommandLine contains "🙏🏽" or TargetProcessCommandLine contains "✍🏽" or TargetProcessCommandLine contains "💪🏽" or TargetProcessCommandLine contains "🦵🏽" or TargetProcessCommandLine contains "🦶🏽" or TargetProcessCommandLine contains "👂🏽" or TargetProcessCommandLine contains "🦻🏽" or TargetProcessCommandLine contains "👃🏽" or TargetProcessCommandLine contains "👶🏽" or TargetProcessCommandLine contains "👧🏽" or TargetProcessCommandLine contains "🧒🏽" or TargetProcessCommandLine contains "👦🏽" or TargetProcessCommandLine contains "👩🏽" or TargetProcessCommandLine contains "🧑🏽" or TargetProcessCommandLine contains "👨🏽" or TargetProcessCommandLine contains "👩🏽‍🦱" or TargetProcessCommandLine contains "🧑🏽‍🦱" or TargetProcessCommandLine contains "👨🏽‍🦱" or TargetProcessCommandLine contains "👩🏽‍🦰" or TargetProcessCommandLine contains "🧑🏽‍🦰" or TargetProcessCommandLine contains "👨🏽‍🦰" or TargetProcessCommandLine contains "👱🏽‍♀️" or TargetProcessCommandLine contains "👱🏽" or TargetProcessCommandLine contains "👱🏽‍♂️" or TargetProcessCommandLine contains "👩🏽‍🦳" or TargetProcessCommandLine contains "🧑🏽‍🦳" or TargetProcessCommandLine contains "👨🏽‍🦳" or TargetProcessCommandLine contains "👩🏽‍🦲" or TargetProcessCommandLine contains "🧑🏽‍🦲" or TargetProcessCommandLine contains "👨🏽‍🦲" or TargetProcessCommandLine contains "🧔🏽‍♀️" or TargetProcessCommandLine contains "🧔🏽" or TargetProcessCommandLine contains "🧔🏽‍♂️" or TargetProcessCommandLine contains "👵🏽" or TargetProcessCommandLine contains "🧓🏽" or TargetProcessCommandLine contains "👴🏽" or TargetProcessCommandLine contains "👲🏽" or TargetProcessCommandLine contains "👳🏽‍♀️" or TargetProcessCommandLine contains "👳🏽" or TargetProcessCommandLine contains "👳🏽‍♂️" or TargetProcessCommandLine contains "🧕🏽" or TargetProcessCommandLine contains "👮🏽‍♀️" or TargetProcessCommandLine contains "👮🏽" or TargetProcessCommandLine contains "👮🏽‍♂️" or TargetProcessCommandLine contains "👷🏽‍♀️" or TargetProcessCommandLine contains "👷🏽" or TargetProcessCommandLine contains "👷🏽‍♂️" or TargetProcessCommandLine contains "💂🏽‍♀️" or TargetProcessCommandLine contains "💂🏽" or TargetProcessCommandLine contains "💂🏽‍♂️" or TargetProcessCommandLine contains "🕵🏽‍♀️" or TargetProcessCommandLine contains "🕵🏽" or TargetProcessCommandLine contains "🕵🏽‍♂️" or TargetProcessCommandLine contains "👩🏽‍⚕️" or TargetProcessCommandLine contains "🧑🏽‍⚕️" or TargetProcessCommandLine contains "👨🏽‍⚕️" or TargetProcessCommandLine contains "👩🏽‍🌾" or TargetProcessCommandLine contains "🧑🏽‍🌾" or TargetProcessCommandLine contains "👨🏽‍🌾" or TargetProcessCommandLine contains "👩🏽‍🍳" or TargetProcessCommandLine contains "🧑🏽‍🍳" or TargetProcessCommandLine contains "👨🏽‍🍳" or TargetProcessCommandLine contains "👩🏽‍🎓" or TargetProcessCommandLine contains "🧑🏽‍🎓" or TargetProcessCommandLine contains "👨🏽‍🎓" or TargetProcessCommandLine contains "👩🏽‍🎤" or TargetProcessCommandLine contains "🧑🏽‍🎤" or TargetProcessCommandLine contains "👨🏽‍🎤" or TargetProcessCommandLine contains "👩🏽‍🏫" or TargetProcessCommandLine contains "🧑🏽‍🏫" or TargetProcessCommandLine contains "👨🏽‍🏫" or TargetProcessCommandLine contains "👩🏽‍🏭" or TargetProcessCommandLine contains "🧑🏽‍🏭" or TargetProcessCommandLine contains "👨🏽‍🏭" or TargetProcessCommandLine contains "👩🏽‍💻" or TargetProcessCommandLine contains "🧑🏽‍💻" or TargetProcessCommandLine contains "👨🏽‍💻" or TargetProcessCommandLine contains "👩🏽‍💼" or TargetProcessCommandLine contains "🧑🏽‍💼" or TargetProcessCommandLine contains "👨🏽‍💼" or TargetProcessCommandLine contains "👩🏽‍🔧" or TargetProcessCommandLine contains "🧑🏽‍🔧" or TargetProcessCommandLine contains "👨🏽‍🔧" or TargetProcessCommandLine contains "👩🏽‍🔬" or TargetProcessCommandLine contains "🧑🏽‍🔬" or TargetProcessCommandLine contains "👨🏽‍🔬" or TargetProcessCommandLine contains "👩🏽‍🎨" or TargetProcessCommandLine contains "🧑🏽‍🎨" or TargetProcessCommandLine contains "👨🏽‍🎨" or TargetProcessCommandLine contains "👩🏽‍🚒" or TargetProcessCommandLine contains "🧑🏽‍🚒" or TargetProcessCommandLine contains "👨🏽‍🚒" or TargetProcessCommandLine contains "👩🏽‍✈️" or TargetProcessCommandLine contains "🧑🏽‍✈️" or TargetProcessCommandLine contains "👨🏽‍✈️" or TargetProcessCommandLine contains "👩🏽‍🚀" or TargetProcessCommandLine contains "🧑🏽‍🚀" or TargetProcessCommandLine contains "👨🏽‍🚀" or TargetProcessCommandLine contains "👩🏽‍⚖️" or TargetProcessCommandLine contains "🧑🏽‍⚖️" or TargetProcessCommandLine contains "👨🏽‍⚖️" or TargetProcessCommandLine contains "👰🏽‍♀️" or TargetProcessCommandLine contains "👰🏽" or TargetProcessCommandLine contains "👰🏽‍♂️" or TargetProcessCommandLine contains "🤵🏽‍♀️" or TargetProcessCommandLine contains "🤵🏽" or TargetProcessCommandLine contains "🤵🏽‍♂️" or TargetProcessCommandLine contains "👸🏽" or TargetProcessCommandLine contains "🫅🏽" or TargetProcessCommandLine contains "🤴🏽" or TargetProcessCommandLine contains "🥷🏽" or TargetProcessCommandLine contains "🦸🏽‍♀️" or TargetProcessCommandLine contains "🦸🏽" or TargetProcessCommandLine contains "🦸🏽‍♂️" or TargetProcessCommandLine contains "🦹🏽‍♀️" or TargetProcessCommandLine contains "🦹🏽" or TargetProcessCommandLine contains "🦹🏽‍♂️" or TargetProcessCommandLine contains "🤶🏽" or TargetProcessCommandLine contains "🧑🏽‍🎄" or TargetProcessCommandLine contains "🎅🏽" or TargetProcessCommandLine contains "🧙🏽‍♀️" or TargetProcessCommandLine contains "🧙🏽" or TargetProcessCommandLine contains "🧙🏽‍♂️" or TargetProcessCommandLine contains "🧝🏽‍♀️" or TargetProcessCommandLine contains "🧝🏽" or TargetProcessCommandLine contains "🧝🏽‍♂️" or TargetProcessCommandLine contains "🧛🏽‍♀️" or TargetProcessCommandLine contains "🧛🏽" or TargetProcessCommandLine contains "🧛🏽‍♂️" or TargetProcessCommandLine contains "🧜🏽‍♀️" or TargetProcessCommandLine contains "🧜🏽" or TargetProcessCommandLine contains "🧜🏽‍♂️" or TargetProcessCommandLine contains "🧚🏽‍♀️" or TargetProcessCommandLine contains "🧚🏽" or TargetProcessCommandLine contains "🧚🏽‍♂️" or TargetProcessCommandLine contains "👼🏽" or TargetProcessCommandLine contains "🤰🏽" or TargetProcessCommandLine contains "🫄🏽" or TargetProcessCommandLine contains "🫃🏽" or TargetProcessCommandLine contains "🤱🏽" or TargetProcessCommandLine contains "👩🏽‍🍼" or TargetProcessCommandLine contains "🧑🏽‍🍼" or TargetProcessCommandLine contains "👨🏽‍🍼" or TargetProcessCommandLine contains "🙇🏽‍♀️" or TargetProcessCommandLine contains "🙇🏽" or TargetProcessCommandLine contains "🙇🏽‍♂️" or TargetProcessCommandLine contains "💁🏽‍♀️" or TargetProcessCommandLine contains "💁🏽" or TargetProcessCommandLine contains "💁🏽‍♂️" or TargetProcessCommandLine contains "🙅🏽‍♀️" or TargetProcessCommandLine contains "🙅🏽" or TargetProcessCommandLine contains "🙅🏽‍♂️" or TargetProcessCommandLine contains "🙆🏽‍♀️" or TargetProcessCommandLine contains "🙆🏽" or TargetProcessCommandLine contains "🙆🏽‍♂️" or TargetProcessCommandLine contains "🙋🏽‍♀️" or TargetProcessCommandLine contains "🙋🏽" or TargetProcessCommandLine contains "🙋🏽‍♂️" or TargetProcessCommandLine contains "🧏🏽‍♀️" or TargetProcessCommandLine contains "🧏🏽" or TargetProcessCommandLine contains "🧏🏽‍♂️" or TargetProcessCommandLine contains "🤦🏽‍♀️" or TargetProcessCommandLine contains "🤦🏽" or TargetProcessCommandLine contains "🤦🏽‍♂️" or TargetProcessCommandLine contains "🤷🏽‍♀️" or TargetProcessCommandLine contains "🤷🏽" or TargetProcessCommandLine contains "🤷🏽‍♂️" or TargetProcessCommandLine contains "🙎🏽‍♀️" or TargetProcessCommandLine contains "🙎🏽" or TargetProcessCommandLine contains "🙎🏽‍♂️" or TargetProcessCommandLine contains "🙍🏽‍♀️" or TargetProcessCommandLine contains "🙍🏽" or TargetProcessCommandLine contains "🙍🏽‍♂️" or TargetProcessCommandLine contains "💇🏽‍♀️" or TargetProcessCommandLine contains "💇🏽" or TargetProcessCommandLine contains "💇🏽‍♂️" or TargetProcessCommandLine contains "💆🏽‍♀️" or TargetProcessCommandLine contains "💆🏽" or TargetProcessCommandLine contains "💆🏽‍♂️" or TargetProcessCommandLine contains "🧖🏽‍♀️" or TargetProcessCommandLine contains "🧖🏽" or TargetProcessCommandLine contains "🧖🏽‍♂️" or TargetProcessCommandLine contains "💃🏽" or TargetProcessCommandLine contains "🕺🏽" or TargetProcessCommandLine contains "🕴🏽" or TargetProcessCommandLine contains "👩🏽‍🦽" or TargetProcessCommandLine contains "🧑🏽‍🦽" or TargetProcessCommandLine contains "👨🏽‍🦽" or TargetProcessCommandLine contains "👩🏽‍🦼" or TargetProcessCommandLine contains "🧑🏽‍🦼" or TargetProcessCommandLine contains "👨🏽‍🦼" or TargetProcessCommandLine contains "🚶🏽‍♀️" or TargetProcessCommandLine contains "🚶🏽" or TargetProcessCommandLine contains "🚶🏽‍♂️" or TargetProcessCommandLine contains "👩🏽‍🦯" or TargetProcessCommandLine contains "🧑🏽‍🦯" or TargetProcessCommandLine contains "👨🏽‍🦯" or TargetProcessCommandLine contains "🧎🏽‍♀️" or TargetProcessCommandLine contains "🧎🏽" or TargetProcessCommandLine contains "🧎🏽‍♂️" or TargetProcessCommandLine contains "🏃🏽‍♀️" or TargetProcessCommandLine contains "🏃🏽" or TargetProcessCommandLine contains "🏃🏽‍♂️" or TargetProcessCommandLine contains "🧍🏽‍♀️" or TargetProcessCommandLine contains "🧍🏽" or TargetProcessCommandLine contains "🧍🏽‍♂️" or TargetProcessCommandLine contains "👭🏽" or TargetProcessCommandLine contains "🧑🏽‍🤝‍🧑🏽" or TargetProcessCommandLine contains "👬🏽" or TargetProcessCommandLine contains "👫🏽" or TargetProcessCommandLine contains "🧗🏽‍♀️" or TargetProcessCommandLine contains "🧗🏽" or TargetProcessCommandLine contains "🧗🏽‍♂️" or TargetProcessCommandLine contains "🏇🏽" or TargetProcessCommandLine contains "🏂🏽" or TargetProcessCommandLine contains "🏌🏽‍♀️" or TargetProcessCommandLine contains "🏌🏽" or TargetProcessCommandLine contains "🏌🏽‍♂️" or TargetProcessCommandLine contains "🏄🏽‍♀️" or TargetProcessCommandLine contains "🏄🏽" or TargetProcessCommandLine contains "🏄🏽‍♂️" or TargetProcessCommandLine contains "🚣🏽‍♀️" or TargetProcessCommandLine contains "🚣🏽" or TargetProcessCommandLine contains "🚣🏽‍♂️" or TargetProcessCommandLine contains "🏊🏽‍♀️" or TargetProcessCommandLine contains "🏊🏽" or TargetProcessCommandLine contains "🏊🏽‍♂️" or TargetProcessCommandLine contains "⛹🏽‍♀️" or TargetProcessCommandLine contains "⛹🏽" or TargetProcessCommandLine contains "⛹🏽‍♂️" or TargetProcessCommandLine contains "🏋🏽‍♀️" or TargetProcessCommandLine contains "🏋🏽" or TargetProcessCommandLine contains "🏋🏽‍♂️" or TargetProcessCommandLine contains "🚴🏽‍♀️" or TargetProcessCommandLine contains "🚴🏽" or TargetProcessCommandLine contains "🚴🏽‍♂️" or TargetProcessCommandLine contains "🚵🏽‍♀️" or TargetProcessCommandLine contains "🚵🏽" or TargetProcessCommandLine contains "🚵🏽‍♂️" or TargetProcessCommandLine contains "🤸🏽‍♀️" or TargetProcessCommandLine contains "🤸🏽" or TargetProcessCommandLine contains "🤸🏽‍♂️" or TargetProcessCommandLine contains "🤽🏽‍♀️" or TargetProcessCommandLine contains "🤽🏽" or TargetProcessCommandLine contains "🤽🏽‍♂️" or TargetProcessCommandLine contains "🤾🏽‍♀️" or TargetProcessCommandLine contains "🤾🏽" or TargetProcessCommandLine contains "🤾🏽‍♂️" or TargetProcessCommandLine contains "🤹🏽‍♀️" or TargetProcessCommandLine contains "🤹🏽" or TargetProcessCommandLine contains "🤹🏽‍♂️" or TargetProcessCommandLine contains "🧘🏽‍♀️" or TargetProcessCommandLine contains "🧘🏽" or TargetProcessCommandLine contains "🧘🏽‍♂️" or TargetProcessCommandLine contains "🛀🏽" or TargetProcessCommandLine contains "🛌🏽" or TargetProcessCommandLine contains "👋🏾" or TargetProcessCommandLine contains "🤚🏾" or TargetProcessCommandLine contains "🖐🏾" or TargetProcessCommandLine contains "✋🏾" or TargetProcessCommandLine contains "🖖🏾" or TargetProcessCommandLine contains "👌🏾" or TargetProcessCommandLine contains "🤌🏾" or TargetProcessCommandLine contains "🤏🏾" or TargetProcessCommandLine contains "✌🏾" or TargetProcessCommandLine contains "🤞🏾" or TargetProcessCommandLine contains "🫰🏾" or TargetProcessCommandLine contains "🤟🏾" or TargetProcessCommandLine contains "🤘🏾" or TargetProcessCommandLine contains "🤙🏾" or TargetProcessCommandLine contains "🫵🏾" or TargetProcessCommandLine contains "🫱🏾" or TargetProcessCommandLine contains "🫲🏾" or TargetProcessCommandLine contains "🫳🏾" or TargetProcessCommandLine contains "🫴🏾" or TargetProcessCommandLine contains "👈🏾" or TargetProcessCommandLine contains "👉🏾" or TargetProcessCommandLine contains "👆🏾" or TargetProcessCommandLine contains "🖕🏾" or TargetProcessCommandLine contains "👇🏾" or TargetProcessCommandLine contains "☝🏾" or TargetProcessCommandLine contains "👍🏾" or TargetProcessCommandLine contains "👎🏾" or TargetProcessCommandLine contains "✊🏾" or TargetProcessCommandLine contains "👊🏾" or TargetProcessCommandLine contains "🤛🏾" or TargetProcessCommandLine contains "🤜🏾" or TargetProcessCommandLine contains "👏🏾" or TargetProcessCommandLine contains "🫶🏾" or TargetProcessCommandLine contains "🙌🏾" or TargetProcessCommandLine contains "👐🏾" or TargetProcessCommandLine contains "🤲🏾" or TargetProcessCommandLine contains "🙏🏾" or TargetProcessCommandLine contains "✍🏾" or TargetProcessCommandLine contains "💪🏾" or TargetProcessCommandLine contains "🦵🏾" or TargetProcessCommandLine contains "🦶🏾" or TargetProcessCommandLine contains "👂🏾" or TargetProcessCommandLine contains "🦻🏾" or TargetProcessCommandLine contains "👃🏾" or TargetProcessCommandLine contains "👶🏾" or TargetProcessCommandLine contains "👧🏾" or TargetProcessCommandLine contains "🧒🏾" or TargetProcessCommandLine contains "👦🏾" or TargetProcessCommandLine contains "👩🏾" or TargetProcessCommandLine contains "🧑🏾" or TargetProcessCommandLine contains "👨🏾" or TargetProcessCommandLine contains "👩🏾‍🦱" or TargetProcessCommandLine contains "🧑🏾‍🦱" or TargetProcessCommandLine contains "👨🏾‍🦱" or TargetProcessCommandLine contains "👩🏾‍🦰" or TargetProcessCommandLine contains "🧑🏾‍🦰" or TargetProcessCommandLine contains "👨🏾‍🦰" or TargetProcessCommandLine contains "👱🏾‍♀️" or TargetProcessCommandLine contains "👱🏾" or TargetProcessCommandLine contains "👱🏾‍♂️" or TargetProcessCommandLine contains "👩🏾‍🦳" or TargetProcessCommandLine contains "🧑🏾‍🦳" or TargetProcessCommandLine contains "👨🏾‍🦳" or TargetProcessCommandLine contains "👩🏾‍🦲" or TargetProcessCommandLine contains "🧑🏾‍🦲" or TargetProcessCommandLine contains "👨🏾‍🦲" or TargetProcessCommandLine contains "🧔🏾‍♀️" or TargetProcessCommandLine contains "🧔🏾" or TargetProcessCommandLine contains "🧔🏾‍♂️" or TargetProcessCommandLine contains "👵🏾" or TargetProcessCommandLine contains "🧓🏾" or TargetProcessCommandLine contains "👴🏾" or TargetProcessCommandLine contains "👲🏾" or TargetProcessCommandLine contains "👳🏾‍♀️" or TargetProcessCommandLine contains "👳🏾" or TargetProcessCommandLine contains "👳🏾‍♂️" or TargetProcessCommandLine contains "🧕🏾" or TargetProcessCommandLine contains "👮🏾‍♀️" or TargetProcessCommandLine contains "👮🏾" or TargetProcessCommandLine contains "👮🏾‍♂️" or TargetProcessCommandLine contains "👷🏾‍♀️" or TargetProcessCommandLine contains "👷🏾" or TargetProcessCommandLine contains "👷🏾‍♂️" or TargetProcessCommandLine contains "💂🏾‍♀️" or TargetProcessCommandLine contains "💂🏾" or TargetProcessCommandLine contains "💂🏾‍♂️" or TargetProcessCommandLine contains "🕵🏾‍♀️" or TargetProcessCommandLine contains "🕵🏾" or TargetProcessCommandLine contains "🕵🏾‍♂️" or TargetProcessCommandLine contains "👩🏾‍⚕️" or TargetProcessCommandLine contains "🧑🏾‍⚕️" or TargetProcessCommandLine contains "👨🏾‍⚕️" or TargetProcessCommandLine contains "👩🏾‍🌾" or TargetProcessCommandLine contains "🧑🏾‍🌾" or TargetProcessCommandLine contains "👨🏾‍🌾" or TargetProcessCommandLine contains "👩🏾‍🍳" or TargetProcessCommandLine contains "🧑🏾‍🍳" or TargetProcessCommandLine contains "👨🏾‍🍳" or TargetProcessCommandLine contains "👩🏾‍🎓" or TargetProcessCommandLine contains "🧑🏾‍🎓" or TargetProcessCommandLine contains "👨🏾‍🎓" or TargetProcessCommandLine contains "👩🏾‍🎤" or TargetProcessCommandLine contains "🧑🏾‍🎤" or TargetProcessCommandLine contains "👨🏾‍🎤" or TargetProcessCommandLine contains "👩🏾‍🏫" or TargetProcessCommandLine contains "🧑🏾‍🏫" or TargetProcessCommandLine contains "👨🏾‍🏫" or TargetProcessCommandLine contains "👩🏾‍🏭" or TargetProcessCommandLine contains "🧑🏾‍🏭" or TargetProcessCommandLine contains "👨🏾‍🏭" or TargetProcessCommandLine contains "👩🏾‍💻" or TargetProcessCommandLine contains "🧑🏾‍💻" or TargetProcessCommandLine contains "👨🏾‍💻" or TargetProcessCommandLine contains "👩🏾‍💼" or TargetProcessCommandLine contains "🧑🏾‍💼" or TargetProcessCommandLine contains "👨🏾‍💼" or TargetProcessCommandLine contains "👩🏾‍🔧" or TargetProcessCommandLine contains "🧑🏾‍🔧" or TargetProcessCommandLine contains "👨🏾‍🔧" or TargetProcessCommandLine contains "👩🏾‍🔬" or TargetProcessCommandLine contains "🧑🏾‍🔬" or TargetProcessCommandLine contains "👨🏾‍🔬" or TargetProcessCommandLine contains "👩🏾‍🎨" or TargetProcessCommandLine contains "🧑🏾‍🎨" or TargetProcessCommandLine contains "👨🏾‍🎨" or TargetProcessCommandLine contains "👩🏾‍🚒" or TargetProcessCommandLine contains "🧑🏾‍🚒" or TargetProcessCommandLine contains "👨🏾‍🚒" or TargetProcessCommandLine contains "👩🏾‍✈️" or TargetProcessCommandLine contains "🧑🏾‍✈️" or TargetProcessCommandLine contains "👨🏾‍✈️" or TargetProcessCommandLine contains "👩🏾‍🚀" or TargetProcessCommandLine contains "🧑🏾‍🚀" or TargetProcessCommandLine contains "👨🏾‍🚀" or TargetProcessCommandLine contains "👩🏾‍⚖️" or TargetProcessCommandLine contains "🧑🏾‍⚖️" or TargetProcessCommandLine contains "👨🏾‍⚖️" or TargetProcessCommandLine contains "👰🏾‍♀️" or TargetProcessCommandLine contains "👰🏾" or TargetProcessCommandLine contains "👰🏾‍♂️" or TargetProcessCommandLine contains "🤵🏾‍♀️" or TargetProcessCommandLine contains "🤵🏾" or TargetProcessCommandLine contains "🤵🏾‍♂️" or TargetProcessCommandLine contains "👸🏾" or TargetProcessCommandLine contains "🫅🏾" or TargetProcessCommandLine contains "🤴🏾" or TargetProcessCommandLine contains "🥷🏾" or TargetProcessCommandLine contains "🦸🏾‍♀️" or TargetProcessCommandLine contains "🦸🏾" or TargetProcessCommandLine contains "🦸🏾‍♂️" or TargetProcessCommandLine contains "🦹🏾‍♀️" or TargetProcessCommandLine contains "🦹🏾" or TargetProcessCommandLine contains "🦹🏾‍♂️" or TargetProcessCommandLine contains "🤶🏾" or TargetProcessCommandLine contains "🧑🏾‍🎄" or TargetProcessCommandLine contains "🎅🏾" or TargetProcessCommandLine contains "🧙🏾‍♀️" or TargetProcessCommandLine contains "🧙🏾" or TargetProcessCommandLine contains "🧙🏾‍♂️" or TargetProcessCommandLine contains "🧝🏾‍♀️" or TargetProcessCommandLine contains "🧝🏾" or TargetProcessCommandLine contains "🧝🏾‍♂️" or TargetProcessCommandLine contains "🧛🏾‍♀️" or TargetProcessCommandLine contains "🧛🏾" or TargetProcessCommandLine contains "🧛🏾‍♂️" or TargetProcessCommandLine contains "🧜🏾‍♀️" or TargetProcessCommandLine contains "🧜🏾" or TargetProcessCommandLine contains "🧜🏾‍♂️" or TargetProcessCommandLine contains "🧚🏾‍♀️" or TargetProcessCommandLine contains "🧚🏾" or TargetProcessCommandLine contains "🧚🏾‍♂️" or TargetProcessCommandLine contains "👼🏾" or TargetProcessCommandLine contains "🤰🏾" or TargetProcessCommandLine contains "🫄🏾" or TargetProcessCommandLine contains "🫃🏾" or TargetProcessCommandLine contains "🤱🏾" or TargetProcessCommandLine contains "👩🏾‍🍼" or TargetProcessCommandLine contains "🧑🏾‍🍼" or TargetProcessCommandLine contains "👨🏾‍🍼" or TargetProcessCommandLine contains "🙇🏾‍♀️" or TargetProcessCommandLine contains "🙇🏾" or TargetProcessCommandLine contains "🙇🏾‍♂️" or TargetProcessCommandLine contains "💁🏾‍♀️" or TargetProcessCommandLine contains "💁🏾" or TargetProcessCommandLine contains "💁🏾‍♂️" or TargetProcessCommandLine contains "🙅🏾‍♀️" or TargetProcessCommandLine contains "🙅🏾" or TargetProcessCommandLine contains "🙅🏾‍♂️" or TargetProcessCommandLine contains "🙆🏾‍♀️" or TargetProcessCommandLine contains "🙆🏾" or TargetProcessCommandLine contains "🙆🏾‍♂️" or TargetProcessCommandLine contains "🙋🏾‍♀️" or TargetProcessCommandLine contains "🙋🏾" or TargetProcessCommandLine contains "🙋🏾‍♂️" or TargetProcessCommandLine contains "🧏🏾‍♀️" or TargetProcessCommandLine contains "🧏🏾" or TargetProcessCommandLine contains "🧏🏾‍♂️" or TargetProcessCommandLine contains "🤦🏾‍♀️" or TargetProcessCommandLine contains "🤦🏾" or TargetProcessCommandLine contains "🤦🏾‍♂️" or TargetProcessCommandLine contains "🤷🏾‍♀️" or TargetProcessCommandLine contains "🤷🏾" or TargetProcessCommandLine contains "🤷🏾‍♂️" or TargetProcessCommandLine contains "🙎🏾‍♀️" or TargetProcessCommandLine contains "🙎🏾" or TargetProcessCommandLine contains "🙎🏾‍♂️" or TargetProcessCommandLine contains "🙍🏾‍♀️" or TargetProcessCommandLine contains "🙍🏾" or TargetProcessCommandLine contains "🙍🏾‍♂️" or TargetProcessCommandLine contains "💇🏾‍♀️" or TargetProcessCommandLine contains "💇🏾" or TargetProcessCommandLine contains "💇🏾‍♂️" or TargetProcessCommandLine contains "💆🏾‍♀️" or TargetProcessCommandLine contains "💆🏾" or TargetProcessCommandLine contains "💆🏾‍♂️" or TargetProcessCommandLine contains "🧖🏾‍♀️" or TargetProcessCommandLine contains "🧖🏾" or TargetProcessCommandLine contains "🧖🏾‍♂️" or TargetProcessCommandLine contains "💃🏾" or TargetProcessCommandLine contains "🕺🏾" or TargetProcessCommandLine contains "👩🏾‍🦽" or TargetProcessCommandLine contains "🧑🏾‍🦽" or TargetProcessCommandLine contains "👨🏾‍🦽" or TargetProcessCommandLine contains "👩🏾‍🦼" or TargetProcessCommandLine contains "🧑🏾‍🦼" or TargetProcessCommandLine contains "👨🏾‍🦼" or TargetProcessCommandLine contains "🚶🏾‍♀️" or TargetProcessCommandLine contains "🚶🏾" or TargetProcessCommandLine contains "🚶🏾‍♂️" or TargetProcessCommandLine contains "👩🏾‍🦯" or TargetProcessCommandLine contains "🧑🏾‍🦯" or TargetProcessCommandLine contains "👨🏾‍🦯" or TargetProcessCommandLine contains "🧎🏾‍♀️" or TargetProcessCommandLine contains "🧎🏾" or TargetProcessCommandLine contains "🧎🏾‍♂️" or TargetProcessCommandLine contains "🏃🏾‍♀️" or TargetProcessCommandLine contains "🏃🏾" or TargetProcessCommandLine contains "🏃🏾‍♂️" or TargetProcessCommandLine contains "🧍🏾‍♀️" or TargetProcessCommandLine contains "🧍🏾" or TargetProcessCommandLine contains "🧍🏾‍♂️" or TargetProcessCommandLine contains "👭🏾" or TargetProcessCommandLine contains "🧑🏾‍🤝‍🧑🏾" or TargetProcessCommandLine contains "👬🏾" or TargetProcessCommandLine contains "👫🏾" or TargetProcessCommandLine contains "🧗🏾‍♀️" or TargetProcessCommandLine contains "🧗🏾" or TargetProcessCommandLine contains "🧗🏾‍♂️" or TargetProcessCommandLine contains "🏇🏾" or TargetProcessCommandLine contains "🏂🏾" or TargetProcessCommandLine contains "🏌🏾‍♀️" or TargetProcessCommandLine contains "🏌🏾" or TargetProcessCommandLine contains "🏌🏾‍♂️" or TargetProcessCommandLine contains "🏄🏾‍♀️" or TargetProcessCommandLine contains "🏄🏾" or TargetProcessCommandLine contains "🏄🏾‍♂️" or TargetProcessCommandLine contains "🚣🏾‍♀️" or TargetProcessCommandLine contains "🚣🏾" or TargetProcessCommandLine contains "🚣🏾‍♂️" or TargetProcessCommandLine contains "🏊🏾‍♀️" or TargetProcessCommandLine contains "🏊🏾" or TargetProcessCommandLine contains "🏊🏾‍♂️" or TargetProcessCommandLine contains "⛹🏾‍♀️" or TargetProcessCommandLine contains "⛹🏾" or TargetProcessCommandLine contains "⛹🏾‍♂️" or TargetProcessCommandLine contains "🏋🏾‍♀️" or TargetProcessCommandLine contains "🏋🏾" or TargetProcessCommandLine contains "🏋🏾‍♂️" or TargetProcessCommandLine contains "🚴🏾‍♀️" or TargetProcessCommandLine contains "🚴🏾" or TargetProcessCommandLine contains "🚴🏾‍♂️" or TargetProcessCommandLine contains "🚵🏾‍♀️" or TargetProcessCommandLine contains "🚵🏾" or TargetProcessCommandLine contains "🚵🏾‍♂️" or TargetProcessCommandLine contains "🤸🏾‍♀️" or TargetProcessCommandLine contains "🤸🏾" or TargetProcessCommandLine contains "🤸🏾‍♂️" or TargetProcessCommandLine contains "🤽🏾‍♀️" or TargetProcessCommandLine contains "🤽🏾" or TargetProcessCommandLine contains "🤽🏾‍♂️" or TargetProcessCommandLine contains "🤾🏾‍♀️" or TargetProcessCommandLine contains "🤾🏾" or TargetProcessCommandLine contains "🤾🏾‍♂️" or TargetProcessCommandLine contains "🤹🏾‍♀️" or TargetProcessCommandLine contains "🤹🏾" or TargetProcessCommandLine contains "🤹🏾‍♂️" or TargetProcessCommandLine contains "🧘🏾‍♀️" or TargetProcessCommandLine contains "🧘🏾" or TargetProcessCommandLine contains "🧘🏾‍♂️" or TargetProcessCommandLine contains "🛀🏾" or TargetProcessCommandLine contains "🛌🏾" or TargetProcessCommandLine contains "👋🏿" or TargetProcessCommandLine contains "🤚🏿" or TargetProcessCommandLine contains "🖐🏿" or TargetProcessCommandLine contains "✋🏿" or TargetProcessCommandLine contains "🖖🏿" or TargetProcessCommandLine contains "👌🏿" or TargetProcessCommandLine contains "🤌🏿" or TargetProcessCommandLine contains "🤏🏿" or TargetProcessCommandLine contains "✌🏿" or TargetProcessCommandLine contains "🤞🏿" or TargetProcessCommandLine contains "🫰🏿" or TargetProcessCommandLine contains "🤟🏿" or TargetProcessCommandLine contains "🤘🏿" or TargetProcessCommandLine contains "🤙🏿" or TargetProcessCommandLine contains "🫵🏿" or TargetProcessCommandLine contains "🫱🏿" or TargetProcessCommandLine contains "🫲🏿" or TargetProcessCommandLine contains "🫳🏿" or TargetProcessCommandLine contains "🫴🏿" or TargetProcessCommandLine contains "👈🏿" or TargetProcessCommandLine contains "👉🏿" or TargetProcessCommandLine contains "👆🏿" or TargetProcessCommandLine contains "🖕🏿" or TargetProcessCommandLine contains "👇🏿" or TargetProcessCommandLine contains "☝🏿" or TargetProcessCommandLine contains "👍🏿" or TargetProcessCommandLine contains "👎🏿" or TargetProcessCommandLine contains "✊🏿" or TargetProcessCommandLine contains "👊🏿" or TargetProcessCommandLine contains "🤛🏿" or TargetProcessCommandLine contains "🤜🏿" or TargetProcessCommandLine contains "👏🏿" or TargetProcessCommandLine contains "🫶🏿" or TargetProcessCommandLine contains "🙌🏿" or TargetProcessCommandLine contains "👐🏿" or TargetProcessCommandLine contains "🤲🏿" or TargetProcessCommandLine contains "🙏🏿" or TargetProcessCommandLine contains "✍🏿" or TargetProcessCommandLine contains "🤳🏿" or TargetProcessCommandLine contains "💪🏿" or TargetProcessCommandLine contains "🦵🏿" or TargetProcessCommandLine contains "🦶🏿" or TargetProcessCommandLine contains "👂🏿" or TargetProcessCommandLine contains "🦻🏿" or TargetProcessCommandLine contains "👃🏿" or TargetProcessCommandLine contains "👶🏿" or TargetProcessCommandLine contains "👧🏿" or TargetProcessCommandLine contains "🧒🏿" or TargetProcessCommandLine contains "👦🏿" or TargetProcessCommandLine contains "👩🏿" or TargetProcessCommandLine contains "🧑🏿" or TargetProcessCommandLine contains "👨🏿" or TargetProcessCommandLine contains "👩🏿‍🦱" or TargetProcessCommandLine contains "🧑🏿‍🦱" or TargetProcessCommandLine contains "👨🏿‍🦱" or TargetProcessCommandLine contains "👩🏿‍🦰" or TargetProcessCommandLine contains "🧑🏿‍🦰" or TargetProcessCommandLine contains "👨🏿‍🦰" or TargetProcessCommandLine contains "👱🏿‍♀️" or TargetProcessCommandLine contains "👱🏿" or TargetProcessCommandLine contains "👱🏿‍♂️" or TargetProcessCommandLine contains "👩🏿‍🦳" or TargetProcessCommandLine contains "🧑🏿‍🦳" or TargetProcessCommandLine contains "👨🏿‍🦳" or TargetProcessCommandLine contains "👩🏿‍🦲" or TargetProcessCommandLine contains "🧑🏿‍🦲" or TargetProcessCommandLine contains "👨🏿‍🦲" or TargetProcessCommandLine contains "🧔🏿‍♀️" or TargetProcessCommandLine contains "🧔🏿" or TargetProcessCommandLine contains "🧔🏿‍♂️" or TargetProcessCommandLine contains "👵🏿" or TargetProcessCommandLine contains "🧓🏿" or TargetProcessCommandLine contains "👴🏿" or TargetProcessCommandLine contains "👲🏿" or TargetProcessCommandLine contains "👳🏿‍♀️" or TargetProcessCommandLine contains "👳🏿" or TargetProcessCommandLine contains "👳🏿‍♂️" or TargetProcessCommandLine contains "🧕🏿" or TargetProcessCommandLine contains "👮🏿‍♀️" or TargetProcessCommandLine contains "👮🏿" or TargetProcessCommandLine contains "👮🏿‍♂️" or TargetProcessCommandLine contains "👷🏿‍♀️" or TargetProcessCommandLine contains "👷🏿" or TargetProcessCommandLine contains "👷🏿‍♂️" or TargetProcessCommandLine contains "💂🏿‍♀️" or TargetProcessCommandLine contains "💂🏿" or TargetProcessCommandLine contains "💂🏿‍♂️" or TargetProcessCommandLine contains "🕵🏿‍♀️" or TargetProcessCommandLine contains "🕵🏿" or TargetProcessCommandLine contains "🕵🏿‍♂️" or TargetProcessCommandLine contains "👩🏿‍⚕️" or TargetProcessCommandLine contains "🧑🏿‍⚕️" or TargetProcessCommandLine contains "👨🏿‍⚕️" or TargetProcessCommandLine contains "👩🏿‍🌾" or TargetProcessCommandLine contains "🧑🏿‍🌾" or TargetProcessCommandLine contains "👨🏿‍🌾" or TargetProcessCommandLine contains "👩🏿‍🍳" or TargetProcessCommandLine contains "🧑🏿‍🍳" or TargetProcessCommandLine contains "👨🏿‍🍳" or TargetProcessCommandLine contains "👩🏿‍🎓" or TargetProcessCommandLine contains "🧑🏿‍🎓" or TargetProcessCommandLine contains "👨🏿‍🎓" or TargetProcessCommandLine contains "👩🏿‍🎤" or TargetProcessCommandLine contains "🧑🏿‍🎤" or TargetProcessCommandLine contains "👨🏿‍🎤" or TargetProcessCommandLine contains "👩🏿‍🏫" or TargetProcessCommandLine contains "🧑🏿‍🏫" or TargetProcessCommandLine contains "👨🏿‍🏫" or TargetProcessCommandLine contains "👩🏿‍🏭" or TargetProcessCommandLine contains "🧑🏿‍🏭" or TargetProcessCommandLine contains "👨🏿‍🏭" or TargetProcessCommandLine contains "👩🏿‍💻" or TargetProcessCommandLine contains "🧑🏿‍💻" or TargetProcessCommandLine contains "👨🏿‍💻" or TargetProcessCommandLine contains "👩🏿‍💼" or TargetProcessCommandLine contains "🧑🏿‍💼" or TargetProcessCommandLine contains "👨🏿‍💼" or TargetProcessCommandLine contains "👩🏿‍🔧" or TargetProcessCommandLine contains "🧑🏿‍🔧" or TargetProcessCommandLine contains "👨🏿‍🔧" or TargetProcessCommandLine contains "👩🏿‍🔬" or TargetProcessCommandLine contains "🧑🏿‍🔬" or TargetProcessCommandLine contains "👨🏿‍🔬" or TargetProcessCommandLine contains "👩🏿‍🎨" or TargetProcessCommandLine contains "🧑🏿‍🎨" or TargetProcessCommandLine contains "👨🏿‍🎨" or TargetProcessCommandLine contains "👩🏿‍🚒" or TargetProcessCommandLine contains "🧑🏿‍🚒" or TargetProcessCommandLine contains "👨🏿‍🚒" or TargetProcessCommandLine contains "👩🏿‍✈️" or TargetProcessCommandLine contains "🧑🏿‍✈️" or TargetProcessCommandLine contains "👨🏿‍✈️" or TargetProcessCommandLine contains "👩🏿‍🚀" or TargetProcessCommandLine contains "🧑🏿‍🚀" or TargetProcessCommandLine contains "👨🏿‍🚀" or TargetProcessCommandLine contains "👩🏿‍⚖️" or TargetProcessCommandLine contains "🧑🏿‍⚖️" or TargetProcessCommandLine contains "👨🏿‍⚖️" or TargetProcessCommandLine contains "👰🏿‍♀️" or TargetProcessCommandLine contains "👰🏿" or TargetProcessCommandLine contains "👰🏿‍♂️" or TargetProcessCommandLine contains "🤵🏿‍♀️" or TargetProcessCommandLine contains "🤵🏿" or TargetProcessCommandLine contains "🤵🏿‍♂️" or TargetProcessCommandLine contains "👸🏿" or TargetProcessCommandLine contains "🫅🏿" or TargetProcessCommandLine contains "🤴🏿" or TargetProcessCommandLine contains "🥷🏿" or TargetProcessCommandLine contains "🦸🏿‍♀️" or TargetProcessCommandLine contains "🦸🏿" or TargetProcessCommandLine contains "🦸🏿‍♂️" or TargetProcessCommandLine contains "🦹🏿‍♀️" or TargetProcessCommandLine contains "🦹🏿" or TargetProcessCommandLine contains "🦹🏿‍♂️" or TargetProcessCommandLine contains "🤶🏿" or TargetProcessCommandLine contains "🧑🏿‍🎄" or TargetProcessCommandLine contains "🎅🏿" or TargetProcessCommandLine contains "🧙🏿‍♀️" or TargetProcessCommandLine contains "🧙🏿" or TargetProcessCommandLine contains "🧙🏿‍♂️" or TargetProcessCommandLine contains "🧝🏿‍♀️" or TargetProcessCommandLine contains "🧝🏿" or TargetProcessCommandLine contains "🧝🏿‍♂️" or TargetProcessCommandLine contains "🧛🏿‍♀️" or TargetProcessCommandLine contains "🧛🏿" or TargetProcessCommandLine contains "🧛🏿‍♂️" or TargetProcessCommandLine contains "🧜🏿‍♀️" or TargetProcessCommandLine contains "🧜🏿" or TargetProcessCommandLine contains "🧜🏿‍♂️" or TargetProcessCommandLine contains "🧚🏿‍♀️" or TargetProcessCommandLine contains "🧚🏿" or TargetProcessCommandLine contains "🧚🏿‍♂️" or TargetProcessCommandLine contains "👼🏿" or TargetProcessCommandLine contains "🤰🏿" or TargetProcessCommandLine contains "🫄🏿" or TargetProcessCommandLine contains "🫃🏿" or TargetProcessCommandLine contains "🤱🏿" or TargetProcessCommandLine contains "👩🏿‍🍼" or TargetProcessCommandLine contains "🧑🏿‍🍼" or TargetProcessCommandLine contains "👨🏿‍🍼" or TargetProcessCommandLine contains "🙇🏿‍♀️" or TargetProcessCommandLine contains "🙇🏿" or TargetProcessCommandLine contains "🙇🏿‍♂️" or TargetProcessCommandLine contains "💁🏿‍♀️" or TargetProcessCommandLine contains "💁🏿" or TargetProcessCommandLine contains "💁🏿‍♂️" or TargetProcessCommandLine contains "🙅🏿‍♀️" or TargetProcessCommandLine contains "🙅🏿" or TargetProcessCommandLine contains "🙅🏿‍♂️" or TargetProcessCommandLine contains "🙆🏿‍♀️" or TargetProcessCommandLine contains "🙆🏿" or TargetProcessCommandLine contains "🙆🏿‍♂️" or TargetProcessCommandLine contains "🙋🏿‍♀️" or TargetProcessCommandLine contains "🙋🏿" or TargetProcessCommandLine contains "🙋🏿‍♂️" or TargetProcessCommandLine contains "🧏🏿‍♀️" or TargetProcessCommandLine contains "🧏🏿" or TargetProcessCommandLine contains "🧏🏿‍♂️" or TargetProcessCommandLine contains "🤦🏿‍♀️" or TargetProcessCommandLine contains "🤦🏿" or TargetProcessCommandLine contains "🤦🏿‍♂️" or TargetProcessCommandLine contains "🤷🏿‍♀️" or TargetProcessCommandLine contains "🤷🏿" or TargetProcessCommandLine contains "🤷🏿‍♂️" or TargetProcessCommandLine contains "🙎🏿‍♀️" or TargetProcessCommandLine contains "🙎🏿" or TargetProcessCommandLine contains "🙎🏿‍♂️" or TargetProcessCommandLine contains "🙍🏿‍♀️" or TargetProcessCommandLine contains "🙍🏿" or TargetProcessCommandLine contains "🙍🏿‍♂️" or TargetProcessCommandLine contains "💇🏿‍♀️" or TargetProcessCommandLine contains "💇🏿" or TargetProcessCommandLine contains "💇🏿‍♂️" or TargetProcessCommandLine contains "💆🏿‍♀️" or TargetProcessCommandLine contains "💆🏿" or TargetProcessCommandLine contains "💆🏿‍♂️" or TargetProcessCommandLine contains "🧖🏿‍♀️" or TargetProcessCommandLine contains "🧖🏿" or TargetProcessCommandLine contains "🧖🏿‍♂️" or TargetProcessCommandLine contains "💃🏿" or TargetProcessCommandLine contains "🕺🏿" or TargetProcessCommandLine contains "🕴🏿" or TargetProcessCommandLine contains "👩🏿‍🦽" or TargetProcessCommandLine contains "🧑🏿‍🦽" or TargetProcessCommandLine contains "👨🏿‍🦽" or TargetProcessCommandLine contains "👩🏿‍🦼" or TargetProcessCommandLine contains "🧑🏿‍🦼" or TargetProcessCommandLine contains "👨🏿‍🦼" or TargetProcessCommandLine contains "🚶🏿‍♀️" or TargetProcessCommandLine contains "🚶🏿" or TargetProcessCommandLine contains "🚶🏿‍♂️" or TargetProcessCommandLine contains "👩🏿‍🦯" or TargetProcessCommandLine contains "🧑🏿‍🦯" or TargetProcessCommandLine contains "👨🏿‍🦯" or TargetProcessCommandLine contains "🧎🏿‍♀️" or TargetProcessCommandLine contains "🧎🏿" or TargetProcessCommandLine contains "🧎🏿‍♂️" or TargetProcessCommandLine contains "🏃🏿‍♀️" or TargetProcessCommandLine contains "🏃🏿" or TargetProcessCommandLine contains "🏃🏿‍♂️" or TargetProcessCommandLine contains "🧍🏿‍♀️" or TargetProcessCommandLine contains "🧍🏿" or TargetProcessCommandLine contains "🧍🏿‍♂️" or TargetProcessCommandLine contains "👭🏿" or TargetProcessCommandLine contains "🧑🏿‍🤝‍🧑🏿" or TargetProcessCommandLine contains "👬🏿" or TargetProcessCommandLine contains "👫🏿" or TargetProcessCommandLine contains "🧗🏿‍♀️" or TargetProcessCommandLine contains "🧗🏿" or TargetProcessCommandLine contains "🧗🏿‍♂️" or TargetProcessCommandLine contains "🏇🏿" or TargetProcessCommandLine contains "🏂🏿" or TargetProcessCommandLine contains "🏌🏿‍♀️" or TargetProcessCommandLine contains "🏌🏿" or TargetProcessCommandLine contains "🏌🏿‍♂️" or TargetProcessCommandLine contains "🏄🏿‍♀️" or TargetProcessCommandLine contains "🏄🏿" or TargetProcessCommandLine contains "🏄🏿‍♂️" or TargetProcessCommandLine contains "🚣🏿‍♀️" or TargetProcessCommandLine contains "🚣🏿" or TargetProcessCommandLine contains "🚣🏿‍♂️" or TargetProcessCommandLine contains "🏊🏿‍♀️" or TargetProcessCommandLine contains "🏊🏿" or TargetProcessCommandLine contains "🏊🏿‍♂️" or TargetProcessCommandLine contains "⛹🏿‍♀️" or TargetProcessCommandLine contains "⛹🏿" or TargetProcessCommandLine contains "⛹🏿‍♂️" or TargetProcessCommandLine contains "🏋🏿‍♀️" or TargetProcessCommandLine contains "🏋🏿" or TargetProcessCommandLine contains "🏋🏿‍♂️" or TargetProcessCommandLine contains "🚴🏿‍♀️" or TargetProcessCommandLine contains "🚴🏿" or TargetProcessCommandLine contains "🚴🏿‍♂️" or TargetProcessCommandLine contains "🚵🏿‍♀️" or TargetProcessCommandLine contains "🚵🏿" or TargetProcessCommandLine contains "🚵🏿‍♂️" or TargetProcessCommandLine contains "🤸🏿‍♀️" or TargetProcessCommandLine contains "🤸🏿" or TargetProcessCommandLine contains "🤸🏿‍♂️" or TargetProcessCommandLine contains "🤽🏿‍♀️" or TargetProcessCommandLine contains "🤽🏿" or TargetProcessCommandLine contains "🤽🏿‍♂️" or TargetProcessCommandLine contains "🤾🏿‍♀️" or TargetProcessCommandLine contains "🤾🏿" or TargetProcessCommandLine contains "🤾🏿‍♂️" or TargetProcessCommandLine contains "🤹🏿‍♀️" or TargetProcessCommandLine contains "🤹🏿" or TargetProcessCommandLine contains "🤹🏿‍♂️" or TargetProcessCommandLine contains "🧘🏿‍♀️" or TargetProcessCommandLine contains "🧘🏿" or TargetProcessCommandLine contains "🧘🏿‍♂️" or TargetProcessCommandLine contains "🛀🏿" or TargetProcessCommandLine contains "🛌🏿" or TargetProcessCommandLine contains "🐶" or TargetProcessCommandLine contains "🐱" or TargetProcessCommandLine contains "🐭" or TargetProcessCommandLine contains "🐹" or TargetProcessCommandLine contains "🐰" or TargetProcessCommandLine contains "🦊" or TargetProcessCommandLine contains "🐻" or TargetProcessCommandLine contains "🐼" or TargetProcessCommandLine contains "🐻‍❄️" or TargetProcessCommandLine contains "🐨" or TargetProcessCommandLine contains "🐯" or TargetProcessCommandLine contains "🦁" or TargetProcessCommandLine contains "🐮" or TargetProcessCommandLine contains "🐷" or TargetProcessCommandLine contains "🐽" or TargetProcessCommandLine contains "🐸" or TargetProcessCommandLine contains "🐵" or TargetProcessCommandLine contains "🙈" or TargetProcessCommandLine contains "🙉" or TargetProcessCommandLine contains "🙊" or TargetProcessCommandLine contains "🐒" or TargetProcessCommandLine contains "🐔" or TargetProcessCommandLine contains "🐧" or TargetProcessCommandLine contains "🐦" or TargetProcessCommandLine contains "🐤" or TargetProcessCommandLine contains "🐣" or TargetProcessCommandLine contains "🐥"

Required Data Sources

False Positive Guidance

• Unknown

References

• Internal Research
• SigmaHQ Rule