Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 3

Severity: high
Author: @Kostastsale, TheDFIRReport
Source: upstream

Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.

Event coverage

Provider	Event ID	Title
Sysmon	1	Process creation
Security-Auditing	4688	A new process has been created.

Stages and Predicates

Stage 1: `selection`

or:
CommandLine|contains: '#️⃣'
CommandLine|contains: '*️⃣'
CommandLine|contains: '0️⃣'
CommandLine|contains: '1️⃣'
CommandLine|contains: '2️⃣'
CommandLine|contains: '3️⃣'
CommandLine|contains: '4️⃣'
CommandLine|contains: '5️⃣'
CommandLine|contains: '6️⃣'
CommandLine|contains: '7️⃣'
CommandLine|contains: '8️⃣'
CommandLine|contains: '9️⃣'
CommandLine|contains: '©️'
CommandLine|contains: '®️'
CommandLine|contains: '‼️'
CommandLine|contains: '⁉️'
CommandLine|contains: '™️'
CommandLine|contains: 'ℹ️'
CommandLine|contains: '↔️'
CommandLine|contains: '↕️'
CommandLine|contains: '↖️'
CommandLine|contains: '↗️'
CommandLine|contains: '↘️'
CommandLine|contains: '↙️'
CommandLine|contains: '↩️'
CommandLine|contains: '↪️'
CommandLine|contains: '⌚️'
CommandLine|contains: '⌛️'
CommandLine|contains: '⌨️'
CommandLine|contains: '⏏️'
CommandLine|contains: '⏩'
CommandLine|contains: '⏪'
CommandLine|contains: '⏫'
CommandLine|contains: '⏬'
CommandLine|contains: '⏭'
CommandLine|contains: '⏮'
CommandLine|contains: '⏯'
CommandLine|contains: '⏰'
CommandLine|contains: '⏱'
CommandLine|contains: '⏲'
CommandLine|contains: '⏳'
CommandLine|contains: '⏸'
CommandLine|contains: '⏹'
CommandLine|contains: '⏺'
CommandLine|contains: 'Ⓜ️'
CommandLine|contains: '▶️'
CommandLine|contains: '◀️'
CommandLine|contains: '☀️'
CommandLine|contains: '☁️'
CommandLine|contains: '☂️'
CommandLine|contains: '☃️'
CommandLine|contains: '☄️'
CommandLine|contains: '☎️'
CommandLine|contains: '☑️'
CommandLine|contains: '☔️'
CommandLine|contains: '☕️'
CommandLine|contains: '☘️'
CommandLine|contains: '☢️'
CommandLine|contains: '☣️'
CommandLine|contains: '☦️'
CommandLine|contains: '☪️'
CommandLine|contains: '☮️'
CommandLine|contains: '☯️'
CommandLine|contains: '☸️'
CommandLine|contains: '♈️'
CommandLine|contains: '♉️'
CommandLine|contains: '♊️'
CommandLine|contains: '♋️'
CommandLine|contains: '♌️'
CommandLine|contains: '♍️'
CommandLine|contains: '♎️'
CommandLine|contains: '♏️'
CommandLine|contains: '♐️'
CommandLine|contains: '♑️'
CommandLine|contains: '♒️'
CommandLine|contains: '♓️'
CommandLine|contains: '♟'
CommandLine|contains: '♨️'
CommandLine|contains: '♻️'
CommandLine|contains: '♾'
CommandLine|contains: '♿️'
CommandLine|contains: '⚒'
CommandLine|contains: '⚓️'
CommandLine|contains: '⚔️'
CommandLine|contains: '⚖️'
CommandLine|contains: '⚗️'
CommandLine|contains: '⚙️'
CommandLine|contains: '⚛️'
CommandLine|contains: '⚜️'
CommandLine|contains: '⚠️'
CommandLine|contains: '⚡️'
CommandLine|contains: '⚧'
CommandLine|contains: '⚪️'
CommandLine|contains: '⚫️'
CommandLine|contains: '⚰️'
CommandLine|contains: '⚱️'
CommandLine|contains: '⚽️'
CommandLine|contains: '⚾️'
CommandLine|contains: '⛄️'
CommandLine|contains: '⛅️'
CommandLine|contains: '⛈'
CommandLine|contains: '⛎'
CommandLine|contains: '⛏'
CommandLine|contains: '⛓'
CommandLine|contains: '⛔️'
CommandLine|contains: '⛩'
CommandLine|contains: '⛪️'
CommandLine|contains: '⛰'
CommandLine|contains: '⛱'
CommandLine|contains: '⛲️'
CommandLine|contains: '⛳️'
CommandLine|contains: '⛴'
CommandLine|contains: '⛵️'
CommandLine|contains: '⛷'
CommandLine|contains: '⛸'
CommandLine|contains: '⛹️'
CommandLine|contains: '⛹️‍♀️'
CommandLine|contains: '⛹️‍♂️'
CommandLine|contains: '⛺️'
CommandLine|contains: '⛽️'
CommandLine|contains: '✂️'
CommandLine|contains: '✅'
CommandLine|contains: '✈️'
CommandLine|contains: '✉️'
CommandLine|contains: '✏️'
CommandLine|contains: '✒️'
CommandLine|contains: '✔️'
CommandLine|contains: '✖️'
CommandLine|contains: '✝️'
CommandLine|contains: '✡️'
CommandLine|contains: '✨'
CommandLine|contains: '✳️'
CommandLine|contains: '✴️'
CommandLine|contains: '❄️'
CommandLine|contains: '❇️'
CommandLine|contains: '❌'
CommandLine|contains: '❎'
CommandLine|contains: '❓'
CommandLine|contains: '❔'
CommandLine|contains: '❕'
CommandLine|contains: '❗️'
CommandLine|contains: '❣️'
CommandLine|contains: '❤️‍🔥'
CommandLine|contains: '❤️‍🩹'
CommandLine|contains: '➕'
CommandLine|contains: '➖'
CommandLine|contains: '➗'
CommandLine|contains: '➡️'
CommandLine|contains: '➰'
CommandLine|contains: '➿'
CommandLine|contains: '⤴️'
CommandLine|contains: '⤵️'
CommandLine|contains: '⬅️'
CommandLine|contains: '⬆️'
CommandLine|contains: '⬇️'
CommandLine|contains: '⭐️'
CommandLine|contains: '⭕️'
CommandLine|contains: '〰️'
CommandLine|contains: '〽️'
CommandLine|contains: '㊗️'
CommandLine|contains: '㊙️'
CommandLine|contains: '🅰️'
CommandLine|contains: '🅱️'
CommandLine|contains: '🅾️'
CommandLine|contains: '🅿️'
CommandLine|contains: '🆎'
CommandLine|contains: '🆑'
CommandLine|contains: '🆒'
CommandLine|contains: '🆓'
CommandLine|contains: '🆔'
CommandLine|contains: '🆕'
CommandLine|contains: '🆖'
CommandLine|contains: '🆗'
CommandLine|contains: '🆘'
CommandLine|contains: '🆙'
CommandLine|contains: '🆚'
CommandLine|contains: '🈁'
CommandLine|contains: '🈂️'
CommandLine|contains: '🈚️'
CommandLine|contains: '🈯️'
CommandLine|contains: '🈲'
CommandLine|contains: '🈳'
CommandLine|contains: '🈴'
CommandLine|contains: '🈵'
CommandLine|contains: '🈶'
CommandLine|contains: '🈷️'
CommandLine|contains: '🈸'
CommandLine|contains: '🈹'
CommandLine|contains: '🈺'
CommandLine|contains: '🉐'
CommandLine|contains: '🉑'
CommandLine|contains: '🌀'
CommandLine|contains: '🌁'
CommandLine|contains: '🌃'
CommandLine|contains: '🌄'
CommandLine|contains: '🌅'
CommandLine|contains: '🌆'
CommandLine|contains: '🌇'
CommandLine|contains: '🌈'
CommandLine|contains: '🌉'
CommandLine|contains: '🌊'
CommandLine|contains: '🌋'
CommandLine|contains: '🌌'
CommandLine|contains: '🌍'
CommandLine|contains: '🌎'
CommandLine|contains: '🌏'
CommandLine|contains: '🌐'
CommandLine|contains: '🌑'
CommandLine|contains: '🌒'
CommandLine|contains: '🌓'
CommandLine|contains: '🌔'
CommandLine|contains: '🌕'
CommandLine|contains: '🌖'
CommandLine|contains: '🌗'
CommandLine|contains: '🌘'
CommandLine|contains: '🌙'
CommandLine|contains: '🌚'
CommandLine|contains: '🌛'
CommandLine|contains: '🌜'
CommandLine|contains: '🌝'
CommandLine|contains: '🌞'
CommandLine|contains: '🌟'
CommandLine|contains: '🌠'
CommandLine|contains: '🌡'
CommandLine|contains: '🌤'
CommandLine|contains: '🌥'
CommandLine|contains: '🌦'
CommandLine|contains: '🌧'
CommandLine|contains: '🌨'
CommandLine|contains: '🌩'
CommandLine|contains: '🌪'
CommandLine|contains: '🌫🍏'
CommandLine|contains: '🌬'
CommandLine|contains: '🌭'
CommandLine|contains: '🌮'
CommandLine|contains: '🌯'
CommandLine|contains: '🌰'
CommandLine|contains: '🌱'
CommandLine|contains: '🌲'
CommandLine|contains: '🌳'
CommandLine|contains: '🌴'
CommandLine|contains: '🌵'
CommandLine|contains: '🌶'
CommandLine|contains: '🌷'
CommandLine|contains: '🌸'
CommandLine|contains: '🌹'
CommandLine|contains: '🌺'
CommandLine|contains: '🌻'
CommandLine|contains: '🌼'
CommandLine|contains: '🌽'
CommandLine|contains: '🌾'
CommandLine|contains: '🌿'
CommandLine|contains: '🍀'
CommandLine|contains: '🍁'
CommandLine|contains: '🍂'
CommandLine|contains: '🍃'
CommandLine|contains: '🍄'
CommandLine|contains: '🍅'
CommandLine|contains: '🍆'
CommandLine|contains: '🍇'
CommandLine|contains: '🍈'
CommandLine|contains: '🍉'
CommandLine|contains: '🍊'
CommandLine|contains: '🍋'
CommandLine|contains: '🍌'
CommandLine|contains: '🍍'
CommandLine|contains: '🍎'
CommandLine|contains: '🍐'
CommandLine|contains: '🍑'
CommandLine|contains: '🍒'
CommandLine|contains: '🍓'
CommandLine|contains: '🍔'
CommandLine|contains: '🍕'
CommandLine|contains: '🍖'
CommandLine|contains: '🍗'
CommandLine|contains: '🍘'
CommandLine|contains: '🍙'
CommandLine|contains: '🍚'
CommandLine|contains: '🍛'
CommandLine|contains: '🍜'
CommandLine|contains: '🍝'
CommandLine|contains: '🍞'
CommandLine|contains: '🍟'
CommandLine|contains: '🍠'
CommandLine|contains: '🍡'
CommandLine|contains: '🍢'
CommandLine|contains: '🍣'
CommandLine|contains: '🍤'
CommandLine|contains: '🍥'
CommandLine|contains: '🍦'
CommandLine|contains: '🍧'
CommandLine|contains: '🍨'
CommandLine|contains: '🍩'
CommandLine|contains: '🍪'
CommandLine|contains: '🍫'
CommandLine|contains: '🍬'
CommandLine|contains: '🍭'
CommandLine|contains: '🍮'
CommandLine|contains: '🍯'
CommandLine|contains: '🍰'
CommandLine|contains: '🍱'
CommandLine|contains: '🍲'
CommandLine|contains: '🍳'
CommandLine|contains: '🍴'
CommandLine|contains: '🍵'
CommandLine|contains: '🍶'
CommandLine|contains: '🍷'
CommandLine|contains: '🍸'
CommandLine|contains: '🍹'
CommandLine|contains: '🍺'
CommandLine|contains: '🍻'
CommandLine|contains: '🍼'
CommandLine|contains: '🍽'
CommandLine|contains: '🍾'
CommandLine|contains: '🍿'
CommandLine|contains: '🎀'
CommandLine|contains: '🎁'
CommandLine|contains: '🎂'
CommandLine|contains: '🎄'
CommandLine|contains: '🎆'
CommandLine|contains: '🎇'
CommandLine|contains: '🎈'
CommandLine|contains: '🎉'
CommandLine|contains: '🎊'
CommandLine|contains: '🎋'
CommandLine|contains: '🎍'
CommandLine|contains: '🎎'
CommandLine|contains: '🎏'
CommandLine|contains: '🎐'
CommandLine|contains: '🎑'
CommandLine|contains: '🎖'
CommandLine|contains: '🎗'
CommandLine|contains: '🎙'
CommandLine|contains: '🎚'
CommandLine|contains: '🎛'
CommandLine|contains: '🎞'
CommandLine|contains: '🎟'
CommandLine|contains: '🎠'
CommandLine|contains: '🎡'
CommandLine|contains: '🎢'
CommandLine|contains: '🎣'
CommandLine|contains: '🎤'
CommandLine|contains: '🎥'
CommandLine|contains: '🎦'
CommandLine|contains: '🎧'
CommandLine|contains: '🎨'
CommandLine|contains: '🎪'
CommandLine|contains: '🎫'
CommandLine|contains: '🎬'
CommandLine|contains: '🎭'
CommandLine|contains: '🎮'
CommandLine|contains: '🎯'
CommandLine|contains: '🎰'
CommandLine|contains: '🎱'
CommandLine|contains: '🎲'
CommandLine|contains: '🎳'
CommandLine|contains: '🎵'
CommandLine|contains: '🎶'
CommandLine|contains: '🎷'
CommandLine|contains: '🎸'
CommandLine|contains: '🎹'
CommandLine|contains: '🎺'
CommandLine|contains: '🎻'
CommandLine|contains: '🎼'
CommandLine|contains: '🎽'
CommandLine|contains: '🎾'
CommandLine|contains: '🎿'
CommandLine|contains: '🏀'
CommandLine|contains: '🏂'
CommandLine|contains: '🏄'
CommandLine|contains: '🏄‍♀️'
CommandLine|contains: '🏄‍♂️'
CommandLine|contains: '🏅'
CommandLine|contains: '🏆'
CommandLine|contains: '🏇'
CommandLine|contains: '🏈'
CommandLine|contains: '🏉'
CommandLine|contains: '🏊'
CommandLine|contains: '🏊‍♀️'
CommandLine|contains: '🏊‍♂️'
CommandLine|contains: '🏋️'
CommandLine|contains: '🏋️‍♀️'
CommandLine|contains: '🏋️‍♂️'
CommandLine|contains: '🏌️'
CommandLine|contains: '🏌️‍♀️'
CommandLine|contains: '🏌️‍♂️'
CommandLine|contains: '🏍'
CommandLine|contains: '🏎'
CommandLine|contains: '🏏'
CommandLine|contains: '🏐'
CommandLine|contains: '🏑'
CommandLine|contains: '🏒'
CommandLine|contains: '🏓'
CommandLine|contains: '🏔'
CommandLine|contains: '🏕'
CommandLine|contains: '🏖'
CommandLine|contains: '🏗'
CommandLine|contains: '🏘'
CommandLine|contains: '🏙'
CommandLine|contains: '🏚'
CommandLine|contains: '🏛'
CommandLine|contains: '🏜'
CommandLine|contains: '🏝'
CommandLine|contains: '🏞'
CommandLine|contains: '🏟'
CommandLine|contains: '🏠'
CommandLine|contains: '🏡'
CommandLine|contains: '🏢'
CommandLine|contains: '🏣'
CommandLine|contains: '🏤'
CommandLine|contains: '🏥'
CommandLine|contains: '🏦'
CommandLine|contains: '🏧'
CommandLine|contains: '🏨'
CommandLine|contains: '🏩'
CommandLine|contains: '🏪'
CommandLine|contains: '🏫'
CommandLine|contains: '🏬'
CommandLine|contains: '🏭'
CommandLine|contains: '🏮'
CommandLine|contains: '🏯'
CommandLine|contains: '🏰'
CommandLine|contains: '🏵'
CommandLine|contains: '🏷'
CommandLine|contains: '🏸'
CommandLine|contains: '🏹'
CommandLine|contains: '🏺'
CommandLine|contains: '🐀'
CommandLine|contains: '🐁'
CommandLine|contains: '🐂'
CommandLine|contains: '🐃'
CommandLine|contains: '🐄'
CommandLine|contains: '🐅'
CommandLine|contains: '🐆'
CommandLine|contains: '🐇'
CommandLine|contains: '🐈'
CommandLine|contains: '🐈‍⬛'
CommandLine|contains: '🐉'
CommandLine|contains: '🐊'
CommandLine|contains: '🐋'
CommandLine|contains: '🐌'
CommandLine|contains: '🐍'
CommandLine|contains: '🐎'
CommandLine|contains: '🐏'
CommandLine|contains: '🐐'
CommandLine|contains: '🐑'
CommandLine|contains: '🐓'
CommandLine|contains: '🐕'
CommandLine|contains: '🐕‍🦺'
CommandLine|contains: '🐖'
CommandLine|contains: '🐗'
CommandLine|contains: '🐘'
CommandLine|contains: '🐙'
CommandLine|contains: '🐚'
CommandLine|contains: '🐛'
CommandLine|contains: '🐜'
CommandLine|contains: '🐝'
CommandLine|contains: '🐞'
CommandLine|contains: '🐟'
CommandLine|contains: '🐠'
CommandLine|contains: '🐡'
CommandLine|contains: '🐢'
CommandLine|contains: '🐩'
CommandLine|contains: '🐪'
CommandLine|contains: '🐫'
CommandLine|contains: '🐬'
CommandLine|contains: '🐲'
CommandLine|contains: '🐳'
CommandLine|contains: '🐴'
CommandLine|contains: '🐺'
CommandLine|contains: '🐾'
CommandLine|contains: '🐿'
CommandLine|contains: '💈'
CommandLine|contains: '💉'
CommandLine|contains: '💊'
CommandLine|contains: '💌'
CommandLine|contains: '💎'
CommandLine|contains: '💐'
CommandLine|contains: '💒'
CommandLine|contains: '💓'
CommandLine|contains: '💔'
CommandLine|contains: '💕'
CommandLine|contains: '💖'
CommandLine|contains: '💗'
CommandLine|contains: '💘'
CommandLine|contains: '💙'
CommandLine|contains: '💚'
CommandLine|contains: '💛'
CommandLine|contains: '💜'
CommandLine|contains: '💝'
CommandLine|contains: '💞'
CommandLine|contains: '💟'
CommandLine|contains: '💠'
CommandLine|contains: '💡'
CommandLine|contains: '💢'
CommandLine|contains: '💣'
CommandLine|contains: '💤'
CommandLine|contains: '💥'
CommandLine|contains: '💦'
CommandLine|contains: '💧'
CommandLine|contains: '💨'
CommandLine|contains: '💫'
CommandLine|contains: '💮'
CommandLine|contains: '💯'
CommandLine|contains: '💰'
CommandLine|contains: '💱'
CommandLine|contains: '💲'
CommandLine|contains: '💳'
CommandLine|contains: '💴'
CommandLine|contains: '💵'
CommandLine|contains: '💶'
CommandLine|contains: '💷'
CommandLine|contains: '💸'
CommandLine|contains: '💹'
CommandLine|contains: '💺'
CommandLine|contains: '💻'
CommandLine|contains: '💽'
CommandLine|contains: '💾'
CommandLine|contains: '💿'
CommandLine|contains: '📀'
CommandLine|contains: '📁'
CommandLine|contains: '📂'
CommandLine|contains: '📃'
CommandLine|contains: '📄'
CommandLine|contains: '📅'
CommandLine|contains: '📆'
CommandLine|contains: '📇'
CommandLine|contains: '📈'
CommandLine|contains: '📉'
CommandLine|contains: '📊'
CommandLine|contains: '📋'
CommandLine|contains: '📌'
CommandLine|contains: '📍'
CommandLine|contains: '📎'
CommandLine|contains: '📏'
CommandLine|contains: '📐'
CommandLine|contains: '📑'
CommandLine|contains: '📒'
CommandLine|contains: '📓'
CommandLine|contains: '📔'
CommandLine|contains: '📕'
CommandLine|contains: '📖'
CommandLine|contains: '📗'
CommandLine|contains: '📘'
CommandLine|contains: '📙'
CommandLine|contains: '📚'
CommandLine|contains: '📛'
CommandLine|contains: '📜'
CommandLine|contains: '📝'
CommandLine|contains: '📞'
CommandLine|contains: '📟'
CommandLine|contains: '📠'
CommandLine|contains: '📡'
CommandLine|contains: '📤'
CommandLine|contains: '📥'
CommandLine|contains: '📦'
CommandLine|contains: '📧'
CommandLine|contains: '📨'
CommandLine|contains: '📩'
CommandLine|contains: '📪'
CommandLine|contains: '📫'
CommandLine|contains: '📬'
CommandLine|contains: '📭'
CommandLine|contains: '📮'
CommandLine|contains: '📯'
CommandLine|contains: '📰'
CommandLine|contains: '📱'
CommandLine|contains: '📲'
CommandLine|contains: '📳'
CommandLine|contains: '📴'
CommandLine|contains: '📵'
CommandLine|contains: '📶'
CommandLine|contains: '📷'
CommandLine|contains: '📸'
CommandLine|contains: '📹'
CommandLine|contains: '📺'
CommandLine|contains: '📻'
CommandLine|contains: '📼'
CommandLine|contains: '📽'
CommandLine|contains: '📿'
CommandLine|contains: '🔀'
CommandLine|contains: '🔁'
CommandLine|contains: '🔂'
CommandLine|contains: '🔃'
CommandLine|contains: '🔄'
CommandLine|contains: '🔅'
CommandLine|contains: '🔆'
CommandLine|contains: '🔋'
CommandLine|contains: '🔌'
CommandLine|contains: '🔍'
CommandLine|contains: '🔎'
CommandLine|contains: '🔏'
CommandLine|contains: '🔐'
CommandLine|contains: '🔑'
CommandLine|contains: '🔒'
CommandLine|contains: '🔓❤️'
CommandLine|contains: '🔖'
CommandLine|contains: '🔗'
CommandLine|contains: '🔘'
CommandLine|contains: '🔙'
CommandLine|contains: '🔚'
CommandLine|contains: '🔛'
CommandLine|contains: '🔜'
CommandLine|contains: '🔝'
CommandLine|contains: '🔞'
CommandLine|contains: '🔟'
CommandLine|contains: '🔠'
CommandLine|contains: '🔡'
CommandLine|contains: '🔢'
CommandLine|contains: '🔣'
CommandLine|contains: '🔤'
CommandLine|contains: '🔥'
CommandLine|contains: '🔦'
CommandLine|contains: '🔧'
CommandLine|contains: '🔨'
CommandLine|contains: '🔩'
CommandLine|contains: '🔪'
CommandLine|contains: '🔫'
CommandLine|contains: '🔬'
CommandLine|contains: '🔭'
CommandLine|contains: '🔮'
CommandLine|contains: '🔯'
CommandLine|contains: '🔰'
CommandLine|contains: '🔱'
CommandLine|contains: '🔴'
CommandLine|contains: '🔵'
CommandLine|contains: '🔺'
CommandLine|contains: '🔻'
CommandLine|contains: '🔼'
CommandLine|contains: '🔽'
CommandLine|contains: '🕉'
CommandLine|contains: '🕊'
CommandLine|contains: '🕋'
CommandLine|contains: '🕌'
CommandLine|contains: '🕍'
CommandLine|contains: '🕎'
CommandLine|contains: '🕯'
CommandLine|contains: '🕰'
CommandLine|contains: '🕳'
CommandLine|contains: '🕷'
CommandLine|contains: '🕸'
CommandLine|contains: '🕹'
CommandLine|contains: '🖇'
CommandLine|contains: '🖊'
CommandLine|contains: '🖋'
CommandLine|contains: '🖌'
CommandLine|contains: '🖍'
CommandLine|contains: '🖤'
CommandLine|contains: '🖥'
CommandLine|contains: '🖨'
CommandLine|contains: '🖱'
CommandLine|contains: '🖲'
CommandLine|contains: '🖼'
CommandLine|contains: '🗂'
CommandLine|contains: '🗃'
CommandLine|contains: '🗄'
CommandLine|contains: '🗑'
CommandLine|contains: '🗒'
CommandLine|contains: '🗓'
CommandLine|contains: '🗜'
CommandLine|contains: '🗝'
CommandLine|contains: '🗞'
CommandLine|contains: '🗡'
CommandLine|contains: '🗳'
CommandLine|contains: '🗺'
CommandLine|contains: '🗻'
CommandLine|contains: '🗼'
CommandLine|contains: '🗽'
CommandLine|contains: '🗾'
CommandLine|contains: '🗿'
CommandLine|contains: '🚀'
CommandLine|contains: '🚁'
CommandLine|contains: '🚂'
CommandLine|contains: '🚃'
CommandLine|contains: '🚄'
CommandLine|contains: '🚅'
CommandLine|contains: '🚆'
CommandLine|contains: '🚇'
CommandLine|contains: '🚈'
CommandLine|contains: '🚉'
CommandLine|contains: '🚊'
CommandLine|contains: '🚋'
CommandLine|contains: '🚌'
CommandLine|contains: '🚍'
CommandLine|contains: '🚎'
CommandLine|contains: '🚏'
CommandLine|contains: '🚐'
CommandLine|contains: '🚑'
CommandLine|contains: '🚒'
CommandLine|contains: '🚓'
CommandLine|contains: '🚔'
CommandLine|contains: '🚕'
CommandLine|contains: '🚖'
CommandLine|contains: '🚗'
CommandLine|contains: '🚘'
CommandLine|contains: '🚙'
CommandLine|contains: '🚚'
CommandLine|contains: '🚛'
CommandLine|contains: '🚜'
CommandLine|contains: '🚝'
CommandLine|contains: '🚞'
CommandLine|contains: '🚟'
CommandLine|contains: '🚠'
CommandLine|contains: '🚡'
CommandLine|contains: '🚢'
CommandLine|contains: '🚣'
CommandLine|contains: '🚣‍♀️'
CommandLine|contains: '🚣‍♂️'
CommandLine|contains: '🚤'
CommandLine|contains: '🚥'
CommandLine|contains: '🚦'
CommandLine|contains: '🚧'
CommandLine|contains: '🚨'
CommandLine|contains: '🚪'
CommandLine|contains: '🚫'
CommandLine|contains: '🚬'
CommandLine|contains: '🚭'
CommandLine|contains: '🚮'
CommandLine|contains: '🚯'
CommandLine|contains: '🚰'
CommandLine|contains: '🚱'
CommandLine|contains: '🚲'
CommandLine|contains: '🚳'
CommandLine|contains: '🚴'
CommandLine|contains: '🚴‍♀️'
CommandLine|contains: '🚴‍♂️'
CommandLine|contains: '🚵'
CommandLine|contains: '🚵‍♀️'
CommandLine|contains: '🚵‍♂️'
CommandLine|contains: '🚷'
CommandLine|contains: '🚸'
CommandLine|contains: '🚹'
CommandLine|contains: '🚺'
CommandLine|contains: '🚻'
CommandLine|contains: '🚼'
CommandLine|contains: '🚽'
CommandLine|contains: '🚾'
CommandLine|contains: '🚿'
CommandLine|contains: '🛀'
CommandLine|contains: '🛁'
CommandLine|contains: '🛂'
CommandLine|contains: '🛃'
CommandLine|contains: '🛄'
CommandLine|contains: '🛅'
CommandLine|contains: '🛋'
CommandLine|contains: '🛌'
CommandLine|contains: '🛍'
CommandLine|contains: '🛎'
CommandLine|contains: '🛏'
CommandLine|contains: '🛐'
CommandLine|contains: '🛑'
CommandLine|contains: '🛒'
CommandLine|contains: '🛕'
CommandLine|contains: '🛖'
CommandLine|contains: '🛗'
CommandLine|contains: '🛝'
CommandLine|contains: '🛞'
CommandLine|contains: '🛟'
CommandLine|contains: '🛠'
CommandLine|contains: '🛡'
CommandLine|contains: '🛢'
CommandLine|contains: '🛣'
CommandLine|contains: '🛤'
CommandLine|contains: '🛥'
CommandLine|contains: '🛩'
CommandLine|contains: '🛫'
CommandLine|contains: '🛬'
CommandLine|contains: '🛰'
CommandLine|contains: '🛳'
CommandLine|contains: '🛴'
CommandLine|contains: '🛵'
CommandLine|contains: '🛶'
CommandLine|contains: '🛷'
CommandLine|contains: '🛸'
CommandLine|contains: '🛹'
CommandLine|contains: '🛺'
CommandLine|contains: '🛻'
CommandLine|contains: '🛼'
CommandLine|contains: '🟠'
CommandLine|contains: '🟡'
CommandLine|contains: '🟢'
CommandLine|contains: '🟣'
CommandLine|contains: '🟤'
CommandLine|contains: '🟰'
CommandLine|contains: '🤍'
CommandLine|contains: '🤎'
CommandLine|contains: '🤸'
CommandLine|contains: '🤸‍♀️'
CommandLine|contains: '🤸‍♂️'
CommandLine|contains: '🤹'
CommandLine|contains: '🤹‍♀️'
CommandLine|contains: '🤹‍♂️'
CommandLine|contains: '🤺'
CommandLine|contains: '🤼'
CommandLine|contains: '🤼‍♀️'
CommandLine|contains: '🤼‍♂️'
CommandLine|contains: '🤽'
CommandLine|contains: '🤽‍♀️'
CommandLine|contains: '🤽‍♂️'
CommandLine|contains: '🤾'
CommandLine|contains: '🤾‍♀️'
CommandLine|contains: '🤾‍♂️'
CommandLine|contains: '🤿'
CommandLine|contains: '🥀'
CommandLine|contains: '🥁'
CommandLine|contains: '🥂'
CommandLine|contains: '🥃'
CommandLine|contains: '🥄'
CommandLine|contains: '🥅'
CommandLine|contains: '🥇'
CommandLine|contains: '🥈'
CommandLine|contains: '🥉'
CommandLine|contains: '🥊'
CommandLine|contains: '🥋'
CommandLine|contains: '🥌'
CommandLine|contains: '🥍'
CommandLine|contains: '🥎'
CommandLine|contains: '🥏'
CommandLine|contains: '🥐'
CommandLine|contains: '🥑'
CommandLine|contains: '🥒'
CommandLine|contains: '🥓'
CommandLine|contains: '🥔'
CommandLine|contains: '🥕'
CommandLine|contains: '🥖'
CommandLine|contains: '🥗'
CommandLine|contains: '🥘'
CommandLine|contains: '🥙'
CommandLine|contains: '🥚'
CommandLine|contains: '🥛'
CommandLine|contains: '🥜'
CommandLine|contains: '🥝'
CommandLine|contains: '🥞'
CommandLine|contains: '🥟'
CommandLine|contains: '🥠'
CommandLine|contains: '🥡'
CommandLine|contains: '🥢'
CommandLine|contains: '🥣'
CommandLine|contains: '🥤'
CommandLine|contains: '🥥'
CommandLine|contains: '🥦'
CommandLine|contains: '🥧'
CommandLine|contains: '🥨'
CommandLine|contains: '🥩'
CommandLine|contains: '🥪'
CommandLine|contains: '🥫'
CommandLine|contains: '🥬'
CommandLine|contains: '🥭'
CommandLine|contains: '🥮'
CommandLine|contains: '🥯'
CommandLine|contains: '🦀'
CommandLine|contains: '🦂'
CommandLine|contains: '🦃'
CommandLine|contains: '🦄'
CommandLine|contains: '🦅'
CommandLine|contains: '🦆'
CommandLine|contains: '🦇'
CommandLine|contains: '🦈'
CommandLine|contains: '🦉'
CommandLine|contains: '🦋'
CommandLine|contains: '🦌'
CommandLine|contains: '🦍'
CommandLine|contains: '🦎'
CommandLine|contains: '🦏'
CommandLine|contains: '🦐'
CommandLine|contains: '🦑'
CommandLine|contains: '🦒'
CommandLine|contains: '🦓'
CommandLine|contains: '🦔'
CommandLine|contains: '🦕'
CommandLine|contains: '🦖'
CommandLine|contains: '🦗'
CommandLine|contains: '🦘'
CommandLine|contains: '🦙'
CommandLine|contains: '🦚'
CommandLine|contains: '🦛'
CommandLine|contains: '🦜'
CommandLine|contains: '🦝'
CommandLine|contains: '🦞'
CommandLine|contains: '🦟'
CommandLine|contains: '🦠'
CommandLine|contains: '🦡'
CommandLine|contains: '🦢'
CommandLine|contains: '🦣'
CommandLine|contains: '🦤'
CommandLine|contains: '🦥'
CommandLine|contains: '🦦'
CommandLine|contains: '🦧'
CommandLine|contains: '🦨'
CommandLine|contains: '🦩'
CommandLine|contains: '🦪'
CommandLine|contains: '🦫'
CommandLine|contains: '🦬'
CommandLine|contains: '🦮'
CommandLine|contains: '🦯'
CommandLine|contains: '🦴'
CommandLine|contains: '🦼'
CommandLine|contains: '🦽'
CommandLine|contains: '🧀'
CommandLine|contains: '🧁'
CommandLine|contains: '🧂'
CommandLine|contains: '🧃'
CommandLine|contains: '🧄'
CommandLine|contains: '🧅'
CommandLine|contains: '🧆'
CommandLine|contains: '🧇'
CommandLine|contains: '🧈'
CommandLine|contains: '🧉'
CommandLine|contains: '🧊'
CommandLine|contains: '🧋'
CommandLine|contains: '🧗'
CommandLine|contains: '🧗‍♀️'
CommandLine|contains: '🧗‍♂️'
CommandLine|contains: '🧘'
CommandLine|contains: '🧘‍♀️'
CommandLine|contains: '🧘‍♂️'
CommandLine|contains: '🧡'
CommandLine|contains: '🧧'
CommandLine|contains: '🧨'
CommandLine|contains: '🧩'
CommandLine|contains: '🧪'
CommandLine|contains: '🧫'
CommandLine|contains: '🧬'
CommandLine|contains: '🧭'
CommandLine|contains: '🧮'
CommandLine|contains: '🧯'
CommandLine|contains: '🧰'
CommandLine|contains: '🧱'
CommandLine|contains: '🧲'
CommandLine|contains: '🧴'
CommandLine|contains: '🧷'
CommandLine|contains: '🧸'
CommandLine|contains: '🧹'
CommandLine|contains: '🧺'
CommandLine|contains: '🧻'
CommandLine|contains: '🧼'
CommandLine|contains: '🧽'
CommandLine|contains: '🧾'
CommandLine|contains: '🧿'
CommandLine|contains: '🩰'
CommandLine|contains: '🩸'
CommandLine|contains: '🩹'
CommandLine|contains: '🩺'
CommandLine|contains: '🩻'
CommandLine|contains: '🩼'
CommandLine|contains: '🪀'
CommandLine|contains: '🪁'
CommandLine|contains: '🪂'
CommandLine|contains: '🪃'
CommandLine|contains: '🪄'
CommandLine|contains: '🪅'
CommandLine|contains: '🪆'
CommandLine|contains: '🪐'
CommandLine|contains: '🪑'
CommandLine|contains: '🪒'
CommandLine|contains: '🪓'
CommandLine|contains: '🪔'
CommandLine|contains: '🪕'
CommandLine|contains: '🪗'
CommandLine|contains: '🪘'
CommandLine|contains: '🪙'
CommandLine|contains: '🪚'
CommandLine|contains: '🪛'
CommandLine|contains: '🪜'
CommandLine|contains: '🪝'
CommandLine|contains: '🪞'
CommandLine|contains: '🪟'
CommandLine|contains: '🪠'
CommandLine|contains: '🪣'
CommandLine|contains: '🪤'
CommandLine|contains: '🪥'
CommandLine|contains: '🪦'
CommandLine|contains: '🪧'
CommandLine|contains: '🪨'
CommandLine|contains: '🪩'
CommandLine|contains: '🪪'
CommandLine|contains: '🪫'
CommandLine|contains: '🪬'
CommandLine|contains: '🪰'
CommandLine|contains: '🪱'
CommandLine|contains: '🪲'
CommandLine|contains: '🪳'
CommandLine|contains: '🪴'
CommandLine|contains: '🪵'
CommandLine|contains: '🪶'
CommandLine|contains: '🪷'
CommandLine|contains: '🪸'
CommandLine|contains: '🪹'
CommandLine|contains: '🪺'
CommandLine|contains: '🫐'
CommandLine|contains: '🫑'
CommandLine|contains: '🫒'
CommandLine|contains: '🫓'
CommandLine|contains: '🫔'
CommandLine|contains: '🫕'
CommandLine|contains: '🫖'
CommandLine|contains: '🫗'
CommandLine|contains: '🫘'
CommandLine|contains: '🫙'
CommandLine|contains: '🫧'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`CommandLine`	match	`#️⃣` `*️⃣` `0️⃣` `1️⃣` `2️⃣` `3️⃣` `4️⃣` `5️⃣` `6️⃣` `7️⃣` `8️⃣` `9️⃣` `©️` `®️` `‼️` `⁉️` `™️` `ℹ️` `↔️` `↕️` `↖️` `↗️` `↘️` `↙️` `↩️` `↪️` `⌚️` `⌛️` `⌨️` `⏏️` `⏩` `⏪` `⏫` `⏬` `⏭` `⏮` `⏯` `⏰` `⏱` `⏲` `⏳` `⏸` `⏹` `⏺` `Ⓜ️` `▶️` `◀️` `☀️` `☁️` `☂️` corpus 2 (sigma 2) `☃️` `☄️` `☎️` `☑️` `☔️` `☕️` `☘️` `☢️` `☣️` `☦️` `☪️` `☮️` `☯️` `☸️` `♈️` `♉️` `♊️` `♋️` `♌️` `♍️` `♎️` `♏️` `♐️` `♑️` `♒️` `♓️` `♟` corpus 2 (sigma 2) `♨️` `♻️` `♾` `♿️` `⚒` `⚓️` `⚔️` `⚖️` `⚗️` `⚙️` `⚛️` `⚜️` `⚠️` `⚡️` `⚧` `⚪️` `⚫️` `⚰️` `⚱️` `⚽️` `⚾️` `⛄️` `⛅️` `⛈` `⛎` `⛏` `⛓` `⛔️` `⛩` `⛪️` `⛰` `⛱` `⛲️` `⛳️` `⛴` `⛵️` `⛷` `⛸` `⛹️` `⛹️‍♀️` `⛹️‍♂️` `⛺️` `⛽️` `✂️` `✅` `✈️` `✉️` `✏️` `✒️` `✔️` `✖️` `✝️` `✡️` `✨` `✳️` `✴️` `❄️` `❇️` `❌` `❎` `❓` `❔` `❕` `❗️` `❣️` `❤️‍🔥` corpus 2 (sigma 2) `❤️‍🩹` corpus 2 (sigma 2) `➕` `➖` `➗` `➡️` `➰` `➿` `⤴️` `⤵️` `⬅️` `⬆️` `⬇️` `⭐️` `⭕️` `〰️` `〽️` `㊗️` `㊙️` `🅰️` `🅱️` `🅾️` `🅿️` `🆎` `🆑` `🆒` `🆓` `🆔` `🆕` `🆖` `🆗` `🆘` `🆙` `🆚` `🈁` `🈂️` `🈚️` `🈯️` `🈲` `🈳` `🈴` `🈵` `🈶` `🈷️` `🈸` `🈹` `🈺` `🉐` `🉑` `🌀` `🌁` `🌃` `🌄` `🌅` `🌆` `🌇` `🌈` `🌉` `🌊` `🌋` `🌌` `🌍` `🌎` `🌏` `🌐` `🌑` `🌒` `🌓` `🌔` `🌕` `🌖` `🌗` `🌘` `🌙` `🌚` `🌛` `🌜` `🌝` `🌞` `🌟` `🌠` `🌡` `🌤` `🌥` `🌦` `🌧` `🌨` `🌩` `🌪` `🌫🍏` `🌬` `🌭` `🌮` `🌯` `🌰` `🌱` `🌲` `🌳` `🌴` `🌵` `🌶` `🌷` `🌸` `🌹` `🌺` `🌻` `🌼` `🌽` `🌾` `🌿` `🍀` `🍁` `🍂` `🍃` `🍄` `🍅` `🍆` `🍇` `🍈` `🍉` `🍊` `🍋` `🍌` `🍍` `🍎` `🍐` `🍑` `🍒` `🍓` `🍔` `🍕` `🍖` `🍗` `🍘` `🍙` `🍚` `🍛` `🍜` `🍝` `🍞` `🍟` `🍠` `🍡` `🍢` `🍣` `🍤` `🍥` `🍦` `🍧` `🍨` `🍩` `🍪` `🍫` `🍬` `🍭` `🍮` `🍯` `🍰` `🍱` `🍲` `🍳` `🍴` `🍵` `🍶` `🍷` `🍸` `🍹` `🍺` `🍻` `🍼` `🍽` `🍾` `🍿` `🎀` `🎁` `🎂` `🎄` `🎆` `🎇` `🎈` `🎉` `🎊` `🎋` `🎍` `🎎` `🎏` `🎐` `🎑` `🎖` `🎗` `🎙` `🎚` `🎛` `🎞` `🎟` `🎠` `🎡` `🎢` `🎣` `🎤` `🎥` `🎦` `🎧` `🎨` `🎪` `🎫` `🎬` `🎭` `🎮` `🎯` `🎰` `🎱` `🎲` `🎳` `🎵` `🎶` `🎷` `🎸` `🎹` `🎺` `🎻` `🎼` `🎽` `🎾` `🎿` `🏀` `🏂` `🏄` `🏄‍♀️` `🏄‍♂️` `🏅` `🏆` `🏇` `🏈` `🏉` `🏊` `🏊‍♀️` `🏊‍♂️` `🏋️` `🏋️‍♀️` `🏋️‍♂️` `🏌️` `🏌️‍♀️` `🏌️‍♂️` `🏍` `🏎` `🏏` `🏐` `🏑` `🏒` `🏓` `🏔` `🏕` `🏖` `🏗` `🏘` `🏙` `🏚` `🏛` `🏜` `🏝` `🏞` `🏟` `🏠` `🏡` `🏢` `🏣` `🏤` `🏥` `🏦` `🏧` `🏨` `🏩` `🏪` `🏫` `🏬` `🏭` `🏮` `🏯` `🏰` `🏵` `🏷` `🏸` `🏹` `🏺` `🐀` `🐁` `🐂` `🐃` `🐄` `🐅` `🐆` `🐇` `🐈` `🐈‍⬛` `🐉` `🐊` `🐋` `🐌` `🐍` `🐎` `🐏` `🐐` `🐑` `🐓` `🐕` `🐕‍🦺` `🐖` `🐗` `🐘` `🐙` `🐚` `🐛` `🐜` `🐝` `🐞` `🐟` `🐠` `🐡` `🐢` `🐩` `🐪` `🐫` `🐬` `🐲` `🐳` `🐴` `🐺` `🐾` `🐿` `💈` `💉` `💊` `💌` `💎` `💐` `💒` `💓` `💔` `💕` `💖` `💗` `💘` `💙` `💚` `💛` `💜` `💝` `💞` `💟` `💠` `💡` `💢` `💣` `💤` `💥` `💦` `💧` `💨` `💫` `💮` `💯` `💰` `💱` `💲` `💳` `💴` `💵` `💶` `💷` `💸` `💹` `💺` `💻` `💽` `💾` `💿` `📀` `📁` `📂` `📃` `📄` `📅` `📆` `📇` `📈` `📉` `📊` `📋` `📌` `📍` `📎` `📏` `📐` `📑` `📒` `📓` `📔` `📕` `📖` `📗` `📘` `📙` `📚` `📛` `📜` `📝` `📞` `📟` `📠` `📡` `📤` `📥` `📦` `📧` `📨` `📩` `📪` `📫` `📬` `📭` `📮` `📯` `📰` `📱` `📲` `📳` `📴` `📵` `📶` `📷` `📸` `📹` `📺` `📻` `📼` `📽` `📿` `🔀` `🔁` `🔂` `🔃` `🔄` `🔅` `🔆` `🔋` `🔌` `🔍` `🔎` `🔏` `🔐` `🔑` `🔒` `🔓❤️` `🔖` `🔗` `🔘` `🔙` `🔚` `🔛` `🔜` `🔝` `🔞` `🔟` `🔠` `🔡` `🔢` `🔣` `🔤` `🔥` `🔦` `🔧` `🔨` `🔩` `🔪` `🔫` `🔬` `🔭` `🔮` `🔯` `🔰` `🔱` `🔴` `🔵` `🔺` `🔻` `🔼` `🔽` `🕉` `🕊` `🕋` `🕌` `🕍` `🕎` `🕯` `🕰` `🕳` `🕷` `🕸` `🕹` `🖇` `🖊` `🖋` `🖌` `🖍` `🖤` `🖥` `🖨` `🖱` `🖲` `🖼` `🗂` `🗃` `🗄` `🗑` `🗒` `🗓` `🗜` `🗝` `🗞` `🗡` `🗳` `🗺` `🗻` `🗼` `🗽` `🗾` `🗿` `🚀` `🚁` `🚂` `🚃` `🚄` `🚅` `🚆` `🚇` `🚈` `🚉` `🚊` `🚋` `🚌` `🚍` `🚎` `🚏` `🚐` `🚑` `🚒` `🚓` `🚔` `🚕` `🚖` `🚗` `🚘` `🚙` `🚚` `🚛` `🚜` `🚝` `🚞` `🚟` `🚠` `🚡` `🚢` `🚣` `🚣‍♀️` `🚣‍♂️` `🚤` `🚥` `🚦` `🚧` `🚨` `🚪` `🚫` `🚬` `🚭` `🚮` `🚯` `🚰` `🚱` `🚲` `🚳` `🚴` `🚴‍♀️` `🚴‍♂️` `🚵` `🚵‍♀️` `🚵‍♂️` `🚷` `🚸` `🚹` `🚺` `🚻` `🚼` `🚽` `🚾` `🚿` `🛀` `🛁` `🛂` `🛃` `🛄` `🛅` `🛋` `🛌` `🛍` `🛎` `🛏` `🛐` `🛑` `🛒` `🛕` `🛖` `🛗` `🛝` corpus 2 (sigma 2) `🛞` corpus 2 (sigma 2) `🛟` corpus 2 (sigma 2) `🛠` `🛡` `🛢` `🛣` `🛤` `🛥` `🛩` `🛫` `🛬` `🛰` `🛳` `🛴` `🛵` `🛶` `🛷` `🛸` `🛹` `🛺` `🛻` `🛼` `🟠` `🟡` `🟢` `🟣` `🟤` `🟰` corpus 2 (sigma 2) `🤍` `🤎` `🤸` `🤸‍♀️` `🤸‍♂️` `🤹` `🤹‍♀️` `🤹‍♂️` `🤺` `🤼` `🤼‍♀️` `🤼‍♂️` `🤽` `🤽‍♀️` `🤽‍♂️` `🤾` `🤾‍♀️` `🤾‍♂️` `🤿` `🥀` `🥁` `🥂` `🥃` `🥄` `🥅` `🥇` `🥈` `🥉` `🥊` `🥋` `🥌` `🥍` `🥎` `🥏` `🥐` `🥑` `🥒` `🥓` `🥔` `🥕` `🥖` `🥗` `🥘` `🥙` `🥚` `🥛` `🥜` `🥝` `🥞` `🥟` `🥠` `🥡` `🥢` `🥣` `🥤` `🥥` `🥦` `🥧` `🥨` `🥩` `🥪` `🥫` `🥬` `🥭` `🥮` `🥯` `🦀` `🦂` `🦃` `🦄` `🦅` `🦆` `🦇` `🦈` `🦉` `🦋` `🦌` `🦍` `🦎` `🦏` `🦐` `🦑` `🦒` `🦓` `🦔` `🦕` `🦖` `🦗` `🦘` `🦙` `🦚` `🦛` `🦜` `🦝` `🦞` `🦟` `🦠` `🦡` `🦢` `🦣` `🦤` `🦥` `🦦` `🦧` `🦨` `🦩` `🦪` `🦫` `🦬` `🦮` `🦯` `🦴` corpus 2 (sigma 2) `🦼` `🦽` `🧀` `🧁` `🧂` `🧃` `🧄` `🧅` `🧆` `🧇` `🧈` `🧉` `🧊` `🧋` `🧗` `🧗‍♀️` `🧗‍♂️` `🧘` `🧘‍♀️` `🧘‍♂️` `🧡` `🧧` `🧨` `🧩` `🧪` `🧫` `🧬` `🧭` `🧮` `🧯` `🧰` `🧱` `🧲` `🧴` `🧷` `🧸` `🧹` `🧺` `🧻` `🧼` `🧽` `🧾` `🧿` `🩰` corpus 2 (sigma 2) `🩸` corpus 2 (sigma 2) `🩹` `🩺` `🩻` corpus 2 (sigma 2) `🩼` corpus 2 (sigma 2) `🪀` `🪁` `🪂` `🪃` `🪄` `🪅` `🪆` `🪐` `🪑` `🪒` `🪓` `🪔` `🪕` `🪗` `🪘` `🪙` `🪚` `🪛` `🪜` `🪝` `🪞` `🪟` `🪠` `🪣` `🪤` `🪥` `🪦` `🪧` `🪨` `🪩` corpus 2 (sigma 2) `🪪` corpus 2 (sigma 2) `🪫` corpus 2 (sigma 2) `🪬` corpus 2 (sigma 2) `🪰` `🪱` `🪲` `🪳` `🪴` `🪵` `🪶` `🪷` corpus 2 (sigma 2) `🪸` corpus 2 (sigma 2) `🪹` corpus 2 (sigma 2) `🪺` corpus 2 (sigma 2) `🫐` `🫑` `🫒` `🫓` `🫔` `🫕` `🫖` `🫗` corpus 2 (sigma 2) `🫘` corpus 2 (sigma 2) `🫙` corpus 2 (sigma 2) `🫧` corpus 2 (sigma 2)

Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 3

Event coverage

Stages and Predicates

Stage 1: selection

Indicators

Stage 1: `selection`