Sigma rules: 03

title: Active Directory Replication from Non Machine Account - DcSync Indicator
id: 17d619c1-e020-4347-957e-1d1207455c93
related:
    - id: 611eab06-a145-4dfa-a295-3ccc5c20f59a # Suspicious Machine Account Replication - DcSync Indicator
      type: similar
status: test
description: Detects potential abuse of Active Directory Replication Service (ADRS) from a non machine account to request credentials.
references:
    - https://threathunterplaybook.com/hunts/windows/180815-ADObjectAccessReplication/notebook.html
    - https://threathunterplaybook.com/library/windows/active_directory_replication.html
    - https://threathunterplaybook.com/hunts/windows/190101-ADModDirectoryReplication/notebook.html
author: Roberto Rodriguez @Cyb3rWard0g
date: 2019-07-26
modified: 2026-07-30
tags:
    - attack.credential-access
    - attack.t1003.006
logsource:
    product: windows
    service: security
    definition: |
        Requirements: A SACL must be configured on the domain NC root object (e.g. DC=domain,DC=com)
        to generate Event 4662. Add via ADSI Edit: navigate to the domain NC root → Properties →
        Security → Advanced → Auditing → add an ACE for Everyone, Type: Success, Applies to:
        This object only, rights: DS-Replication-Get-Changes and DS-Replication-Get-Changes-All.
        The OS audit subcategory must also be enabled:
        auditpol /set /subcategory:"Directory Service Access" /success:enable
detection:
    selection:
        EventID: 4662
        Properties|contains:
            - '1131f6ad-9c07-11d1-f79f-00c04fc2dcd2' # DS-Replication-Get-Changes-All
            - '1131f6aa-9c07-11d1-f79f-00c04fc2dcd2' # DS-Replication-Get-Changes
            - '9923a32a-3607-11d2-b9be-0000f87a36b2' # DS-Replication-Synchronize
            - '89e95b76-444d-4c62-991a-0facbeda640c' # DS-Replication-Get-Changes-In-Filtered-Set
    filter_main_machine_accounts:
        SubjectUserName|endswith: '$'
    filter_optional_subject_domain:
        SubjectDomainName: 'Window Manager'
    filter_optional_subject_usersid:
        SubjectUserName|startswith:
            - 'NT AUT'
            - 'MSOL_' # https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/reference-connect-accounts-permissions#ad-ds-connector-account
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - Unknown
level: medium

title: AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl - File
id: d353dac0-1b41-46c2-820c-d7d2561fc6ed
related:
    - id: 074e0ded-6ced-4ebd-8b4d-53f55908119d
      type: derived
status: test
description: Detects execution of attacker-controlled WsmPty.xsl or WsmTxt.xsl via winrm.vbs and copied cscript.exe (can be renamed)
references:
    - https://posts.specterops.io/application-whitelisting-bypass-and-arbitrary-unsigned-code-execution-technique-in-winrm-vbs-c8c24fb40404
author: Julia Fomina, oscd.community
date: 2020-10-06
modified: 2022-11-28
tags:
    - attack.stealth
    - attack.t1216
logsource:
    product: windows
    category: file_event
detection:
    system_files:
        TargetFilename|endswith:
            - 'WsmPty.xsl'
            - 'WsmTxt.xsl'
    in_system_folder:
        TargetFilename|startswith:
            - 'C:\Windows\System32\'
            - 'C:\Windows\SysWOW64\'
    condition: system_files and not in_system_folder
falsepositives:
    - Unlikely
level: medium

title: Axios NPM Compromise Indicators - Linux
id: 0a23a62d-c5b3-468b-a072-25064a9a8c87
status: experimental
description: |
    Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3.
    On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper.
    The dropper contacted a C2 server, delivered platform-specific payloads, deleted itself, and replaced package.json to evade detection.
references:
    - https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan
    - https://www.derp.ca/research/axios-npm-supply-chain-rat/
    - https://www.trendmicro.com/zh_hk/research/26/c/axios-npm-package-compromised.html
    - https://www.elastic.co/security-labs/axios-supply-chain-compromise-detections
    - https://www.virustotal.com/gui/file/e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2026-04-01
tags:
    - attack.initial-access
    - attack.t1195.002
    - attack.execution
    - attack.command-and-control
    - attack.t1059.006
    - attack.t1059.004
    - attack.t1105
    - detection.emerging-threats
logsource:
    category: process_creation
    product: linux
detection:
    selection_node_shell:
        ParentImage|endswith:
            - '/node'
            - '/bun'
        CommandLine|contains|all:
            - 'curl '
            - '/tmp/ld.py'
            - 'python3 '
            - 'nohup '
            - '6202033'
    selection_curl_download:
        Image|endswith: '/curl'
        CommandLine|contains: 'http://sfrclak.com'
    condition: 1 of selection_*
falsepositives:
    - Unlikely
level: high

title: Azure AD Only Single Factor Authentication Required
id: 28eea407-28d7-4e42-b0be-575d5ba60b2c
status: test
description: Detect when users are authenticating without MFA being required.
references:
    - https://learn.microsoft.com/en-gb/entra/architecture/security-operations-user-accounts
author: MikeDuddington, '@dudders1'
date: 2022-07-27
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.initial-access
    - attack.credential-access
    - attack.stealth
    - attack.defense-impairment
    - attack.t1078.004
    - attack.t1556.006
logsource:
    product: azure
    service: signinlogs
detection:
    selection:
        Status: 'Success'
        AuthenticationRequirement: 'singleFactorAuthentication'
    condition: selection
falsepositives:
    - If this was approved by System Administrator.
level: low

title: BaaUpdate.exe Suspicious DLL Load
id: 6e8fe0a8-ba0b-4a93-8f9e-82657e7a5984
related:
    - id: 9f38c1db-e2ae-40bf-81d0-5b68f73fb512 # Suspicious BitLocker Access Agent Update Utility Execution
      type: similar
status: experimental
description: |
    Detects BitLocker Access Agent Update Utility (baaupdate.exe) loading DLLs from suspicious locations that are publicly writable which could indicate an attempt to lateral movement via BitLocker DCOM & COM Hijacking.
    This technique abuses COM Classes configured as INTERACTIVE USER to spawn processes in the context of the logged-on user's session. Specifically, it targets the BDEUILauncher Class (CLSID ab93b6f1-be76-4185-a488-a9001b105b94)
    which can launch BaaUpdate.exe, which is vulnerable to COM Hijacking when started with input parameters. This allows attackers to execute code in the user's context without needing to steal credentials or use additional techniques to compromise the account.
references:
    - https://github.com/rtecCyberSec/BitlockMove
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-10-18
tags:
    - attack.stealth
    - attack.t1218
    - attack.lateral-movement
    - attack.t1021.003
logsource:
    category: image_load
    product: windows
detection:
    selection:
        Image|endswith: '\BaaUpdate.exe'
        ImageLoaded|endswith: '.dll'
        ImageLoaded|contains:
            - ':\Perflogs\'
            - ':\Users\Default\'
            - ':\Users\Public\'
            - ':\Windows\Temp\'
            - '\AppData\Local\Temp\'
            - '\AppData\Roaming\'
            - '\Contacts\'
            - '\Favorites\'
            - '\Favourites\'
            - '\Links\'
            - '\Music\'
            - '\Pictures\'
            - '\ProgramData\'
            - '\Temporary Internet'
            - '\Videos\'
    condition: selection
falsepositives:
    - Unknown
level: high

title: Change Default File Association To Executable Via Assoc
id: ae6f14e6-14de-45b0-9f44-c0986f50dc89
related:
    - id: 3d3aa6cd-6272-44d6-8afc-7e88dfef7061
      type: derived
status: test
description: |
    Detects when a program changes the default file association of any extension to an executable.
    When a file is opened, the default program used to open the file (also called the file association or handler) is checked. File association selections are stored in the Windows Registry and can be edited by users, administrators, or programs that have Registry access or by administrators using the built-in assoc utility. Applications can modify the file association for a given file extension to call an arbitrary program when a file with the given extension is opened.
references:
    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/assoc
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-06-28
modified: 2023-03-06
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1546.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\cmd.exe'
        - OriginalFileName: 'Cmd.Exe'
    selection_cli:
        CommandLine|contains|all:
            - 'assoc '
            - 'exefile'
    filter:
        CommandLine|contains: '.exe=exefile'
    condition: all of selection_* and not filter
falsepositives:
    - Unknown
level: high

title: Clipboard Collection with Xclip Tool - Auditd
id: 214e7e6c-f21b-47ff-bb6f-551b2d143fcf
status: test
description: |
  Detects attempts to collect data stored in the clipboard from users with the usage of xclip tool.
  Xclip has to be installed.
  Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations.
references:
    - https://linux.die.net/man/1/xclip
    - https://www.cyberciti.biz/faq/xclip-linux-insert-files-command-output-intoclipboard/
author: 'Pawel Mazur'
date: 2021-09-24
modified: 2022-11-26
tags:
    - attack.collection
    - attack.t1115
logsource:
    product: linux
    service: auditd
detection:
    selection:
        type: EXECVE
        a0: xclip
        a1:
            - '-selection'
            - '-sel'
        a2:
            - clipboard
            - clip
        a3: '-o'
    condition: selection
falsepositives:
    - Legitimate usage of xclip tools
level: low

title: Denied Access To Remote Desktop
id: 8e5c03fa-b7f0-11ea-b242-07e0576828d9
status: test
description: |
  This event is generated when an authenticated user who is not allowed to log on remotely attempts to connect to this computer through Remote Desktop.
  Often, this event can be generated by attackers when searching for available windows servers in the network.
references:
    - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4825
author: Pushkarev Dmitry
date: 2020-06-27
modified: 2021-11-27
tags:
    - attack.lateral-movement
    - attack.t1021.001
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4825
    condition: selection
falsepositives:
    - Valid user was not added to RDP group
level: medium

title: Disabled guest or builtin account activated (command)
description: Detects scenarios where an attacker enables a disabled builtin account via command line.
references:
- https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/
tags:
- attack.persistence
- attack.t1098
author: mdecrevoisier
logsource:
  product: windows
  category: process_creation
detection:
  selection: # Full command example: 'net user DefaultAccount /active:yes'
    EventID: 4688
    NewProcessName|endswith:
      - \net1.exe
      - \net.exe
    CommandLine|contains|all:
      - user
      - active
      - 'yes'
    CommandLine|contains:
      - Guest
      - DefaultAccount
      - support_388945a0   # Remote assistance
      - HelpAssistant      # Managed by Remote Desktop Help Session Manager service
      - WDAGUtilityAccount # Defender Application Guard
  condition: selection
falsepositives:
- None
level: high

title: Exploitation Attempt Of CVE-2020-1472 - Execution of ZeroLogon PoC
id: dcc6a01e-9471-44a0-a699-71ea96f8ed8b
status: test
description: Detects the execution of the commonly used ZeroLogon PoC executable.
references:
    - https://thedfirreport.com/2021/11/01/from-zero-to-domain-admin/
    - https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/
author: '@Kostastsale, TheDFIRReport'
date: 2022-02-12
tags:
    - attack.execution
    - attack.lateral-movement
    - attack.t1210
    - cve.2020-1472
    - detection.emerging-threats
logsource:
    product: windows
    category: process_creation
detection:
    selection_main:
        ParentImage|endswith: '\cmd.exe'
        Image|endswith:
            - '\cool.exe'
            - '\zero.exe'
        CommandLine|contains|all:
            - 'Administrator'
            - '-c'
    selection_payloads_1:
        CommandLine|contains|all:
            - 'taskkill'
            - '/f'
            - '/im'
    selection_payloads_2:
        CommandLine|contains: 'powershell'
    condition: selection_main and 1 of selection_payloads_*
falsepositives:
    - Unknown
level: high

title: File and Directory Discovery - MacOS
id: 089dbdf6-b960-4bcc-90e3-ffc3480c20f6
status: test
description: Detects usage of system utilities to discover files and directories
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1083/T1083.md
author: Daniil Yugoslavskiy, oscd.community
date: 2020-10-19
modified: 2022-11-25
tags:
    - attack.discovery
    - attack.t1083
logsource:
    category: process_creation
    product: macos
detection:
    select_file_with_asterisk:
        Image: '/usr/bin/file'
        CommandLine|re: '(.){200,}' # execution of the 'file */* *>> /tmp/output.txt' will produce huge commandline
    select_recursive_ls:
        Image: '/bin/ls'
        CommandLine|contains: '-R'
    select_find_execution:
        Image: '/usr/bin/find'
    select_mdfind_execution:
        Image: '/usr/bin/mdfind'
    select_tree_execution|endswith:
        Image: '/tree'
    condition: 1 of select*
falsepositives:
    - Legitimate activities
level: informational

title: File Download Via Bitsadmin
id: d059842b-6b9d-4ed1-b5c3-5b89143c6ede
status: test
description: Detects usage of bitsadmin downloading a file
references:
    - https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin
    - https://isc.sans.edu/diary/22264
    - https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/
author: Michael Haag, FPT.EagleEye
date: 2017-03-09
modified: 2023-02-15
tags:
    - attack.persistence
    - attack.execution
    - attack.stealth
    - attack.t1197
    - attack.s0190
    - attack.t1036.003
    - attack.command-and-control
    - attack.t1105
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\bitsadmin.exe'
        - OriginalFileName: 'bitsadmin.exe'
    selection_cmd:
        CommandLine|contains: ' /transfer '
    selection_cli_1:
        CommandLine|contains:
            - ' /create '
            - ' /addfile '
    selection_cli_2:
        CommandLine|contains: 'http'
    condition: selection_img and (selection_cmd or all of selection_cli_*)
falsepositives:
    - Some legitimate apps use this, but limited.
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_bitsadmin_download/info.yml
simulation:
    - type: atomic-red-team
      name: Windows - BITSAdmin BITS Download
      technique: T1105
      atomic_guid: a1921cd3-9a2d-47d5-a891-f1d0f2a7a31b

title: Huawei BGP Authentication Failures
id: a557ffe6-ac54-43d2-ae69-158027082350
status: test
description: Detects BGP failures which may be indicative of brute force attacks to manipulate routing.
references:
    - https://www.blackhat.com/presentations/bh-usa-03/bh-us-03-convery-franz-v3.pdf
author: Tim Brown
date: 2023-01-09
modified: 2023-01-23
tags:
    - attack.initial-access
    - attack.persistence
    - attack.privilege-escalation
    - attack.credential-access
    - attack.collection
    - attack.stealth
    - attack.t1078
    - attack.t1110
    - attack.t1557
logsource:
    product: huawei
    service: bgp
    definition: 'Requirements: huawei bgp logs need to be enabled and ingested'
detection:
    keywords_bgp_huawei:
        '|all':
            - ':179' # Protocol
            - 'BGP_AUTH_FAILED'
    condition: keywords_bgp_huawei
falsepositives:
    - Unlikely. Except due to misconfigurations
level: low

title: Imports Registry Key From an ADS
id: 0b80ade5-6997-4b1d-99a1-71701778ea61
related:
    - id: 73bba97f-a82d-42ce-b315-9182e76c57b1
      type: similar
status: test
description: Detects the import of a alternate datastream to the registry with regedit.exe.
references:
    - https://lolbas-project.github.io/lolbas/Binaries/Regedit/
    - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
author: Oddvar Moe, Sander Wiebing, oscd.community
date: 2020-10-12
modified: 2024-03-13
tags:
    - attack.persistence
    - attack.defense-impairment
    - attack.t1112
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\regedit.exe'
        - OriginalFileName: 'REGEDIT.EXE'
    selection_cli:
        CommandLine|contains:
            - ' /i '
            - '.reg'
        CommandLine|re: ':[^ \\]'
    filter:
        CommandLine|contains|windash:
            - ' -e '
            - ' -a '
            - ' -c '
    condition: all of selection_* and not filter
falsepositives:
    - Unknown
level: high

title: Massive SAM users/groups enumeration (native)
name: SAM_enumeration_user_group
description: Detects scenarios where an attacker attempts to enumerate sensitive domain users/groups settings and membership. Correlate TargetLogonId from ID 4624 with SubjectLogonId from ID 4661 to identify the source of the enumeration.
requirements: extended rights auditing enabled (https://www.manageengine.com/products/active-directory-audit/active-directory-auditing-configuration-guide-configure-object-level-auditing-manually.html)
references:
  - https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0007-Discovery/T1069-Permission%20Groups%20Discovery
  - https://bitvijays.github.io/LFF-IPS-P3-Exploitation.html
tags:
  - attack.discovery
  - attack.t1069.002
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection: # net group <domain_group> /domain
  selection:
    EventID: 4661
    ProcessName|endswith: '\lsass.exe'
    ObjectServer: "Security Account Manager"
    ObjectName|startswith:
      - S-1-5-32- # refers to builtin domain local groups
      - S-1-5-21- # refers to domain users and groups
    ObjectType:
      - SAM_USER
      - SAM_GROUP
  filter:
    - SubjectUserName|endswith: "$"
    - ObjectName|endswith: # already covered in a separated rule for sensitive user & group enumeration
        - "-500" # local administrator
        - "-512" # Domain Admins
        - "-513" # Domain users (less critical)
  condition: selection and not filter
falsepositives:
  - Administrator activity
level: informational

---
title: Massive SAM users/groups enumeration (native)
status: experimental
correlation:
  type: value_count
  rules:
    - SAM_enumeration_user_group
  group-by:
    - Computer
  timespan: 15m
  condition:
    gte: 30
    field: ObjectName
level: high

title: Mstsc.EXE Execution With Local RDP File
id: 5fdce3ac-e7f9-4ecd-a3aa-a4d78ebbf0af
status: test
description: Detects potential RDP connection via Mstsc using a local ".rdp" file
references:
    - https://www.blackhillsinfosec.com/rogue-rdp-revisiting-initial-access-methods/
    - https://web.archive.org/web/20230726144748/https://blog.thickmints.dev/mintsights/detecting-rogue-rdp/
author: Nasreddine Bencherchali (Nextron Systems), Christopher Peacock @securepeacock
date: 2023-04-18
modified: 2023-04-30
tags:
    - attack.command-and-control
    - attack.t1219.002
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\mstsc.exe'
        - OriginalFileName: 'mstsc.exe'
    selection_cli:
        CommandLine|endswith:
            - '.rdp'
            - '.rdp"'
    filter_optional_wsl:
        ParentImage: 'C:\Windows\System32\lxss\wslhost.exe'
        CommandLine|contains: 'C:\ProgramData\Microsoft\WSL\wslg.rdp'
    condition: all of selection_* and not 1 of filter_optional_*
falsepositives:
    - Likely with legitimate usage of ".rdp" files
level: low

title: OpenSSH Server Listening On Socket
id: 3ce8e9a4-bc61-4c9b-8e69-d7e2492a8781
status: test
description: Detects scenarios where an attacker enables the OpenSSH server and server starts to listening on SSH socket.
references:
    - https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0008-Lateral%20Movement/T1021.004-Remote%20Service%20SSH
    - https://winaero.com/enable-openssh-server-windows-10/
    - https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse
    - https://virtualizationreview.com/articles/2020/05/21/ssh-server-on-windows-10.aspx
    - https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16
author: mdecrevoisier
date: 2022-10-25
tags:
    - attack.lateral-movement
    - attack.t1021.004
logsource:
    product: windows
    service: openssh
detection:
    selection:
        EventID: 4
        process: sshd
        payload|startswith: 'Server listening on '
    condition: selection
falsepositives:
    - Legitimate administrator activity
level: medium

title: Persistence Via Hhctrl.ocx
id: f10ed525-97fe-4fed-be7c-2feecca941b1
status: test
description: Detects when an attacker modifies the registry value of the "hhctrl" to point to a custom binary
references:
    - https://persistence-info.github.io/Data/hhctrl.html
    - https://www.hexacorn.com/blog/2018/04/23/beyond-good-ol-run-key-part-77/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-07-21
modified: 2023-08-17
tags:
    - attack.persistence
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: '\CLSID\{52A2AAAE-085D-4187-97EA-8C30DB990436}\InprocServer32\(Default)'
    filter:
        Details: 'C:\Windows\System32\hhctrl.ocx'
    condition: selection and not filter
falsepositives:
    - Unlikely
level: high

title: Ping Hex IP
id: 1a0d4aba-7668-4365-9ce4-6d79ab088dfd
status: test
description: Detects a ping command that uses a hex encoded IP address
references:
    - https://github.com/vysecurity/Aggressor-VYSEC/blob/0d61c80387b9432dab64b8b8a9fb52d20cfef80e/ping.cna
    - https://twitter.com/vysecurity/status/977198418354491392
author: Florian Roth (Nextron Systems)
date: 2018-03-23
modified: 2025-10-17
tags:
    - attack.stealth
    - attack.t1140
    - attack.t1027
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\ping.exe'
        CommandLine|re: '0x[a-fA-F0-9]{8}'
    condition: selection
falsepositives:
    - Unlikely, because no sane admin pings IP addresses in a hexadecimal form
level: high

title: Potential Credential Dumping Via WER
id: 9a4ccd1a-3526-4d99-b980-9f9c5d3a6ff3
status: test
description: Detects potential credential dumping via Windows Error Reporting LSASS Shtinkering technique which uses the Windows Error Reporting to dump lsass
references:
    - https://github.com/deepinstinct/Lsass-Shtinkering
    - https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Asaf%20Gilboa%20-%20LSASS%20Shtinkering%20Abusing%20Windows%20Error%20Reporting%20to%20Dump%20LSASS.pdf
author: '@pbssubhash , Nasreddine Bencherchali'
date: 2022-12-08
modified: 2022-12-09
tags:
    - attack.credential-access
    - attack.t1003.001
logsource:
    product: windows
    category: process_creation
detection:
    selection_img:
        - Image|endswith: '\Werfault.exe'
        - OriginalFileName: 'WerFault.exe'
    selection_cli:
        ParentUser|contains: # covers many language settings
            - 'AUTHORI'
            - 'AUTORI'
        User|contains:
            - 'AUTHORI'
            - 'AUTORI'
        CommandLine|contains|all:
            # Doc: WerFault.exe -u -p <target process> -ip <source process> -s <file mapping handle>
            # Example: C:\Windows\system32\Werfault.exe -u -p 744 -ip 1112 -s 244
            # If the source process is not equal to the target process and the target process is LSASS then this is an indication of this technique
            # Example: If the "-p" points the PID of "lsass.exe" and "-ip" points to a different process than "lsass.exe" then this is a sign of malicious activity
            - ' -u -p '
            - ' -ip '
            - ' -s '
    filter_lsass:
        ParentImage: 'C:\Windows\System32\lsass.exe'
    condition: all of selection_* and not 1 of filter_*
falsepositives:
    - Windows Error Reporting might produce similar behavior. In that case, check the PID associated with the "-p" parameter in the CommandLine.
level: high

title: Potential CVE-2022-26809 Exploitation Attempt
id: a7cd7306-df8b-4398-b711-6f3e4935cf16
status: test
description: Detects suspicious remote procedure call (RPC) service anomalies based on the spawned sub processes (long shot to detect the exploitation of vulnerabilities like CVE-2022-26809)
references:
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26809
    - https://www.bleepingcomputer.com/startups/RpcSs.exe-14544.html
    - https://twitter.com/cyb3rops/status/1514217991034097664
    - https://www.securonix.com/blog/cve-2022-26809-remote-procedure-call-runtime-remote-code-execution-vulnerability-and-coverage/
author: Florian Roth (Nextron Systems)
date: 2022-04-13
modified: 2023-02-03
tags:
    - attack.initial-access
    - attack.t1190
    - attack.execution
    - attack.t1569.002
    - cve.2022-26809
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage: 'C:\Windows\System32\svchost.exe'
        ParentCommandLine|contains: '-k RPCSS'
    condition: selection
falsepositives:
    - Unknown
    - Some cases in which the service spawned a werfault.exe process
level: high

title: Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 4
id: 225274c4-8dd1-40db-9e09-71dff4f6fb3c
status: test
description: Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.
author: '@Kostastsale, TheDFIRReport'
references:
    - Internal Research
tags:
    - attack.stealth
date: 2022-12-05
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        CommandLine|contains:
            - '🔸'
            - '🔹'
            - '🔶'
            - '🔷'
            - '🔳'
            - '🔲'
            - '▪️'
            - '▫️'
            - '◾️'
            - '◽️'
            - '◼️'
            - '◻️'
            - '🟥'
            - '🟧'
            - '🟨'
            - '🟩'
            - '🟦'
            - '🟪'
            - '⬛️'
            - '⬜️'
            - '🟫'
            - '🔈'
            - '🔇'
            - '🔉'
            - '🔊'
            - '🔔'
            - '🔕'
            - '📣'
            - '📢'
            - '👁‍🗨'
            - '💬'
            - '💭'
            - '🗯'
            - '♠️'
            - '♣️'
            - '♥️'
            - '♦️'
            - '🃏'
            - '🎴'
            - '🀄️'
            - '🕐'
            - '🕑'
            - '🕒'
            - '🕓'
            - '🕔'
            - '🕕'
            - '🕖'
            - '🕗'
            - '🕘'
            - '🕙'
            - '🕚'
            - '🕛'
            - '🕜'
            - '🕝'
            - '🕞'
            - '🕟'
            - '🕠'
            - '🕡'
            - '🕢'
            - '🕣'
            - '🕤'
            - '🕥'
            - '🕦'
            - '🕧✢'
            - '✣'
            - '✤'
            - '✥'
            - '✦'
            - '✧'
            - '★'
            - '☆'
            - '✯'
            - '✡︎'
            - '✩'
            - '✪'
            - '✫'
            - '✬'
            - '✭'
            - '✮'
            - '✶'
            - '✷'
            - '✵'
            - '✸'
            - '✹'
            - '→'
            - '⇒'
            - '⟹'
            - '⇨'
            - '⇾'
            - '➾'
            - '⇢'
            - '☛'
            - '☞'
            - '➔'
            - '➜'
            - '➙'
            - '➛'
            - '➝'
            - '➞'
            - '♠︎'
            - '♣︎'
            - '♥︎'
            - '♦︎'
            - '♤'
            - '♧'
            - '♡'
            - '♢'
            - '♚'
            - '♛'
            - '♜'
            - '♝'
            - '♞'
            - '♟'
            - '♔'
            - '♕'
            - '♖'
            - '♗'
            - '♘'
            - '♙'
            - '⚀'
            - '⚁'
            - '⚂'
            - '⚃'
            - '⚄'
            - '⚅'
            - '🂠'
            - '⚈'
            - '⚉'
            - '⚆'
            - '⚇'
            - '𓀀'
            - '𓀁'
            - '𓀂'
            - '𓀃'
            - '𓀄'
            - '𓀅'
            - '𓀆'
            - '𓀇'
            - '𓀈'
            - '𓀉'
            - '𓀊'
            - '𓀋'
            - '𓀌'
            - '𓀍'
            - '𓀎'
            - '𓀏'
            - '𓀐'
            - '𓀑'
            - '𓀒'
            - '𓀓'
            - '𓀔'
            - '𓀕'
            - '𓀖'
            - '𓀗'
            - '𓀘'
            - '𓀙'
            - '𓀚'
            - '𓀛'
            - '𓀜'
            - '𓀝🏳️'
            - '🏴'
            - '🏁'
            - '🚩'
            - '🏳️‍🌈'
            - '🏳️‍⚧️'
            - '🏴‍☠️'
            - '🇦🇫'
            - '🇦🇽'
            - '🇦🇱'
            - '🇩🇿'
            - '🇦🇸'
            - '🇦🇩'
            - '🇦🇴'
            - '🇦🇮'
            - '🇦🇶'
            - '🇦🇬'
            - '🇦🇷'
            - '🇦🇲'
            - '🇦🇼'
            - '🇦🇺'
            - '🇦🇹'
            - '🇦🇿'
            - '🇧🇸'
            - '🇧🇭'
            - '🇧🇩'
            - '🇧🇧'
            - '🇧🇾'
            - '🇧🇪'
            - '🇧🇿'
            - '🇧🇯'
            - '🇧🇲'
            - '🇧🇹'
            - '🇧🇴'
            - '🇧🇦'
            - '🇧🇼'
            - '🇧🇷'
            - '🇮🇴'
            - '🇻🇬'
            - '🇧🇳'
            - '🇧🇬'
            - '🇧🇫'
            - '🇧🇮'
            - '🇰🇭'
            - '🇨🇲'
            - '🇨🇦'
            - '🇮🇨'
            - '🇨🇻'
            - '🇧🇶'
            - '🇰🇾'
            - '🇨🇫'
            - '🇹🇩'
            - '🇨🇱'
            - '🇨🇳'
            - '🇨🇽'
            - '🇨🇨'
            - '🇨🇴'
            - '🇰🇲'
            - '🇨🇬'
            - '🇨🇩'
            - '🇨🇰'
            - '🇨🇷'
            - '🇨🇮'
            - '🇭🇷'
            - '🇨🇺'
            - '🇨🇼'
            - '🇨🇾'
            - '🇨🇿'
            - '🇩🇰'
            - '🇩🇯'
            - '🇩🇲'
            - '🇩🇴'
            - '🇪🇨'
            - '🇪🇬'
            - '🇸🇻'
            - '🇬🇶'
            - '🇪🇷'
            - '🇪🇪'
            - '🇪🇹'
            - '🇪🇺'
            - '🇫🇰'
            - '🇫🇴'
            - '🇫🇯'
            - '🇫🇮'
            - '🇫🇷'
            - '🇬🇫'
            - '🇵🇫'
            - '🇹🇫'
            - '🇬🇦'
            - '🇬🇲'
            - '🇬🇪'
            - '🇩🇪'
            - '🇬🇭'
            - '🇬🇮'
            - '🇬🇷'
            - '🇬🇱'
            - '🇬🇩'
            - '🇬🇵'
            - '🇬🇺'
            - '🇬🇹'
            - '🇬🇬'
            - '🇬🇳'
            - '🇬🇼'
            - '🇬🇾'
            - '🇭🇹'
            - '🇭🇳'
            - '🇭🇰'
            - '🇭🇺'
            - '🇮🇸'
            - '🇮🇳'
            - '🇮🇩'
            - '🇮🇷'
            - '🇮🇶'
            - '🇮🇪'
            - '🇮🇲'
            - '🇮🇱'
            - '🇮🇹'
            - '🇯🇲'
            - '🇯🇵'
            - '🎌'
            - '🇯🇪'
            - '🇯🇴'
            - '🇰🇿'
            - '🇰🇪'
            - '🇰🇮'
            - '🇽🇰'
            - '🇰🇼'
            - '🇰🇬'
            - '🇱🇦'
            - '🇱🇻'
            - '🇱🇧'
            - '🇱🇸'
            - '🇱🇷'
            - '🇱🇾'
            - '🇱🇮'
            - '🇱🇹'
            - '🇱🇺'
            - '🇲🇴'
            - '🇲🇰'
            - '🇲🇬'
            - '🇲🇼'
            - '🇲🇾'
            - '🇲🇻'
            - '🇲🇱'
            - '🇲🇹'
            - '🇲🇭'
            - '🇲🇶'
            - '🇲🇷'
            - '🇲🇺'
            - '🇾🇹'
            - '🇲🇽'
            - '🇫🇲'
            - '🇲🇩'
            - '🇲🇨'
            - '🇲🇳'
            - '🇲🇪'
            - '🇲🇸'
            - '🇲🇦'
            - '🇲🇿'
            - '🇲🇲'
            - '🇳🇦'
            - '🇳🇷'
            - '🇳🇵'
            - '🇳🇱'
            - '🇳🇨'
            - '🇳🇿'
            - '🇳🇮'
            - '🇳🇪'
            - '🇳🇬'
            - '🇳🇺'
            - '🇳🇫'
            - '🇰🇵'
            - '🇲🇵'
            - '🇳🇴'
            - '🇴🇲'
            - '🇵🇰'
            - '🇵🇼'
            - '🇵🇸'
            - '🇵🇦'
            - '🇵🇬'
            - '🇵🇾'
            - '🇵🇪'
            - '🇵🇭'
            - '🇵🇳'
            - '🇵🇱'
            - '🇵🇹'
            - '🇵🇷'
            - '🇶🇦'
            - '🇷🇪'
            - '🇷🇴'
            - '🇷🇺'
            - '🇷🇼'
            - '🇼🇸'
            - '🇸🇲'
            - '🇸🇦'
            - '🇸🇳'
            - '🇷🇸'
            - '🇸🇨'
            - '🇸🇱'
            - '🇸🇬'
            - '🇸🇽'
            - '🇸🇰'
            - '🇸🇮'
            - '🇬🇸'
            - '🇸🇧'
            - '🇸🇴'
            - '🇿🇦'
            - '🇰🇷'
            - '🇸🇸'
            - '🇪🇸'
            - '🇱🇰'
            - '🇧🇱'
            - '🇸🇭'
            - '🇰🇳'
            - '🇱🇨'
            - '🇵🇲'
            - '🇻🇨'
            - '🇸🇩'
            - '🇸🇷'
            - '🇸🇿'
            - '🇸🇪'
            - '🇨🇭'
            - '🇸🇾'
            - '🇹🇼'
            - '🇹🇯'
            - '🇹🇿'
            - '🇹🇭'
            - '🇹🇱'
            - '🇹🇬'
            - '🇹🇰'
            - '🇹🇴'
            - '🇹🇹'
            - '🇹🇳'
            - '🇹🇷'
            - '🇹🇲'
            - '🇹🇨'
            - '🇹🇻'
            - '🇻🇮'
            - '🇺🇬'
            - '🇺🇦'
            - '🇦🇪'
            - '🇬🇧'
            - '🏴󠁧󠁢󠁥󠁮󠁧󠁿'
            - '🏴󠁧󠁢󠁳󠁣󠁴󠁿'
            - '🏴󠁧󠁢󠁷󠁬󠁳󠁿'
            - '🇺🇳'
            - '🇺🇸'
            - '🇺🇾'
            - '🇺🇿'
            - '🇻🇺'
            - '🇻🇦'
            - '🇻🇪'
            - '🇻🇳'
            - '🇼🇫'
            - '🇪🇭'
            - '🇾🇪'
            - '🇿🇲'
            - '🇿🇼🫠'
            - '🫢'
            - '🫣'
            - '🫡'
            - '🫥'
            - '🫤'
            - '🥹'
            - '🫱'
            - '🫱🏻'
            - '🫱🏼'
            - '🫱🏽'
            - '🫱🏾'
            - '🫱🏿'
            - '🫲'
            - '🫲🏻'
            - '🫲🏼'
            - '🫲🏽'
            - '🫲🏾'
            - '🫲🏿'
            - '🫳'
            - '🫳🏻'
            - '🫳🏼'
            - '🫳🏽'
            - '🫳🏾'
            - '🫳🏿'
            - '🫴'
            - '🫴🏻'
            - '🫴🏼'
            - '🫴🏽'
            - '🫴🏾'
            - '🫴🏿'
            - '🫰'
            - '🫰🏻'
            - '🫰🏼'
            - '🫰🏽'
            - '🫰🏾'
            - '🫰🏿'
            - '🫵'
            - '🫵🏻'
            - '🫵🏼'
            - '🫵🏽'
            - '🫵🏾'
            - '🫵🏿'
            - '🫶'
            - '🫶🏻'
            - '🫶🏼'
            - '🫶🏽'
            - '🫶🏾'
            - '🫶🏿'
            - '🤝🏻'
            - '🤝🏼'
            - '🤝🏽'
            - '🤝🏾'
            - '🤝🏿'
            - '🫱🏻‍🫲🏼'
            - '🫱🏻‍🫲🏽'
            - '🫱🏻‍🫲🏾'
            - '🫱🏻‍🫲🏿'
            - '🫱🏼‍🫲🏻'
            - '🫱🏼‍🫲🏽'
            - '🫱🏼‍🫲🏾'
            - '🫱🏼‍🫲🏿'
            - '🫱🏽‍🫲🏻'
            - '🫱🏽‍🫲🏼'
            - '🫱🏽‍🫲🏾'
            - '🫱🏽‍🫲🏿'
            - '🫱🏾‍🫲🏻'
            - '🫱🏾‍🫲🏼'
            - '🫱🏾‍🫲🏽'
            - '🫱🏾‍🫲🏿'
            - '🫱🏿‍🫲🏻'
            - '🫱🏿‍🫲🏼'
            - '🫱🏿‍🫲🏽'
            - '🫱🏿‍🫲🏾'
            - '🫦'
            - '🫅'
            - '🫅🏻'
            - '🫅🏼'
            - '🫅🏽'
            - '🫅🏾'
            - '🫅🏿'
            - '🫃'
            - '🫃🏻'
            - '🫃🏼'
            - '🫃🏽'
            - '🫃🏾'
            - '🫃🏿'
            - '🫄'
            - '🫄🏻'
            - '🫄🏼'
            - '🫄🏽'
            - '🫄🏾'
            - '🫄🏿'
            - '🧌'
            - '🪸'
            - '🪷'
            - '🪹'
            - '🪺'
            - '🫘'
            - '🫗'
            - '🫙'
            - '🛝'
            - '🛞'
            - '🛟'
            - '🪬'
            - '🪩'
            - '🪫'
            - '🩼'
            - '🩻'
            - '🫧'
            - '🪪'
            - '🟰'
            - '😮‍💨'
            - '😵‍💫'
            - '😶‍🌫️'
            - '❤️‍🔥'
            - '❤️‍🩹'
            - '🧔‍♀️'
            - '🧔🏻‍♀️'
            - '🧔🏼‍♀️'
            - '🧔🏽‍♀️'
            - '🧔🏾‍♀️'
            - '🧔🏿‍♀️'
            - '🧔‍♂️'
            - '🧔🏻‍♂️'
            - '🧔🏼‍♂️'
            - '🧔🏽‍♂️'
            - '🧔🏾‍♂️'
            - '🧔🏿‍♂️'
            - '💑🏻'
            - '💑🏼'
            - '💑🏽'
            - '💑🏾'
            - '💑🏿'
            - '💏🏻'
            - '💏🏼'
            - '💏🏽'
            - '💏🏾'
            - '💏🏿'
            - '👨🏻‍❤️‍👨🏻'
            - '👨🏻‍❤️‍👨🏼'
            - '👨🏻‍❤️‍👨🏽'
            - '👨🏻‍❤️‍👨🏾'
            - '👨🏻‍❤️‍👨🏿'
            - '👨🏼‍❤️‍👨🏻'
            - '👨🏼‍❤️‍👨🏼'
            - '👨🏼‍❤️‍👨🏽'
            - '👨🏼‍❤️‍👨🏾'
            - '👨🏼‍❤️‍👨🏿'
            - '👨🏽‍❤️‍👨🏻'
            - '👨🏽‍❤️‍👨🏼'
            - '👨🏽‍❤️‍👨🏽'
            - '👨🏽‍❤️‍👨🏾'
            - '👨🏽‍❤️‍👨🏿'
            - '👨🏾‍❤️‍👨🏻'
            - '👨🏾‍❤️‍👨🏼'
            - '👨🏾‍❤️‍👨🏽'
            - '👨🏾‍❤️‍👨🏾'
            - '👨🏾‍❤️‍👨🏿'
            - '👨🏿‍❤️‍👨🏻'
            - '👨🏿‍❤️‍👨🏼'
            - '👨🏿‍❤️‍👨🏽'
            - '👨🏿‍❤️‍👨🏾'
            - '👨🏿‍❤️‍👨🏿'
            - '👩🏻‍❤️‍👨🏻'
            - '👩🏻‍❤️‍👨🏼'
            - '👩🏻‍❤️‍👨🏽'
            - '👩🏻‍❤️‍👨🏾'
            - '👩🏻‍❤️‍👨🏿'
            - '👩🏻‍❤️‍👩🏻'
            - '👩🏻‍❤️‍👩🏼'
            - '👩🏻‍❤️‍👩🏽'
            - '👩🏻‍❤️‍👩🏾'
            - '👩🏻‍❤️‍👩🏿'
            - '👩🏼‍❤️‍👨🏻'
            - '👩🏼‍❤️‍👨🏼'
            - '👩🏼‍❤️‍👨🏽'
            - '👩🏼‍❤️‍👨🏾'
            - '👩🏼‍❤️‍👨🏿'
            - '👩🏼‍❤️‍👩🏻'
            - '👩🏼‍❤️‍👩🏼'
            - '👩🏼‍❤️‍👩🏽'
            - '👩🏼‍❤️‍👩🏾'
            - '👩🏼‍❤️‍👩🏿'
            - '👩🏽‍❤️‍👨🏻'
            - '👩🏽‍❤️‍👨🏼'
            - '👩🏽‍❤️‍👨🏽'
            - '👩🏽‍❤️‍👨🏾'
            - '👩🏽‍❤️‍👨🏿'
            - '👩🏽‍❤️‍👩🏻'
            - '👩🏽‍❤️‍👩🏼'
            - '👩🏽‍❤️‍👩🏽'
            - '👩🏽‍❤️‍👩🏾'
            - '👩🏽‍❤️‍👩🏿'
            - '👩🏾‍❤️‍👨🏻'
            - '👩🏾‍❤️‍👨🏼'
            - '👩🏾‍❤️‍👨🏽'
            - '👩🏾‍❤️‍👨🏾'
            - '👩🏾‍❤️‍👨🏿'
            - '👩🏾‍❤️‍👩🏻'
            - '👩🏾‍❤️‍👩🏼'
            - '👩🏾‍❤️‍👩🏽'
            - '👩🏾‍❤️‍👩🏾'
            - '👩🏾‍❤️‍👩🏿'
            - '👩🏿‍❤️‍👨🏻'
            - '👩🏿‍❤️‍👨🏼'
            - '👩🏿‍❤️‍👨🏽'
            - '👩🏿‍❤️‍👨🏾'
            - '👩🏿‍❤️‍👨🏿'
            - '👩🏿‍❤️‍👩🏻'
            - '👩🏿‍❤️‍👩🏼'
            - '👩🏿‍❤️‍👩🏽'
            - '👩🏿‍❤️‍👩🏾'
            - '👩🏿‍❤️‍👩🏿'
            - '🧑🏻‍❤️‍🧑🏼'
            - '🧑🏻‍❤️‍🧑🏽'
            - '🧑🏻‍❤️‍🧑🏾'
            - '🧑🏻‍❤️‍🧑🏿'
            - '🧑🏼‍❤️‍🧑🏻'
            - '🧑🏼‍❤️‍🧑🏽'
            - '🧑🏼‍❤️‍🧑🏾'
            - '🧑🏼‍❤️‍🧑🏿'
            - '🧑🏽‍❤️‍🧑🏻'
            - '🧑🏽‍❤️‍🧑🏼'
            - '🧑🏽‍❤️‍🧑🏾'
            - '🧑🏽‍❤️‍🧑🏿'
            - '🧑🏾‍❤️‍🧑🏻'
            - '🧑🏾‍❤️‍🧑🏼'
            - '🧑🏾‍❤️‍🧑🏽'
            - '🧑🏾‍❤️‍🧑🏿'
            - '🧑🏿‍❤️‍🧑🏻'
            - '🧑🏿‍❤️‍🧑🏼'
            - '🧑🏿‍❤️‍🧑🏽'
            - '🧑🏿‍❤️‍🧑🏾'
            - '👨🏻‍❤️‍💋‍👨🏻'
            - '👨🏻‍❤️‍💋‍👨🏼'
            - '👨🏻‍❤️‍💋‍👨🏽'
            - '👨🏻‍❤️‍💋‍👨🏾'
            - '👨🏻‍❤️‍💋‍👨🏿'
            - '👨🏼‍❤️‍💋‍👨🏻'
            - '👨🏼‍❤️‍💋‍👨🏼'
            - '👨🏼‍❤️‍💋‍👨🏽'
            - '👨🏼‍❤️‍💋‍👨🏾'
            - '👨🏼‍❤️‍💋‍👨🏿'
            - '👨🏽‍❤️‍💋‍👨🏻'
            - '👨🏽‍❤️‍💋‍👨🏼'
            - '👨🏽‍❤️‍💋‍👨🏽'
            - '👨🏽‍❤️‍💋‍👨🏾'
            - '👨🏽‍❤️‍💋‍👨🏿'
            - '👨🏾‍❤️‍💋‍👨🏻'
            - '👨🏾‍❤️‍💋‍👨🏼'
            - '👨🏾‍❤️‍💋‍👨🏽'
            - '👨🏾‍❤️‍💋‍👨🏾'
            - '👨🏾‍❤️‍💋‍👨🏿'
            - '👨🏿‍❤️‍💋‍👨🏻'
            - '👨🏿‍❤️‍💋‍👨🏼'
            - '👨🏿‍❤️‍💋‍👨🏽'
            - '👨🏿‍❤️‍💋‍👨🏾'
            - '👨🏿‍❤️‍💋‍👨🏿'
            - '👩🏻‍❤️‍💋‍👨🏻'
            - '👩🏻‍❤️‍💋‍👨🏼'
            - '👩🏻‍❤️‍💋‍👨🏽'
            - '👩🏻‍❤️‍💋‍👨🏾'
            - '👩🏻‍❤️‍💋‍👨🏿'
            - '👩🏻‍❤️‍💋‍👩🏻'
            - '👩🏻‍❤️‍💋‍👩🏼'
            - '👩🏻‍❤️‍💋‍👩🏽'
            - '👩🏻‍❤️‍💋‍👩🏾'
            - '👩🏻‍❤️‍💋‍👩🏿'
            - '👩🏼‍❤️‍💋‍👨🏻'
            - '👩🏼‍❤️‍💋‍👨🏼'
            - '👩🏼‍❤️‍💋‍👨🏽'
            - '👩🏼‍❤️‍💋‍👨🏾'
            - '👩🏼‍❤️‍💋‍👨🏿'
            - '👩🏼‍❤️‍💋‍👩🏻'
            - '👩🏼‍❤️‍💋‍👩🏼'
            - '👩🏼‍❤️‍💋‍👩🏽'
            - '👩🏼‍❤️‍💋‍👩🏾'
            - '👩🏼‍❤️‍💋‍👩🏿'
            - '👩🏽‍❤️‍💋‍👨🏻'
            - '👩🏽‍❤️‍💋‍👨🏼'
            - '👩🏽‍❤️‍💋‍👨🏽'
            - '👩🏽‍❤️‍💋‍👨🏾'
            - '👩🏽‍❤️‍💋‍👨🏿'
            - '👩🏽‍❤️‍💋‍👩🏻'
            - '👩🏽‍❤️‍💋‍👩🏼'
            - '👩🏽‍❤️‍💋‍👩🏽'
            - '👩🏽‍❤️‍💋‍👩🏾'
            - '👩🏽‍❤️‍💋‍👩🏿'
            - '👩🏾‍❤️‍💋‍👨🏻'
            - '👩🏾‍❤️‍💋‍👨🏼'
            - '👩🏾‍❤️‍💋‍👨🏽'
            - '👩🏾‍❤️‍💋‍👨🏾'
            - '👩🏾‍❤️‍💋‍👨🏿'
            - '👩🏾‍❤️‍💋‍👩🏻'
            - '👩🏾‍❤️‍💋‍👩🏼'
            - '👩🏾‍❤️‍💋‍👩🏽'
            - '👩🏾‍❤️‍💋‍👩🏾'
            - '👩🏾‍❤️‍💋‍👩🏿'
            - '👩🏿‍❤️‍💋‍👨🏻'
            - '👩🏿‍❤️‍💋‍👨🏼'
            - '👩🏿‍❤️‍💋‍👨🏽'
            - '👩🏿‍❤️‍💋‍👨🏾'
            - '👩🏿‍❤️‍💋‍👨🏿'
            - '👩🏿‍❤️‍💋‍👩🏻'
            - '👩🏿‍❤️‍💋‍👩🏼'
            - '👩🏿‍❤️‍💋‍👩🏽'
            - '👩🏿‍❤️‍💋‍👩🏾'
            - '👩🏿‍❤️‍💋‍👩🏿'
            - '🧑🏻‍❤️‍💋‍🧑🏼'
            - '🧑🏻‍❤️‍💋‍🧑🏽'
            - '🧑🏻‍❤️‍💋‍🧑🏾'
            - '🧑🏻‍❤️‍💋‍🧑🏿'
            - '🧑🏼‍❤️‍💋‍🧑🏻'
            - '🧑🏼‍❤️‍💋‍🧑🏽'
            - '🧑🏼‍❤️‍💋‍🧑🏾'
            - '🧑🏼‍❤️‍💋‍🧑🏿'
            - '🧑🏽‍❤️‍💋‍🧑🏻'
            - '🧑🏽‍❤️‍💋‍🧑🏼'
            - '🧑🏽‍❤️‍💋‍🧑🏾'
            - '🧑🏽‍❤️‍💋‍🧑🏿'
            - '🧑🏾‍❤️‍💋‍🧑🏻'
            - '🧑🏾‍❤️‍💋‍🧑🏼'
            - '🧑🏾‍❤️‍💋‍🧑🏽'
            - '🧑🏾‍❤️‍💋‍🧑🏿'
            - '🧑🏿‍❤️‍💋‍🧑🏻'
            - '🧑🏿‍❤️‍💋‍🧑🏼'
            - '🧑🏿‍❤️‍💋‍🧑🏽'
            - '🧑🏿‍❤️‍💋‍🧑🏾'
    condition: selection
falsepositives:
    - Unknown
level: high