Detection rules ⺠Sigma
Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 1
Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth | No specific technique |
Event coverage
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
| Security-Auditing | Event ID 4688 | A new process has been created. |
Rule body yaml
title: Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 1
id: 4a30ac0c-b9d6-4e01-b71a-5f851bbf4259
status: test
description: Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.
author: '@Kostastsale, TheDFIRReport'
references:
- Internal Research
tags:
- attack.stealth
date: 2022-12-05
logsource:
product: windows
category: process_creation
detection:
selection:
CommandLine|contains:
- 'ð'
- 'ð'
- 'ð'
- 'ð'
- 'ð'
- 'ð
'
- 'ð'
- 'ð€£'
- 'ð¥²'
- 'ð¥¹'
- 'âºïž'
- 'ð'
- 'ð'
- 'ð'
- 'ð'
- 'ð'
- 'ð'
- 'ð'
- 'ð¥°'
- 'ð'
- 'ð'
- 'ð'
- 'ð'
- 'ð'
- 'ð'
- 'ð'
- 'ð'
- 'ð€ª'
- 'ð€š'
- 'ð§'
- 'ð€'
- 'ð'
- 'ð¥ž'
- 'ð€©'
- 'ð¥³'
- 'ð'
- 'ð'
- 'ð'
- 'ð'
- 'ð'
- 'ð'
- 'ð'
- 'â¹ïž'
- 'ð£'
- 'ð'
- 'ð«'
- 'ð©'
- 'ð¥º'
- 'ð¢'
- 'ð'
- 'ð®âðš'
- 'ð€'
- 'ð '
- 'ð¡'
- 'ð€¬'
- 'ð€¯'
- 'ð³'
- 'ð¥µ'
- 'ð¥¶'
- 'ð±'
- 'ðš'
- 'ð°'
- 'ð¥'
- 'ð'
- 'ð«£'
- 'ð€'
- 'ð«¡'
- 'ð€'
- 'ð«¢'
- 'ð€'
- 'ð€«'
- 'ð€¥'
- 'ð¶'
- 'ð¶âð«ïž'
- 'ð'
- 'ð'
- 'ð¬'
- 'ð« '
- 'ð'
- 'ð¯'
- 'ðŠ'
- 'ð§'
- 'ð®'
- 'ð²'
- 'ð¥±'
- 'ðŽ'
- 'ð€€'
- 'ðª'
- 'ðµ'
- 'ðµâð«'
- 'ð«¥'
- 'ð€'
- 'ð¥Ž'
- 'ð€¢'
- 'ð€®'
- 'ð€§'
- 'ð·'
- 'ð€'
- 'ð€'
- 'ð€'
- 'ð€ '
- 'ð'
- 'ð¿'
- 'ð¹'
- 'ðº'
- 'ð€¡'
- 'ð©'
- 'ð»'
- 'ð'
- 'â ïž'
- 'ðœ'
- 'ðŸ'
- 'ð€'
- 'ð'
- 'ðº'
- 'ðž'
- 'ð¹'
- 'ð»'
- 'ðŒ'
- 'ðœ'
- 'ð'
- 'ð¿'
- 'ðŸ'
- 'ð'
- 'ð€'
- 'ð'
- 'â'
- 'ð'
- 'ð'
- 'ð€'
- 'ð€'
- 'âïž'
- 'ð€'
- 'ð«°'
- 'ð€'
- 'ð€'
- 'ð€'
- 'ð«µ'
- 'ð«±'
- 'ð«²'
- 'ð«³'
- 'ð«Ž'
- 'ð'
- 'ð'
- 'ð'
- 'ð'
- 'ð'
- 'âïž'
- 'ð'
- 'ð'
- 'â'
- 'ð'
- 'ð€'
- 'ð€'
- 'ð'
- 'ð«¶'
- 'ð'
- 'ð'
- 'ð€²'
- 'ð€'
- 'ð'
- 'âïž'
- 'ðª'
- 'ðŠŸ'
- 'ðŠµ'
- 'ðŠ¿'
- 'ðŠ¶'
- 'ð£'
- 'ð'
- 'ðŠ»'
- 'ð'
- 'ð«'
- 'ð«'
- 'ð§ '
- 'ðŠ·'
- 'ðŠŽ'
- 'ð'
- 'ð'
- 'ð
'
- 'ð'
- 'ð«Š'
- 'ð'
- 'ð©ž'
- 'ð¶'
- 'ð§'
- 'ð§'
- 'ðŠ'
- 'ð©'
- 'ð§'
- 'ðš'
- 'ð©âðŠ±'
- 'ð§âðŠ±'
- 'ðšâðŠ±'
- 'ð©âðŠ°'
- 'ð§âðŠ°'
- 'ðšâðŠ°'
- 'ð±ââïž'
- 'ð±'
- 'ð±ââïž'
- 'ð©âðŠ³'
- 'ð§âðŠ³'
- 'ðšâðŠ³'
- 'ð©âðŠ²'
- 'ð§âðŠ²'
- 'ðšâðŠ²'
- 'ð§ââïž'
- 'ð§'
- 'ð§ââïž'
- 'ðµ'
- 'ð§'
- 'ðŽ'
- 'ð²'
- 'ð³ââïž'
- 'ð³'
- 'ð³ââïž'
- 'ð§'
- 'ð®ââïž'
- 'ð®'
- 'ð®ââïž'
- 'ð·ââïž'
- 'ð·'
- 'ð·ââïž'
- 'ðââïž'
- 'ð'
- 'ðââïž'
- 'ðµïžââïž'
- 'ðµïž'
- 'ðµïžââïž'
- 'ð©ââïž'
- 'ð§ââïž'
- 'ðšââïž'
- 'ð©âðŸ'
- 'ð§âðŸ'
- 'ðšâðŸ'
- 'ð©âð³'
- 'ð§âð³'
- 'ðšâð³'
- 'ð©âð'
- 'ð§âð'
- 'ðšâð'
- 'ð©âð€'
- 'ð§âð€'
- 'ðšâð€'
- 'ð©âð«'
- 'ð§âð«'
- 'ðšâð«'
- 'ð©âð'
- 'ð§âð'
- 'ðšâð'
- 'ð©âð»'
- 'ð§âð»'
- 'ðšâð»'
- 'ð©âðŒ'
- 'ð§âðŒ'
- 'ðšâðŒ'
- 'ð©âð§'
- 'ð§âð§'
- 'ðšâð§'
- 'ð©âð¬'
- 'ð§âð¬'
- 'ðšâð¬'
- 'ð©âðš'
- 'ð§âðš'
- 'ðšâðš'
- 'ð©âð'
- 'ð§âð'
- 'ðšâð'
- 'ð©ââïž'
- 'ð§ââïž'
- 'ðšââïž'
- 'ð©âð'
- 'ð§âð'
- 'ðšâð'
- 'ð©ââïž'
- 'ð§ââïž'
- 'ðšââïž'
- 'ð°ââïž'
- 'ð°'
- 'ð°ââïž'
- 'ð€µââïž'
- 'ð€µ'
- 'ð€µââïž'
- 'ðž'
- 'ð«
'
- 'ð€Ž'
- 'ð¥·'
- 'ðŠžââïž'
- 'ðŠž'
- 'ðŠžââïž'
- 'ðŠ¹ââïž'
- 'ðŠ¹'
- 'ðŠ¹ââïž'
- 'ð€¶'
- 'ð§âð'
- 'ð
'
- 'ð§ââïž'
- 'ð§'
- 'ð§ââïž'
- 'ð§ââïž'
- 'ð§'
- 'ð§ââïž'
- 'ð§ââïž'
- 'ð§'
- 'ð§ââïž'
- 'ð§ââïž'
- 'ð§'
- 'ð§ââïž'
- 'ð§ââïž'
- 'ð§'
- 'ð§ââïž'
- 'ð§ââïž'
- 'ð§'
- 'ð§ââïž'
- 'ð§ââïž'
- 'ð§'
- 'ð§ââïž'
- 'ð§'
- 'ðŒ'
- 'ð€°'
- 'ð«'
- 'ð«'
- 'ð€±'
- 'ð©âðŒ'
- 'ð§âðŒ'
- 'ðšâðŒ'
- 'ðââïž'
- 'ð'
- 'ðââïž'
- 'ðââïž'
- 'ð'
- 'ðââïž'
- 'ð
ââïž'
- 'ð
'
- 'ð
ââïž'
- 'ðââïž'
- 'ð'
- 'ðââïž'
- 'ðââïž'
- 'ð'
- 'ðââïž'
- 'ð§ââïž'
- 'ð§'
- 'ð§ââïž'
- 'ð€Šââïž'
- 'ð€Š'
- 'ð€Šââïž'
- 'ð€·ââïž'
- 'ð€·'
- 'ð€·ââïž'
- 'ðââïž'
- 'ð'
- 'ðââïž'
- 'ðââïž'
- 'ð'
- 'ðââïž'
- 'ðââïž'
- 'ð'
- 'ðââïž'
- 'ðââïž'
- 'ð'
- 'ðââïž'
- 'ð§ââïž'
- 'ð§'
- 'ð§ââïž'
- 'ð
'
- 'ð'
- 'ðº'
- 'ð¯ââïž'
- 'ð¯'
- 'ð¯ââïž'
- 'ðŽ'
- 'ð©âðŠœ'
- 'ð§âðŠœ'
- 'ðšâðŠœ'
- 'ð©âðŠŒ'
- 'ð§âðŠŒ'
- 'ðšâðŠŒ'
- 'ð¶ââïž'
- 'ð¶'
- 'ð¶ââïž'
- 'ð©âðŠ¯'
- 'ð§âðŠ¯'
- 'ðšâðŠ¯'
- 'ð§ââïž'
- 'ð§'
- 'ð§ââïž'
- 'ðââïž'
- 'ð'
- 'ðââïž'
- 'ð§ââïž'
- 'ð§'
- 'ð§ââïž'
- 'ð'
- 'ð§âð€âð§'
- 'ð¬'
- 'ð«'
- 'ð©ââ€ïžâð©'
- 'ð'
- 'ðšââ€ïžâðš'
- 'ð©ââ€ïžâðš'
- 'ð©ââ€ïžâðâð©'
- 'ð'
- 'ðšââ€ïžâðâðš'
- 'ð©ââ€ïžâðâðš'
- 'ðª'
- 'ðšâð©âðŠ'
- 'ðšâð©âð§'
- 'ðšâð©âð§âðŠ'
- 'ðšâð©âðŠâðŠ'
- 'ðšâð©âð§âð§'
- 'ðšâðšâðŠ'
- 'ðšâðšâð§'
- 'ðšâðšâð§âðŠ'
- 'ðšâðšâðŠâðŠ'
- 'ðšâðšâð§âð§'
- 'ð©âð©âðŠ'
- 'ð©âð©âð§'
- 'ð©âð©âð§âðŠ'
- 'ð©âð©âðŠâðŠ'
- 'ð©âð©âð§âð§'
- 'ðšâðŠ'
- 'ðšâðŠâðŠ'
- 'ðšâð§'
- 'ðšâð§âðŠ'
- 'ðšâð§âð§'
- 'ð©âðŠ'
- 'ð©âðŠâðŠ'
- 'ð©âð§'
- 'ð©âð§âðŠ'
- 'ð©âð§âð§'
- 'ð£'
- 'ð€'
- 'ð¥'
- 'ð«'
- 'ð§³'
- 'ð'
- 'âïž'
- 'ð§µ'
- 'ðª¡'
- 'ðª¢'
- 'ð§¶'
- 'ð'
- 'ð¶'
- 'ð¥œ'
- 'ð¥Œ'
- 'ðŠº'
- 'ð'
- 'ð'
- 'ð'
- 'ð§£'
- 'ð§€'
- 'ð§¥'
- 'ð§Š'
- 'ð'
- 'ð'
- 'ð¥»'
- 'ð©Ž'
- 'ð©±'
- 'ð©²'
- 'ð©³'
- 'ð'
- 'ð'
- 'ð'
- 'ð'
- 'ð'
- 'ð'
- 'ð'
- 'ð'
- 'ð¥Ÿ'
- 'ð¥¿'
- 'ð '
- 'ð¡'
- 'ð©°'
- 'ð¢'
- 'ð'
- 'ð'
- 'ð©'
- 'ð'
- 'ð§¢'
- 'â'
- 'ðª'
- 'ð'
- 'ð'
- 'ðŒ'
- 'ðð»'
- 'ð€ð»'
- 'ðð»'
- 'âð»'
- 'ðð»'
- 'ðð»'
- 'ð€ð»'
- 'ð€ð»'
- 'âð»'
- 'ð€ð»'
- 'ð«°ð»'
- 'ð€ð»'
- 'ð€ð»'
- 'ð€ð»'
- 'ð«µð»'
- 'ð«±ð»'
- 'ð«²ð»'
- 'ð«³ð»'
- 'ð«Žð»'
- 'ðð»'
- 'ðð»'
- 'ðð»'
- 'ðð»'
- 'ðð»'
- 'âð»'
- 'ðð»'
- 'ðð»'
- 'âð»'
- 'ðð»'
- 'ð€ð»'
- 'ð€ð»'
- 'ðð»'
- 'ð«¶ð»'
- 'ðð»'
- 'ðð»'
- 'ð€²ð»'
- 'ðð»'
- 'âð»'
- 'ðªð»'
- 'ðŠµð»'
- 'ðŠ¶ð»'
- 'ðð»'
- 'ðŠ»ð»'
- 'ðð»'
- 'ð¶ð»'
- 'ð§ð»'
- 'ð§ð»'
- 'ðŠð»'
- 'ð©ð»'
- 'ð§ð»'
- 'ðšð»'
- 'ð©ð»âðŠ±'
- 'ð§ð»âðŠ±'
- 'ðšð»âðŠ±'
- 'ð©ð»âðŠ°'
- 'ð§ð»âðŠ°'
- 'ðšð»âðŠ°'
- 'ð±ð»ââïž'
- 'ð±ð»'
- 'ð±ð»ââïž'
- 'ð©ð»âðŠ³'
- 'ð§ð»âðŠ³'
- 'ðšð»âðŠ³'
- 'ð©ð»âðŠ²'
- 'ð§ð»âðŠ²'
- 'ðšð»âðŠ²'
- 'ð§ð»ââïž'
- 'ð§ð»'
- 'ð§ð»ââïž'
- 'ðµð»'
- 'ð§ð»'
- 'ðŽð»'
- 'ð²ð»'
- 'ð³ð»ââïž'
- 'ð³ð»'
- 'ð³ð»ââïž'
- 'ð§ð»'
- 'ð®ð»ââïž'
- 'ð®ð»'
- 'ð®ð»ââïž'
- 'ð·ð»ââïž'
- 'ð·ð»'
- 'ð·ð»ââïž'
- 'ðð»ââïž'
- 'ðð»'
- 'ðð»ââïž'
- 'ðµð»ââïž'
- 'ðµð»'
- 'ðµð»ââïž'
- 'ð©ð»ââïž'
- 'ð§ð»ââïž'
- 'ðšð»ââïž'
- 'ð©ð»âðŸ'
- 'ð§ð»âðŸ'
- 'ðšð»âðŸ'
- 'ð©ð»âð³'
- 'ð§ð»âð³'
- 'ðšð»âð³'
- 'ð©ð»âð'
- 'ð§ð»âð'
- 'ðšð»âð'
- 'ð©ð»âð€'
- 'ð§ð»âð€'
- 'ðšð»âð€'
- 'ð©ð»âð«'
- 'ð§ð»âð«'
- 'ðšð»âð«'
- 'ð©ð»âð'
- 'ð§ð»âð'
- 'ðšð»âð'
- 'ð©ð»âð»'
- 'ð§ð»âð»'
- 'ðšð»âð»'
- 'ð©ð»âðŒ'
- 'ð§ð»âðŒ'
- 'ðšð»âðŒ'
- 'ð©ð»âð§'
- 'ð§ð»âð§'
- 'ðšð»âð§'
- 'ð©ð»âð¬'
- 'ð§ð»âð¬'
- 'ðšð»âð¬'
- 'ð©ð»âðš'
- 'ð§ð»âðš'
- 'ðšð»âðš'
- 'ð©ð»âð'
- 'ð§ð»âð'
- 'ðšð»âð'
- 'ð©ð»ââïž'
- 'ð§ð»ââïž'
- 'ðšð»ââïž'
- 'ð©ð»âð'
- 'ð§ð»âð'
- 'ðšð»âð'
- 'ð©ð»ââïž'
- 'ð§ð»ââïž'
- 'ðšð»ââïž'
- 'ð°ð»ââïž'
- 'ð°ð»'
- 'ð°ð»ââïž'
- 'ð€µð»ââïž'
- 'ð€µð»'
- 'ð€µð»ââïž'
- 'ðžð»'
- 'ð«
ð»'
- 'ð€Žð»'
- 'ð¥·ð»'
- 'ðŠžð»ââïž'
- 'ðŠžð»'
- 'ðŠžð»ââïž'
- 'ðŠ¹ð»ââïž'
- 'ðŠ¹ð»'
- 'ðŠ¹ð»ââïž'
- 'ð€¶ð»'
- 'ð§ð»âð'
- 'ð
ð»'
- 'ð§ð»ââïž'
- 'ð§ð»'
- 'ð§ð»ââïž'
- 'ð§ð»ââïž'
- 'ð§ð»'
- 'ð§ð»ââïž'
- 'ð§ð»ââïž'
- 'ð§ð»'
- 'ð§ð»ââïž'
- 'ð§ð»ââïž'
- 'ð§ð»'
- 'ð§ð»ââïž'
- 'ð§ð»ââïž'
- 'ð§ð»'
- 'ð§ð»ââïž'
- 'ðŒð»'
- 'ð€°ð»'
- 'ð«ð»'
- 'ð«ð»'
- 'ð€±ð»'
- 'ð©ð»âðŒ'
- 'ð§ð»âðŒ'
- 'ðšð»âðŒ'
- 'ðð»ââïž'
- 'ðð»'
- 'ðð»ââïž'
- 'ðð»ââïž'
- 'ðð»'
- 'ðð»ââïž'
- 'ð
ð»ââïž'
- 'ð
ð»'
- 'ð
ð»ââïž'
- 'ðð»ââïž'
- 'ðð»'
- 'ðð»ââïž'
- 'ðð»ââïž'
- 'ðð»'
- 'ðð»ââïž'
- 'ð§ð»ââïž'
- 'ð§ð»'
- 'ð§ð»ââïž'
- 'ð€Šð»ââïž'
- 'ð€Šð»'
- 'ð€Šð»ââïž'
- 'ð€·ð»ââïž'
- 'ð€·ð»'
- 'ð€·ð»ââïž'
- 'ðð»ââïž'
- 'ðð»'
- 'ðð»ââïž'
- 'ðð»ââïž'
- 'ðð»'
- 'ðð»ââïž'
- 'ðð»ââïž'
- 'ðð»'
- 'ðð»ââïž'
- 'ðð»ââïž'
- 'ðð»'
- 'ðð»ââïž'
- 'ð§ð»ââïž'
- 'ð§ð»'
- 'ð§ð»ââïž'
- 'ðð»'
- 'ðºð»'
- 'ðŽð»'
- 'ð©ð»âðŠœ'
- 'ð§ð»âðŠœ'
- 'ðšð»âðŠœ'
- 'ð©ð»âðŠŒ'
- 'ð§ð»âðŠŒ'
- 'ðšð»âðŠŒ'
- 'ð¶ð»ââïž'
- 'ð¶ð»'
- 'ð¶ð»ââïž'
- 'ð©ð»âðŠ¯'
- 'ð§ð»âðŠ¯'
- 'ðšð»âðŠ¯'
- 'ð§ð»ââïž'
- 'ð§ð»'
- 'ð§ð»ââïž'
- 'ðð»ââïž'
- 'ðð»'
- 'ðð»ââïž'
- 'ð§ð»ââïž'
- 'ð§ð»'
- 'ð§ð»ââïž'
- 'ðð»'
- 'ð§ð»âð€âð§ð»'
- 'ð¬ð»'
- 'ð«ð»'
- 'ð§ð»ââïž'
- 'ð§ð»'
- 'ð§ð»ââïž'
- 'ðð»'
- 'ðð»'
- 'ðð»ââïž'
- 'ðð»'
- 'ðð»ââïž'
- 'ðð»ââïž'
- 'ðð»'
- 'ðð»ââïž'
- 'ð£ð»ââïž'
- 'ð£ð»'
- 'ð£ð»ââïž'
- 'ðð»ââïž'
- 'ðð»'
- 'ðð»ââïž'
- 'â¹ð»ââïž'
- 'â¹ð»'
- 'â¹ð»ââïž'
- 'ðð»ââïž'
- 'ðð»'
- 'ðð»ââïž'
- 'ðŽð»ââïž'
- 'ðŽð»'
- 'ðŽð»ââïž'
- 'ðµð»ââïž'
- 'ðµð»'
- 'ðµð»ââïž'
- 'ð€žð»ââïž'
- 'ð€žð»'
- 'ð€žð»ââïž'
- 'ð€œð»ââïž'
- 'ð€œð»'
- 'ð€œð»ââïž'
- 'ð€Ÿð»ââïž'
- 'ð€Ÿð»'
- 'ð€Ÿð»ââïž'
- 'ð€¹ð»ââïž'
- 'ð€¹ð»'
- 'ð€¹ð»ââïž'
- 'ð§ð»ââïž'
- 'ð§ð»'
- 'ð§ð»ââïž'
- 'ðð»'
- 'ðð»'
- 'ððŒ'
- 'ð€ðŒ'
- 'ððŒ'
- 'âðŒ'
- 'ððŒ'
- 'ððŒ'
- 'ð€ðŒ'
- 'ð€ðŒ'
- 'âðŒ'
- 'ð€ðŒ'
- 'ð«°ðŒ'
- 'ð€ðŒ'
- 'ð€ðŒ'
- 'ð€ðŒ'
- 'ð«µðŒ'
- 'ð«±ðŒ'
- 'ð«²ðŒ'
- 'ð«³ðŒ'
- 'ð«ŽðŒ'
- 'ððŒ'
- 'ððŒ'
- 'ððŒ'
- 'ððŒ'
- 'ððŒ'
- 'âðŒ'
- 'ððŒ'
- 'ððŒ'
- 'âðŒ'
- 'ððŒ'
- 'ð€ðŒ'
- 'ð€ðŒ'
- 'ððŒ'
- 'ð«¶ðŒ'
- 'ððŒ'
- 'ððŒ'
- 'ð€²ðŒ'
- 'ððŒ'
- 'âðŒ'
- 'ðªðŒ'
- 'ðŠµðŒ'
- 'ðŠ¶ðŒ'
- 'ððŒ'
- 'ðŠ»ðŒ'
- 'ððŒ'
- 'ð¶ðŒ'
- 'ð§ðŒ'
- 'ð§ðŒ'
- 'ðŠðŒ'
- 'ð©ðŒ'
- 'ð§ðŒ'
- 'ðšðŒ'
- 'ð©ðŒâðŠ±'
- 'ð§ðŒâðŠ±'
- 'ðšðŒâðŠ±'
- 'ð©ðŒâðŠ°'
- 'ð§ðŒâðŠ°'
- 'ðšðŒâðŠ°'
- 'ð±ðŒââïž'
- 'ð±ðŒ'
- 'ð±ðŒââïž'
- 'ð©ðŒâðŠ³'
- 'ð§ðŒâðŠ³'
- 'ðšðŒâðŠ³'
- 'ð©ðŒâðŠ²'
- 'ð§ðŒâðŠ²'
- 'ðšðŒâðŠ²'
- 'ð§ðŒââïž'
- 'ð§ðŒ'
- 'ð§ðŒââïž'
- 'ðµðŒ'
- 'ð§ðŒ'
- 'ðŽðŒ'
- 'ð²ðŒ'
- 'ð³ðŒââïž'
- 'ð³ðŒ'
- 'ð³ðŒââïž'
- 'ð§ðŒ'
- 'ð®ðŒââïž'
- 'ð®ðŒ'
- 'ð®ðŒââïž'
- 'ð·ðŒââïž'
- 'ð·ðŒ'
- 'ð·ðŒââïž'
- 'ððŒââïž'
- 'ððŒ'
- 'ððŒââïž'
- 'ðµðŒââïž'
- 'ðµðŒ'
- 'ðµðŒââïž'
- 'ð©ðŒââïž'
- 'ð§ðŒââïž'
- 'ðšðŒââïž'
- 'ð©ðŒâðŸ'
- 'ð§ðŒâðŸ'
- 'ðšðŒâðŸ'
- 'ð©ðŒâð³'
- 'ð§ðŒâð³'
- 'ðšðŒâð³'
- 'ð©ðŒâð'
- 'ð§ðŒâð'
- 'ðšðŒâð'
- 'ð©ðŒâð€'
- 'ð§ðŒâð€'
- 'ðšðŒâð€'
- 'ð©ðŒâð«'
- 'ð§ðŒâð«'
- 'ðšðŒâð«'
- 'ð©ðŒâð'
- 'ð§ðŒâð'
- 'ðšðŒâð'
- 'ð©ðŒâð»'
- 'ð§ðŒâð»'
- 'ðšðŒâð»'
- 'ð©ðŒâðŒ'
- 'ð§ðŒâðŒ'
- 'ðšðŒâðŒ'
- 'ð©ðŒâð§'
- 'ð§ðŒâð§'
- 'ðšðŒâð§'
- 'ð©ðŒâð¬'
- 'ð§ðŒâð¬'
- 'ðšðŒâð¬'
- 'ð©ðŒâðš'
- 'ð§ðŒâðš'
- 'ðšðŒâðš'
- 'ð©ðŒâð'
- 'ð§ðŒâð'
- 'ðšðŒâð'
- 'ð©ðŒââïž'
- 'ð§ðŒââïž'
- 'ðšðŒââïž'
- 'ð©ðŒâð'
- 'ð§ðŒâð'
- 'ðšðŒâð'
- 'ð©ðŒââïž'
- 'ð§ðŒââïž'
- 'ðšðŒââïž'
- 'ð°ðŒââïž'
- 'ð°ðŒ'
- 'ð°ðŒââïž'
- 'ð€µðŒââïž'
- 'ð€µðŒ'
- 'ð€µðŒââïž'
- 'ðžðŒ'
- 'ð«
ðŒ'
- 'ð€ŽðŒ'
- 'ð¥·ðŒ'
- 'ðŠžðŒââïž'
- 'ðŠžðŒ'
- 'ðŠžðŒââïž'
- 'ðŠ¹ðŒââïž'
- 'ðŠ¹ðŒ'
- 'ðŠ¹ðŒââïž'
- 'ð€¶ðŒ'
- 'ð§ðŒâð'
- 'ð
ðŒ'
- 'ð§ðŒââïž'
- 'ð§ðŒ'
- 'ð§ðŒââïž'
- 'ð§ðŒââïž'
- 'ð§ðŒ'
- 'ð§ðŒââïž'
- 'ð§ðŒââïž'
- 'ð§ðŒ'
- 'ð§ðŒââïž'
- 'ð§ðŒââïž'
- 'ð§ðŒ'
- 'ð§ðŒââïž'
- 'ð§ðŒââïž'
- 'ð§ðŒ'
- 'ð§ðŒââïž'
- 'ðŒðŒ'
- 'ð€°ðŒ'
- 'ð«ðŒ'
- 'ð«ðŒ'
- 'ð€±ðŒ'
- 'ð©ðŒâðŒ'
- 'ð§ðŒâðŒ'
- 'ðšðŒâðŒ'
- 'ððŒââïž'
- 'ððŒ'
- 'ððŒââïž'
- 'ððŒââïž'
- 'ððŒ'
- 'ððŒââïž'
- 'ð
ðŒââïž'
- 'ð
ðŒ'
- 'ð
ðŒââïž'
- 'ððŒââïž'
- 'ððŒ'
- 'ððŒââïž'
- 'ððŒââïž'
- 'ððŒ'
- 'ððŒââïž'
- 'ð§ðŒââïž'
- 'ð§ðŒ'
- 'ð§ðŒââïž'
- 'ð€ŠðŒââïž'
- 'ð€ŠðŒ'
- 'ð€ŠðŒââïž'
- 'ð€·ðŒââïž'
condition: selection
falsepositives:
- Unknown
level: high
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
CommandLine|contains:
- 'ð'
- 'ð'
- 'ð'
- 'ð'
- 'ð'
- 'ð
'
- 'ð'
- 'ð€£'
- 'ð¥²'
- 'ð¥¹'
- 'âºïž'
- 'ð'
- 'ð'
- 'ð'
- 'ð'
- 'ð'
- 'ð'
- 'ð'
- 'ð¥°'
- 'ð'
- 'ð'
- 'ð'
- 'ð'
- 'ð'
- 'ð'
- 'ð'
- 'ð'
- 'ð€ª'
- 'ð€š'
- 'ð§'
- 'ð€'
- 'ð'
- 'ð¥ž'
- 'ð€©'
- 'ð¥³'
- 'ð'
- 'ð'
- 'ð'
- 'ð'
- 'ð'
- 'ð'
- 'ð'
- 'â¹ïž'
- 'ð£'
- 'ð'
- 'ð«'
- 'ð©'
- 'ð¥º'
- 'ð¢'
- 'ð'
- 'ð®âðš'
- 'ð€'
- 'ð '
- 'ð¡'
- 'ð€¬'
- 'ð€¯'
- 'ð³'
- 'ð¥µ'
- 'ð¥¶'
- 'ð±'
- 'ðš'
- 'ð°'
- 'ð¥'
- 'ð'
- 'ð«£'
- 'ð€'
- 'ð«¡'
- 'ð€'
- 'ð«¢'
- 'ð€'
- 'ð€«'
- 'ð€¥'
- 'ð¶'
- 'ð¶âð«ïž'
- 'ð'
- 'ð'
- 'ð¬'
- 'ð« '
- 'ð'
- 'ð¯'
- 'ðŠ'
- 'ð§'
- 'ð®'
- 'ð²'
- 'ð¥±'
- 'ðŽ'
- 'ð€€'
- 'ðª'
- 'ðµ'
- 'ðµâð«'
- 'ð«¥'
- 'ð€'
- 'ð¥Ž'
- 'ð€¢'
- 'ð€®'
- 'ð€§'
- 'ð·'
- 'ð€'
- 'ð€'
- 'ð€'
- 'ð€ '
- 'ð'
- 'ð¿'
- 'ð¹'
- 'ðº'
- 'ð€¡'
- 'ð©'
- 'ð»'
- 'ð'
- 'â ïž'
- 'ðœ'
- 'ðŸ'
- 'ð€'
- 'ð'
- 'ðº'
- 'ðž'
- 'ð¹'
- 'ð»'
- 'ðŒ'
- 'ðœ'
- 'ð'
- 'ð¿'
- 'ðŸ'
- 'ð'
- 'ð€'
- 'ð'
- 'â'
- 'ð'
- 'ð'
- 'ð€'
- 'ð€'
- 'âïž'
- 'ð€'
- 'ð«°'
- 'ð€'
- 'ð€'
- 'ð€'
- 'ð«µ'
- 'ð«±'
- 'ð«²'
- 'ð«³'
- 'ð«Ž'
- 'ð'
- 'ð'
- 'ð'
- 'ð'
- 'ð'
- 'âïž'
- 'ð'
- 'ð'
- 'â'
- 'ð'
- 'ð€'
- 'ð€'
- 'ð'
- 'ð«¶'
- 'ð'
- 'ð'
- 'ð€²'
- 'ð€'
- 'ð'
- 'âïž'
- 'ðª'
- 'ðŠŸ'
- 'ðŠµ'
- 'ðŠ¿'
- 'ðŠ¶'
- 'ð£'
- 'ð'
- 'ðŠ»'
- 'ð'
- 'ð«'
- 'ð«'
- 'ð§ '
- 'ðŠ·'
- 'ðŠŽ'
- 'ð'
- 'ð'
- 'ð
'
- 'ð'
- 'ð«Š'
- 'ð'
- 'ð©ž'
- 'ð¶'
- 'ð§'
- 'ð§'
- 'ðŠ'
- 'ð©'
- 'ð§'
- 'ðš'
- 'ð©âðŠ±'
- 'ð§âðŠ±'
- 'ðšâðŠ±'
- 'ð©âðŠ°'
- 'ð§âðŠ°'
- 'ðšâðŠ°'
- 'ð±ââïž'
- 'ð±'
- 'ð±ââïž'
- 'ð©âðŠ³'
- 'ð§âðŠ³'
- 'ðšâðŠ³'
- 'ð©âðŠ²'
- 'ð§âðŠ²'
- 'ðšâðŠ²'
- 'ð§ââïž'
- 'ð§'
- 'ð§ââïž'
- 'ðµ'
- 'ð§'
- 'ðŽ'
- 'ð²'
- 'ð³ââïž'
- 'ð³'
- 'ð³ââïž'
- 'ð§'
- 'ð®ââïž'
- 'ð®'
- 'ð®ââïž'
- 'ð·ââïž'
- 'ð·'
- 'ð·ââïž'
- 'ðââïž'
- 'ð'
- 'ðââïž'
- 'ðµïžââïž'
- 'ðµïž'
- 'ðµïžââïž'
- 'ð©ââïž'
- 'ð§ââïž'
- 'ðšââïž'
- 'ð©âðŸ'
- 'ð§âðŸ'
- 'ðšâðŸ'
- 'ð©âð³'
- 'ð§âð³'
- 'ðšâð³'
- 'ð©âð'
- 'ð§âð'
- 'ðšâð'
- 'ð©âð€'
- 'ð§âð€'
- 'ðšâð€'
- 'ð©âð«'
- 'ð§âð«'
- 'ðšâð«'
- 'ð©âð'
- 'ð§âð'
- 'ðšâð'
- 'ð©âð»'
- 'ð§âð»'
- 'ðšâð»'
- 'ð©âðŒ'
- 'ð§âðŒ'
- 'ðšâðŒ'
- 'ð©âð§'
- 'ð§âð§'
- 'ðšâð§'
- 'ð©âð¬'
- 'ð§âð¬'
- 'ðšâð¬'
- 'ð©âðš'
- 'ð§âðš'
- 'ðšâðš'
- 'ð©âð'
- 'ð§âð'
- 'ðšâð'
- 'ð©ââïž'
- 'ð§ââïž'
- 'ðšââïž'
- 'ð©âð'
- 'ð§âð'
- 'ðšâð'
- 'ð©ââïž'
- 'ð§ââïž'
- 'ðšââïž'
- 'ð°ââïž'
- 'ð°'
- 'ð°ââïž'
- 'ð€µââïž'
- 'ð€µ'
- 'ð€µââïž'
- 'ðž'
- 'ð«
'
- 'ð€Ž'
- 'ð¥·'
- 'ðŠžââïž'
- 'ðŠž'
- 'ðŠžââïž'
- 'ðŠ¹ââïž'
- 'ðŠ¹'
- 'ðŠ¹ââïž'
- 'ð€¶'
- 'ð§âð'
- 'ð
'
- 'ð§ââïž'
- 'ð§'
- 'ð§ââïž'
- 'ð§ââïž'
- 'ð§'
- 'ð§ââïž'
- 'ð§ââïž'
- 'ð§'
- 'ð§ââïž'
- 'ð§ââïž'
- 'ð§'
- 'ð§ââïž'
- 'ð§ââïž'
- 'ð§'
- 'ð§ââïž'
- 'ð§ââïž'
- 'ð§'
- 'ð§ââïž'
- 'ð§ââïž'
- 'ð§'
- 'ð§ââïž'
- 'ð§'
- 'ðŒ'
- 'ð€°'
- 'ð«'
- 'ð«'
- 'ð€±'
- 'ð©âðŒ'
- 'ð§âðŒ'
- 'ðšâðŒ'
- 'ðââïž'
- 'ð'
- 'ðââïž'
- 'ðââïž'
- 'ð'
- 'ðââïž'
- 'ð
ââïž'
- 'ð
'
- 'ð
ââïž'
- 'ðââïž'
- 'ð'
- 'ðââïž'
- 'ðââïž'
- 'ð'
- 'ðââïž'
- 'ð§ââïž'
- 'ð§'
- 'ð§ââïž'
- 'ð€Šââïž'
- 'ð€Š'
- 'ð€Šââïž'
- 'ð€·ââïž'
- 'ð€·'
- 'ð€·ââïž'
- 'ðââïž'
- 'ð'
- 'ðââïž'
- 'ðââïž'
- 'ð'
- 'ðââïž'
- 'ðââïž'
- 'ð'
- 'ðââïž'
- 'ðââïž'
- 'ð'
- 'ðââïž'
- 'ð§ââïž'
- 'ð§'
- 'ð§ââïž'
- 'ð
'
- 'ð'
- 'ðº'
- 'ð¯ââïž'
- 'ð¯'
- 'ð¯ââïž'
- 'ðŽ'
- 'ð©âðŠœ'
- 'ð§âðŠœ'
- 'ðšâðŠœ'
- 'ð©âðŠŒ'
- 'ð§âðŠŒ'
- 'ðšâðŠŒ'
- 'ð¶ââïž'
- 'ð¶'
- 'ð¶ââïž'
- 'ð©âðŠ¯'
- 'ð§âðŠ¯'
- 'ðšâðŠ¯'
- 'ð§ââïž'
- 'ð§'
- 'ð§ââïž'
- 'ðââïž'
- 'ð'
- 'ðââïž'
- 'ð§ââïž'
- 'ð§'
- 'ð§ââïž'
- 'ð'
- 'ð§âð€âð§'
- 'ð¬'
- 'ð«'
- 'ð©ââ€ïžâð©'
- 'ð'
- 'ðšââ€ïžâðš'
- 'ð©ââ€ïžâðš'
- 'ð©ââ€ïžâðâð©'
- 'ð'
- 'ðšââ€ïžâðâðš'
- 'ð©ââ€ïžâðâðš'
- 'ðª'
- 'ðšâð©âðŠ'
- 'ðšâð©âð§'
- 'ðšâð©âð§âðŠ'
- 'ðšâð©âðŠâðŠ'
- 'ðšâð©âð§âð§'
- 'ðšâðšâðŠ'
- 'ðšâðšâð§'
- 'ðšâðšâð§âðŠ'
- 'ðšâðšâðŠâðŠ'
- 'ðšâðšâð§âð§'
- 'ð©âð©âðŠ'
- 'ð©âð©âð§'
- 'ð©âð©âð§âðŠ'
- 'ð©âð©âðŠâðŠ'
- 'ð©âð©âð§âð§'
- 'ðšâðŠ'
- 'ðšâðŠâðŠ'
- 'ðšâð§'
- 'ðšâð§âðŠ'
- 'ðšâð§âð§'
- 'ð©âðŠ'
- 'ð©âðŠâðŠ'
- 'ð©âð§'
- 'ð©âð§âðŠ'
- 'ð©âð§âð§'
- 'ð£'
- 'ð€'
- 'ð¥'
- 'ð«'
- 'ð§³'
- 'ð'
- 'âïž'
- 'ð§µ'
- 'ðª¡'
- 'ðª¢'
- 'ð§¶'
- 'ð'
- 'ð¶'
- 'ð¥œ'
- 'ð¥Œ'
- 'ðŠº'
- 'ð'
- 'ð'
- 'ð'
- 'ð§£'
- 'ð§€'
- 'ð§¥'
- 'ð§Š'
- 'ð'
- 'ð'
- 'ð¥»'
- 'ð©Ž'
- 'ð©±'
- 'ð©²'
- 'ð©³'
- 'ð'
- 'ð'
- 'ð'
- 'ð'
- 'ð'
- 'ð'
- 'ð'
- 'ð'
- 'ð¥Ÿ'
- 'ð¥¿'
- 'ð '
- 'ð¡'
- 'ð©°'
- 'ð¢'
- 'ð'
- 'ð'
- 'ð©'
- 'ð'
- 'ð§¢'
- 'â'
- 'ðª'
- 'ð'
- 'ð'
- 'ðŒ'
- 'ðð»'
- 'ð€ð»'
- 'ðð»'
- 'âð»'
- 'ðð»'
- 'ðð»'
- 'ð€ð»'
- 'ð€ð»'
- 'âð»'
- 'ð€ð»'
- 'ð«°ð»'
- 'ð€ð»'
- 'ð€ð»'
- 'ð€ð»'
- 'ð«µð»'
- 'ð«±ð»'
- 'ð«²ð»'
- 'ð«³ð»'
- 'ð«Žð»'
- 'ðð»'
- 'ðð»'
- 'ðð»'
- 'ðð»'
- 'ðð»'
- 'âð»'
- 'ðð»'
- 'ðð»'
- 'âð»'
- 'ðð»'
- 'ð€ð»'
- 'ð€ð»'
- 'ðð»'
- 'ð«¶ð»'
- 'ðð»'
- 'ðð»'
- 'ð€²ð»'
- 'ðð»'
- 'âð»'
- 'ðªð»'
- 'ðŠµð»'
- 'ðŠ¶ð»'
- 'ðð»'
- 'ðŠ»ð»'
- 'ðð»'
- 'ð¶ð»'
- 'ð§ð»'
- 'ð§ð»'
- 'ðŠð»'
- 'ð©ð»'
- 'ð§ð»'
- 'ðšð»'
- 'ð©ð»âðŠ±'
- 'ð§ð»âðŠ±'
- 'ðšð»âðŠ±'
- 'ð©ð»âðŠ°'
- 'ð§ð»âðŠ°'
- 'ðšð»âðŠ°'
- 'ð±ð»ââïž'
- 'ð±ð»'
- 'ð±ð»ââïž'
- 'ð©ð»âðŠ³'
- 'ð§ð»âðŠ³'
- 'ðšð»âðŠ³'
- 'ð©ð»âðŠ²'
- 'ð§ð»âðŠ²'
- 'ðšð»âðŠ²'
- 'ð§ð»ââïž'
- 'ð§ð»'
- 'ð§ð»ââïž'
- 'ðµð»'
- 'ð§ð»'
- 'ðŽð»'
- 'ð²ð»'
- 'ð³ð»ââïž'
- 'ð³ð»'
- 'ð³ð»ââïž'
- 'ð§ð»'
- 'ð®ð»ââïž'
- 'ð®ð»'
- 'ð®ð»ââïž'
- 'ð·ð»ââïž'
- 'ð·ð»'
- 'ð·ð»ââïž'
- 'ðð»ââïž'
- 'ðð»'
- 'ðð»ââïž'
- 'ðµð»ââïž'
- 'ðµð»'
- 'ðµð»ââïž'
- 'ð©ð»ââïž'
- 'ð§ð»ââïž'
- 'ðšð»ââïž'
- 'ð©ð»âðŸ'
- 'ð§ð»âðŸ'
- 'ðšð»âðŸ'
- 'ð©ð»âð³'
- 'ð§ð»âð³'
- 'ðšð»âð³'
- 'ð©ð»âð'
- 'ð§ð»âð'
- 'ðšð»âð'
- 'ð©ð»âð€'
- 'ð§ð»âð€'
- 'ðšð»âð€'
- 'ð©ð»âð«'
- 'ð§ð»âð«'
- 'ðšð»âð«'
- 'ð©ð»âð'
- 'ð§ð»âð'
- 'ðšð»âð'
- 'ð©ð»âð»'
- 'ð§ð»âð»'
- 'ðšð»âð»'
- 'ð©ð»âðŒ'
- 'ð§ð»âðŒ'
- 'ðšð»âðŒ'
- 'ð©ð»âð§'
- 'ð§ð»âð§'
- 'ðšð»âð§'
- 'ð©ð»âð¬'
- 'ð§ð»âð¬'
- 'ðšð»âð¬'
- 'ð©ð»âðš'
- 'ð§ð»âðš'
- 'ðšð»âðš'
- 'ð©ð»âð'
- 'ð§ð»âð'
- 'ðšð»âð'
- 'ð©ð»ââïž'
- 'ð§ð»ââïž'
- 'ðšð»ââïž'
- 'ð©ð»âð'
- 'ð§ð»âð'
- 'ðšð»âð'
- 'ð©ð»ââïž'
- 'ð§ð»ââïž'
- 'ðšð»ââïž'
- 'ð°ð»ââïž'
- 'ð°ð»'
- 'ð°ð»ââïž'
- 'ð€µð»ââïž'
- 'ð€µð»'
- 'ð€µð»ââïž'
- 'ðžð»'
- 'ð«
ð»'
- 'ð€Žð»'
- 'ð¥·ð»'
- 'ðŠžð»ââïž'
- 'ðŠžð»'
- 'ðŠžð»ââïž'
- 'ðŠ¹ð»ââïž'
- 'ðŠ¹ð»'
- 'ðŠ¹ð»ââïž'
- 'ð€¶ð»'
- 'ð§ð»âð'
- 'ð
ð»'
- 'ð§ð»ââïž'
- 'ð§ð»'
- 'ð§ð»ââïž'
- 'ð§ð»ââïž'
- 'ð§ð»'
- 'ð§ð»ââïž'
- 'ð§ð»ââïž'
- 'ð§ð»'
- 'ð§ð»ââïž'
- 'ð§ð»ââïž'
- 'ð§ð»'
- 'ð§ð»ââïž'
- 'ð§ð»ââïž'
- 'ð§ð»'
- 'ð§ð»ââïž'
- 'ðŒð»'
- 'ð€°ð»'
- 'ð«ð»'
- 'ð«ð»'
- 'ð€±ð»'
- 'ð©ð»âðŒ'
- 'ð§ð»âðŒ'
- 'ðšð»âðŒ'
- 'ðð»ââïž'
- 'ðð»'
- 'ðð»ââïž'
- 'ðð»ââïž'
- 'ðð»'
- 'ðð»ââïž'
- 'ð
ð»ââïž'
- 'ð
ð»'
- 'ð
ð»ââïž'
- 'ðð»ââïž'
- 'ðð»'
- 'ðð»ââïž'
- 'ðð»ââïž'
- 'ðð»'
- 'ðð»ââïž'
- 'ð§ð»ââïž'
- 'ð§ð»'
- 'ð§ð»ââïž'
- 'ð€Šð»ââïž'
- 'ð€Šð»'
- 'ð€Šð»ââïž'
- 'ð€·ð»ââïž'
- 'ð€·ð»'
- 'ð€·ð»ââïž'
- 'ðð»ââïž'
- 'ðð»'
- 'ðð»ââïž'
- 'ðð»ââïž'
- 'ðð»'
- 'ðð»ââïž'
- 'ðð»ââïž'
- 'ðð»'
- 'ðð»ââïž'
- 'ðð»ââïž'
- 'ðð»'
- 'ðð»ââïž'
- 'ð§ð»ââïž'
- 'ð§ð»'
- 'ð§ð»ââïž'
- 'ðð»'
- 'ðºð»'
- 'ðŽð»'
- 'ð©ð»âðŠœ'
- 'ð§ð»âðŠœ'
- 'ðšð»âðŠœ'
- 'ð©ð»âðŠŒ'
- 'ð§ð»âðŠŒ'
- 'ðšð»âðŠŒ'
- 'ð¶ð»ââïž'
- 'ð¶ð»'
- 'ð¶ð»ââïž'
- 'ð©ð»âðŠ¯'
- 'ð§ð»âðŠ¯'
- 'ðšð»âðŠ¯'
- 'ð§ð»ââïž'
- 'ð§ð»'
- 'ð§ð»ââïž'
- 'ðð»ââïž'
- 'ðð»'
- 'ðð»ââïž'
- 'ð§ð»ââïž'
- 'ð§ð»'
- 'ð§ð»ââïž'
- 'ðð»'
- 'ð§ð»âð€âð§ð»'
- 'ð¬ð»'
- 'ð«ð»'
- 'ð§ð»ââïž'
- 'ð§ð»'
- 'ð§ð»ââïž'
- 'ðð»'
- 'ðð»'
- 'ðð»ââïž'
- 'ðð»'
- 'ðð»ââïž'
- 'ðð»ââïž'
- 'ðð»'
- 'ðð»ââïž'
- 'ð£ð»ââïž'
- 'ð£ð»'
- 'ð£ð»ââïž'
- 'ðð»ââïž'
- 'ðð»'
- 'ðð»ââïž'
- 'â¹ð»ââïž'
- 'â¹ð»'
- 'â¹ð»ââïž'
- 'ðð»ââïž'
- 'ðð»'
- 'ðð»ââïž'
- 'ðŽð»ââïž'
- 'ðŽð»'
- 'ðŽð»ââïž'
- 'ðµð»ââïž'
- 'ðµð»'
- 'ðµð»ââïž'
- 'ð€žð»ââïž'
- 'ð€žð»'
- 'ð€žð»ââïž'
- 'ð€œð»ââïž'
- 'ð€œð»'
- 'ð€œð»ââïž'
- 'ð€Ÿð»ââïž'
- 'ð€Ÿð»'
- 'ð€Ÿð»ââïž'
- 'ð€¹ð»ââïž'
- 'ð€¹ð»'
- 'ð€¹ð»ââïž'
- 'ð§ð»ââïž'
- 'ð§ð»'
- 'ð§ð»ââïž'
- 'ðð»'
- 'ðð»'
- 'ððŒ'
- 'ð€ðŒ'
- 'ððŒ'
- 'âðŒ'
- 'ððŒ'
- 'ððŒ'
- 'ð€ðŒ'
- 'ð€ðŒ'
- 'âðŒ'
- 'ð€ðŒ'
- 'ð«°ðŒ'
- 'ð€ðŒ'
- 'ð€ðŒ'
- 'ð€ðŒ'
- 'ð«µðŒ'
- 'ð«±ðŒ'
- 'ð«²ðŒ'
- 'ð«³ðŒ'
- 'ð«ŽðŒ'
- 'ððŒ'
- 'ððŒ'
- 'ððŒ'
- 'ððŒ'
- 'ððŒ'
- 'âðŒ'
- 'ððŒ'
- 'ððŒ'
- 'âðŒ'
- 'ððŒ'
- 'ð€ðŒ'
- 'ð€ðŒ'
- 'ððŒ'
- 'ð«¶ðŒ'
- 'ððŒ'
- 'ððŒ'
- 'ð€²ðŒ'
- 'ððŒ'
- 'âðŒ'
- 'ðªðŒ'
- 'ðŠµðŒ'
- 'ðŠ¶ðŒ'
- 'ððŒ'
- 'ðŠ»ðŒ'
- 'ððŒ'
- 'ð¶ðŒ'
- 'ð§ðŒ'
- 'ð§ðŒ'
- 'ðŠðŒ'
- 'ð©ðŒ'
- 'ð§ðŒ'
- 'ðšðŒ'
- 'ð©ðŒâðŠ±'
- 'ð§ðŒâðŠ±'
- 'ðšðŒâðŠ±'
- 'ð©ðŒâðŠ°'
- 'ð§ðŒâðŠ°'
- 'ðšðŒâðŠ°'
- 'ð±ðŒââïž'
- 'ð±ðŒ'
- 'ð±ðŒââïž'
- 'ð©ðŒâðŠ³'
- 'ð§ðŒâðŠ³'
- 'ðšðŒâðŠ³'
- 'ð©ðŒâðŠ²'
- 'ð§ðŒâðŠ²'
- 'ðšðŒâðŠ²'
- 'ð§ðŒââïž'
- 'ð§ðŒ'
- 'ð§ðŒââïž'
- 'ðµðŒ'
- 'ð§ðŒ'
- 'ðŽðŒ'
- 'ð²ðŒ'
- 'ð³ðŒââïž'
- 'ð³ðŒ'
- 'ð³ðŒââïž'
- 'ð§ðŒ'
- 'ð®ðŒââïž'
- 'ð®ðŒ'
- 'ð®ðŒââïž'
- 'ð·ðŒââïž'
- 'ð·ðŒ'
- 'ð·ðŒââïž'
- 'ððŒââïž'
- 'ððŒ'
- 'ððŒââïž'
- 'ðµðŒââïž'
- 'ðµðŒ'
- 'ðµðŒââïž'
- 'ð©ðŒââïž'
- 'ð§ðŒââïž'
- 'ðšðŒââïž'
- 'ð©ðŒâðŸ'
- 'ð§ðŒâðŸ'
- 'ðšðŒâðŸ'
- 'ð©ðŒâð³'
- 'ð§ðŒâð³'
- 'ðšðŒâð³'
- 'ð©ðŒâð'
- 'ð§ðŒâð'
- 'ðšðŒâð'
- 'ð©ðŒâð€'
- 'ð§ðŒâð€'
- 'ðšðŒâð€'
- 'ð©ðŒâð«'
- 'ð§ðŒâð«'
- 'ðšðŒâð«'
- 'ð©ðŒâð'
- 'ð§ðŒâð'
- 'ðšðŒâð'
- 'ð©ðŒâð»'
- 'ð§ðŒâð»'
- 'ðšðŒâð»'
- 'ð©ðŒâðŒ'
- 'ð§ðŒâðŒ'
- 'ðšðŒâðŒ'
- 'ð©ðŒâð§'
- 'ð§ðŒâð§'
- 'ðšðŒâð§'
- 'ð©ðŒâð¬'
- 'ð§ðŒâð¬'
- 'ðšðŒâð¬'
- 'ð©ðŒâðš'
- 'ð§ðŒâðš'
- 'ðšðŒâðš'
- 'ð©ðŒâð'
- 'ð§ðŒâð'
- 'ðšðŒâð'
- 'ð©ðŒââïž'
- 'ð§ðŒââïž'
- 'ðšðŒââïž'
- 'ð©ðŒâð'
- 'ð§ðŒâð'
- 'ðšðŒâð'
- 'ð©ðŒââïž'
- 'ð§ðŒââïž'
- 'ðšðŒââïž'
- 'ð°ðŒââïž'
- 'ð°ðŒ'
- 'ð°ðŒââïž'
- 'ð€µðŒââïž'
- 'ð€µðŒ'
- 'ð€µðŒââïž'
- 'ðžðŒ'
- 'ð«
ðŒ'
- 'ð€ŽðŒ'
- 'ð¥·ðŒ'
- 'ðŠžðŒââïž'
- 'ðŠžðŒ'
- 'ðŠžðŒââïž'
- 'ðŠ¹ðŒââïž'
- 'ðŠ¹ðŒ'
- 'ðŠ¹ðŒââïž'
- 'ð€¶ðŒ'
- 'ð§ðŒâð'
- 'ð
ðŒ'
- 'ð§ðŒââïž'
- 'ð§ðŒ'
- 'ð§ðŒââïž'
- 'ð§ðŒââïž'
- 'ð§ðŒ'
- 'ð§ðŒââïž'
- 'ð§ðŒââïž'
- 'ð§ðŒ'
- 'ð§ðŒââïž'
- 'ð§ðŒââïž'
- 'ð§ðŒ'
- 'ð§ðŒââïž'
- 'ð§ðŒââïž'
- 'ð§ðŒ'
- 'ð§ðŒââïž'
- 'ðŒðŒ'
- 'ð€°ðŒ'
- 'ð«ðŒ'
- 'ð«ðŒ'
- 'ð€±ðŒ'
- 'ð©ðŒâðŒ'
- 'ð§ðŒâðŒ'
- 'ðšðŒâðŒ'
- 'ððŒââïž'
- 'ððŒ'
- 'ððŒââïž'
- 'ððŒââïž'
- 'ððŒ'
- 'ððŒââïž'
- 'ð
ðŒââïž'
- 'ð
ðŒ'
- 'ð
ðŒââïž'
- 'ððŒââïž'
- 'ððŒ'
- 'ððŒââïž'
- 'ððŒââïž'
- 'ððŒ'
- 'ððŒââïž'
- 'ð§ðŒââïž'
- 'ð§ðŒ'
- 'ð§ðŒââïž'
- 'ð€ŠðŒââïž'
- 'ð€ŠðŒ'
- 'ð€ŠðŒââïž'
- 'ð€·ðŒââïž'
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
CommandLine | match |
|