Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 3

Status: test
Severity: high
Log source: product windows, category process_creation
Author: @Kostastsale, TheDFIRReport
Source: github.com/SigmaHQ/sigma

Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	No specific technique

Event coverage

Provider	Event	Title
Sysmon	Event ID 1	Process creation
Security-Auditing	Event ID 4688	A new process has been created.

Rule body yaml

title: Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 3
id: f9578658-9e71-4711-b634-3f9b50cd3c06
status: test
description: Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.
author: '@Kostastsale, TheDFIRReport'
references:
    - Internal Research
tags:
    - attack.stealth
date: 2022-12-05
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        CommandLine|contains:
            - '🦆'
            - '🦅'
            - '🦉'
            - '🦇'
            - '🐺'
            - '🐗'
            - '🐴'
            - '🦄'
            - '🐝'
            - '🪱'
            - '🐛'
            - '🦋'
            - '🐌'
            - '🐞'
            - '🐜'
            - '🪰'
            - '🪲'
            - '🪳'
            - '🦟'
            - '🦗'
            - '🕷'
            - '🕸'
            - '🦂'
            - '🐢'
            - '🐍'
            - '🦎'
            - '🦖'
            - '🦕'
            - '🐙'
            - '🦑'
            - '🦐'
            - '🦞'
            - '🦀'
            - '🪸'
            - '🐡'
            - '🐠'
            - '🐟'
            - '🐬'
            - '🐳'
            - '🐋'
            - '🦈'
            - '🐊'
            - '🐅'
            - '🐆'
            - '🦓'
            - '🦍'
            - '🦧'
            - '🦣'
            - '🐘'
            - '🦛'
            - '🦏'
            - '🐪'
            - '🐫'
            - '🦒'
            - '🦘'
            - '🦬'
            - '🐃'
            - '🐂'
            - '🐄'
            - '🐎'
            - '🐖'
            - '🐏'
            - '🐑'
            - '🦙'
            - '🐐'
            - '🦌'
            - '🐕'
            - '🐩'
            - '🦮'
            - '🐕‍🦺'
            - '🐈'
            - '🐈‍⬛'
            - '🪶'
            - '🐓'
            - '🦃'
            - '🦤'
            - '🦚'
            - '🦜'
            - '🦢'
            - '🦩'
            - '🕊'
            - '🐇'
            - '🦝'
            - '🦨'
            - '🦡'
            - '🦫'
            - '🦦'
            - '🦥'
            - '🐁'
            - '🐀'
            - '🐿'
            - '🦔'
            - '🐾'
            - '🐉'
            - '🐲'
            - '🌵'
            - '🎄'
            - '🌲'
            - '🌳'
            - '🌴'
            - '🪹'
            - '🪺'
            - '🪵'
            - '🌱'
            - '🌿'
            - '☘️'
            - '🍀'
            - '🎍'
            - '🪴'
            - '🎋'
            - '🍃'
            - '🍂'
            - '🍁'
            - '🍄'
            - '🐚'
            - '🪨'
            - '🌾'
            - '💐'
            - '🌷'
            - '🪷'
            - '🌹'
            - '🥀'
            - '🌺'
            - '🌸'
            - '🌼'
            - '🌻'
            - '🌞'
            - '🌝'
            - '🌛'
            - '🌜'
            - '🌚'
            - '🌕'
            - '🌖'
            - '🌗'
            - '🌘'
            - '🌑'
            - '🌒'
            - '🌓'
            - '🌔'
            - '🌙'
            - '🌎'
            - '🌍'
            - '🌏'
            - '🪐'
            - '💫'
            - '⭐️'
            - '🌟'
            - '✨'
            - '⚡️'
            - '☄️'
            - '💥'
            - '🔥'
            - '🌪'
            - '🌈'
            - '☀️'
            - '🌤'
            - '⛅️'
            - '🌥'
            - '☁️'
            - '🌦'
            - '🌧'
            - '⛈'
            - '🌩'
            - '🌨'
            - '❄️'
            - '☃️'
            - '⛄️'
            - '🌬'
            - '💨'
            - '💧'
            - '💦'
            - '🫧'
            - '☔️'
            - '☂️'
            - '🌊'
            - '🌫🍏'
            - '🍎'
            - '🍐'
            - '🍊'
            - '🍋'
            - '🍌'
            - '🍉'
            - '🍇'
            - '🍓'
            - '🫐'
            - '🍈'
            - '🍒'
            - '🍑'
            - '🥭'
            - '🍍'
            - '🥥'
            - '🥝'
            - '🍅'
            - '🍆'
            - '🥑'
            - '🥦'
            - '🥬'
            - '🥒'
            - '🌶'
            - '🫑'
            - '🌽'
            - '🥕'
            - '🫒'
            - '🧄'
            - '🧅'
            - '🥔'
            - '🍠'
            - '🫘'
            - '🥐'
            - '🥯'
            - '🍞'
            - '🥖'
            - '🥨'
            - '🧀'
            - '🥚'
            - '🍳'
            - '🧈'
            - '🥞'
            - '🧇'
            - '🥓'
            - '🥩'
            - '🍗'
            - '🍖'
            - '🦴'
            - '🌭'
            - '🍔'
            - '🍟'
            - '🍕'
            - '🫓'
            - '🥪'
            - '🥙'
            - '🧆'
            - '🌮'
            - '🌯'
            - '🫔'
            - '🥗'
            - '🥘'
            - '🫕'
            - '🥫'
            - '🍝'
            - '🍜'
            - '🍲'
            - '🍛'
            - '🍣'
            - '🍱'
            - '🥟'
            - '🦪'
            - '🍤'
            - '🍙'
            - '🍚'
            - '🍘'
            - '🍥'
            - '🥠'
            - '🥮'
            - '🍢'
            - '🍡'
            - '🍧'
            - '🍨'
            - '🍦'
            - '🥧'
            - '🧁'
            - '🍰'
            - '🎂'
            - '🍮'
            - '🍭'
            - '🍬'
            - '🍫'
            - '🍿'
            - '🍩'
            - '🍪'
            - '🌰'
            - '🥜'
            - '🍯'
            - '🥛'
            - '🍼'
            - '🫖'
            - '☕️'
            - '🍵'
            - '🧃'
            - '🥤'
            - '🧋'
            - '🫙'
            - '🍶'
            - '🍺'
            - '🍻'
            - '🥂'
            - '🍷'
            - '🫗'
            - '🥃'
            - '🍸'
            - '🍹'
            - '🧉'
            - '🍾'
            - '🧊'
            - '🥄'
            - '🍴'
            - '🍽'
            - '🥣'
            - '🥡'
            - '🥢'
            - '🧂'
            - '⚽️'
            - '🏀'
            - '🏈'
            - '⚾️'
            - '🥎'
            - '🎾'
            - '🏐'
            - '🏉'
            - '🥏'
            - '🎱'
            - '🪀'
            - '🏓'
            - '🏸'
            - '🏒'
            - '🏑'
            - '🥍'
            - '🏏'
            - '🪃'
            - '🥅'
            - '⛳️'
            - '🪁'
            - '🏹'
            - '🎣'
            - '🤿'
            - '🥊'
            - '🥋'
            - '🎽'
            - '🛹'
            - '🛼'
            - '🛷'
            - '⛸'
            - '🥌'
            - '🎿'
            - '⛷'
            - '🏂'
            - '🪂'
            - '🏋️‍♀️'
            - '🏋️'
            - '🏋️‍♂️'
            - '🤼‍♀️'
            - '🤼'
            - '🤼‍♂️'
            - '🤸‍♀️'
            - '🤸'
            - '🤸‍♂️'
            - '⛹️‍♀️'
            - '⛹️'
            - '⛹️‍♂️'
            - '🤺'
            - '🤾‍♀️'
            - '🤾'
            - '🤾‍♂️'
            - '🏌️‍♀️'
            - '🏌️'
            - '🏌️‍♂️'
            - '🏇'
            - '🧘‍♀️'
            - '🧘'
            - '🧘‍♂️'
            - '🏄‍♀️'
            - '🏄'
            - '🏄‍♂️'
            - '🏊‍♀️'
            - '🏊'
            - '🏊‍♂️'
            - '🤽‍♀️'
            - '🤽'
            - '🤽‍♂️'
            - '🚣‍♀️'
            - '🚣'
            - '🚣‍♂️'
            - '🧗‍♀️'
            - '🧗'
            - '🧗‍♂️'
            - '🚵‍♀️'
            - '🚵'
            - '🚵‍♂️'
            - '🚴‍♀️'
            - '🚴'
            - '🚴‍♂️'
            - '🏆'
            - '🥇'
            - '🥈'
            - '🥉'
            - '🏅'
            - '🎖'
            - '🏵'
            - '🎗'
            - '🎫'
            - '🎟'
            - '🎪'
            - '🤹'
            - '🤹‍♂️'
            - '🤹‍♀️'
            - '🎭'
            - '🩰'
            - '🎨'
            - '🎬'
            - '🎤'
            - '🎧'
            - '🎼'
            - '🎹'
            - '🥁'
            - '🪘'
            - '🎷'
            - '🎺'
            - '🪗'
            - '🎸'
            - '🪕'
            - '🎻'
            - '🎲'
            - '♟'
            - '🎯'
            - '🎳'
            - '🎮'
            - '🎰'
            - '🧩'
            - '🚗'
            - '🚕'
            - '🚙'
            - '🚌'
            - '🚎'
            - '🏎'
            - '🚓'
            - '🚑'
            - '🚒'
            - '🚐'
            - '🛻'
            - '🚚'
            - '🚛'
            - '🚜'
            - '🦯'
            - '🦽'
            - '🦼'
            - '🛴'
            - '🚲'
            - '🛵'
            - '🏍'
            - '🛺'
            - '🚨'
            - '🚔'
            - '🚍'
            - '🚘'
            - '🚖'
            - '🛞'
            - '🚡'
            - '🚠'
            - '🚟'
            - '🚃'
            - '🚋'
            - '🚞'
            - '🚝'
            - '🚄'
            - '🚅'
            - '🚈'
            - '🚂'
            - '🚆'
            - '🚇'
            - '🚊'
            - '🚉'
            - '✈️'
            - '🛫'
            - '🛬'
            - '🛩'
            - '💺'
            - '🛰'
            - '🚀'
            - '🛸'
            - '🚁'
            - '🛶'
            - '⛵️'
            - '🚤'
            - '🛥'
            - '🛳'
            - '⛴'
            - '🚢'
            - '⚓️'
            - '🛟'
            - '🪝'
            - '⛽️'
            - '🚧'
            - '🚦'
            - '🚥'
            - '🚏'
            - '🗺'
            - '🗿'
            - '🗽'
            - '🗼'
            - '🏰'
            - '🏯'
            - '🏟'
            - '🎡'
            - '🎢'
            - '🛝'
            - '🎠'
            - '⛲️'
            - '⛱'
            - '🏖'
            - '🏝'
            - '🏜'
            - '🌋'
            - '⛰'
            - '🏔'
            - '🗻'
            - '🏕'
            - '⛺️'
            - '🛖'
            - '🏠'
            - '🏡'
            - '🏘'
            - '🏚'
            - '🏗'
            - '🏭'
            - '🏢'
            - '🏬'
            - '🏣'
            - '🏤'
            - '🏥'
            - '🏦'
            - '🏨'
            - '🏪'
            - '🏫'
            - '🏩'
            - '💒'
            - '🏛'
            - '⛪️'
            - '🕌'
            - '🕍'
            - '🛕'
            - '🕋'
            - '⛩'
            - '🛤'
            - '🛣'
            - '🗾'
            - '🎑'
            - '🏞'
            - '🌅'
            - '🌄'
            - '🌠'
            - '🎇'
            - '🎆'
            - '🌇'
            - '🌆'
            - '🏙'
            - '🌃'
            - '🌌'
            - '🌉'
            - '🌁'
            - '⌚️'
            - '📱'
            - '📲'
            - '💻'
            - '⌨️'
            - '🖥'
            - '🖨'
            - '🖱'
            - '🖲'
            - '🕹'
            - '🗜'
            - '💽'
            - '💾'
            - '💿'
            - '📀'
            - '📼'
            - '📷'
            - '📸'
            - '📹'
            - '🎥'
            - '📽'
            - '🎞'
            - '📞'
            - '☎️'
            - '📟'
            - '📠'
            - '📺'
            - '📻'
            - '🎙'
            - '🎚'
            - '🎛'
            - '🧭'
            - '⏱'
            - '⏲'
            - '⏰'
            - '🕰'
            - '⌛️'
            - '⏳'
            - '📡'
            - '🔋'
            - '🪫'
            - '🔌'
            - '💡'
            - '🔦'
            - '🕯'
            - '🪔'
            - '🧯'
            - '🛢'
            - '💸'
            - '💵'
            - '💴'
            - '💶'
            - '💷'
            - '🪙'
            - '💰'
            - '💳'
            - '💎'
            - '⚖️'
            - '🪜'
            - '🧰'
            - '🪛'
            - '🔧'
            - '🔨'
            - '⚒'
            - '🛠'
            - '⛏'
            - '🪚'
            - '🔩'
            - '⚙️'
            - '🪤'
            - '🧱'
            - '⛓'
            - '🧲'
            - '🔫'
            - '💣'
            - '🧨'
            - '🪓'
            - '🔪'
            - '🗡'
            - '⚔️'
            - '🛡'
            - '🚬'
            - '⚰️'
            - '🪦'
            - '⚱️'
            - '🏺'
            - '🔮'
            - '📿'
            - '🧿'
            - '🪬'
            - '💈'
            - '⚗️'
            - '🔭'
            - '🔬'
            - '🕳'
            - '🩹'
            - '🩺'
            - '🩻'
            - '🩼'
            - '💊'
            - '💉'
            - '🩸'
            - '🧬'
            - '🦠'
            - '🧫'
            - '🧪'
            - '🌡'
            - '🧹'
            - '🪠'
            - '🧺'
            - '🧻'
            - '🚽'
            - '🚰'
            - '🚿'
            - '🛁'
            - '🛀'
            - '🧼'
            - '🪥'
            - '🪒'
            - '🧽'
            - '🪣'
            - '🧴'
            - '🛎'
            - '🔑'
            - '🗝'
            - '🚪'
            - '🪑'
            - '🛋'
            - '🛏'
            - '🛌'
            - '🧸'
            - '🪆'
            - '🖼'
            - '🪞'
            - '🪟'
            - '🛍'
            - '🛒'
            - '🎁'
            - '🎈'
            - '🎏'
            - '🎀'
            - '🪄'
            - '🪅'
            - '🎊'
            - '🎉'
            - '🪩'
            - '🎎'
            - '🏮'
            - '🎐'
            - '🧧'
            - '✉️'
            - '📩'
            - '📨'
            - '📧'
            - '💌'
            - '📥'
            - '📤'
            - '📦'
            - '🏷'
            - '🪧'
            - '📪'
            - '📫'
            - '📬'
            - '📭'
            - '📮'
            - '📯'
            - '📜'
            - '📃'
            - '📄'
            - '📑'
            - '🧾'
            - '📊'
            - '📈'
            - '📉'
            - '🗒'
            - '🗓'
            - '📆'
            - '📅'
            - '🗑'
            - '🪪'
            - '📇'
            - '🗃'
            - '🗳'
            - '🗄'
            - '📋'
            - '📁'
            - '📂'
            - '🗂'
            - '🗞'
            - '📰'
            - '📓'
            - '📔'
            - '📒'
            - '📕'
            - '📗'
            - '📘'
            - '📙'
            - '📚'
            - '📖'
            - '🔖'
            - '🧷'
            - '🔗'
            - '📎'
            - '🖇'
            - '📐'
            - '📏'
            - '🧮'
            - '📌'
            - '📍'
            - '✂️'
            - '🖊'
            - '🖋'
            - '✒️'
            - '🖌'
            - '🖍'
            - '📝'
            - '✏️'
            - '🔍'
            - '🔎'
            - '🔏'
            - '🔐'
            - '🔒'
            - '🔓❤️'
            - '🧡'
            - '💛'
            - '💚'
            - '💙'
            - '💜'
            - '🖤'
            - '🤍'
            - '🤎'
            - '❤️‍🔥'
            - '❤️‍🩹'
            - '💔'
            - '❣️'
            - '💕'
            - '💞'
            - '💓'
            - '💗'
            - '💖'
            - '💘'
            - '💝'
            - '💟'
            - '☮️'
            - '✝️'
            - '☪️'
            - '🕉'
            - '☸️'
            - '✡️'
            - '🔯'
            - '🕎'
            - '☯️'
            - '☦️'
            - '🛐'
            - '⛎'
            - '♈️'
            - '♉️'
            - '♊️'
            - '♋️'
            - '♌️'
            - '♍️'
            - '♎️'
            - '♏️'
            - '♐️'
            - '♑️'
            - '♒️'
            - '♓️'
            - '🆔'
            - '⚛️'
            - '🉑'
            - '☢️'
            - '☣️'
            - '📴'
            - '📳'
            - '🈶'
            - '🈚️'
            - '🈸'
            - '🈺'
            - '🈷️'
            - '✴️'
            - '🆚'
            - '💮'
            - '🉐'
            - '㊙️'
            - '㊗️'
            - '🈴'
            - '🈵'
            - '🈹'
            - '🈲'
            - '🅰️'
            - '🅱️'
            - '🆎'
            - '🆑'
            - '🅾️'
            - '🆘'
            - '❌'
            - '⭕️'
            - '🛑'
            - '⛔️'
            - '📛'
            - '🚫'
            - '💯'
            - '💢'
            - '♨️'
            - '🚷'
            - '🚯'
            - '🚳'
            - '🚱'
            - '🔞'
            - '📵'
            - '🚭'
            - '❗️'
            - '❕'
            - '❓'
            - '❔'
            - '‼️'
            - '⁉️'
            - '🔅'
            - '🔆'
            - '〽️'
            - '⚠️'
            - '🚸'
            - '🔱'
            - '⚜️'
            - '🔰'
            - '♻️'
            - '✅'
            - '🈯️'
            - '💹'
            - '❇️'
            - '✳️'
            - '❎'
            - '🌐'
            - '💠'
            - 'Ⓜ️'
            - '🌀'
            - '💤'
            - '🏧'
            - '🚾'
            - '♿️'
            - '🅿️'
            - '🛗'
            - '🈳'
            - '🈂️'
            - '🛂'
            - '🛃'
            - '🛄'
            - '🛅'
            - '🚹'
            - '🚺'
            - '🚼'
            - '⚧'
            - '🚻'
            - '🚮'
            - '🎦'
            - '📶'
            - '🈁'
            - '🔣'
            - 'ℹ️'
            - '🔤'
            - '🔡'
            - '🔠'
            - '🆖'
            - '🆗'
            - '🆙'
            - '🆒'
            - '🆕'
            - '🆓'
            - '0️⃣'
            - '1️⃣'
            - '2️⃣'
            - '3️⃣'
            - '4️⃣'
            - '5️⃣'
            - '6️⃣'
            - '7️⃣'
            - '8️⃣'
            - '9️⃣'
            - '🔟'
            - '🔢'
            - '#️⃣'
            - '*️⃣'
            - '⏏️'
            - '▶️'
            - '⏸'
            - '⏯'
            - '⏹'
            - '⏺'
            - '⏭'
            - '⏮'
            - '⏩'
            - '⏪'
            - '⏫'
            - '⏬'
            - '◀️'
            - '🔼'
            - '🔽'
            - '➡️'
            - '⬅️'
            - '⬆️'
            - '⬇️'
            - '↗️'
            - '↘️'
            - '↙️'
            - '↖️'
            - '↕️'
            - '↔️'
            - '↪️'
            - '↩️'
            - '⤴️'
            - '⤵️'
            - '🔀'
            - '🔁'
            - '🔂'
            - '🔄'
            - '🔃'
            - '🎵'
            - '🎶'
            - '➕'
            - '➖'
            - '➗'
            - '✖️'
            - '🟰'
            - '♾'
            - '💲'
            - '💱'
            - '™️'
            - '©️'
            - '®️'
            - '〰️'
            - '➰'
            - '➿'
            - '🔚'
            - '🔙'
            - '🔛'
            - '🔝'
            - '🔜'
            - '✔️'
            - '☑️'
            - '🔘'
            - '🔴'
            - '🟠'
            - '🟡'
            - '🟢'
            - '🔵'
            - '🟣'
            - '⚫️'
            - '⚪️'
            - '🟤'
            - '🔺'
            - '🔻'
    condition: selection
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    CommandLine|contains:
        - '🦆'
        - '🦅'
        - '🦉'
        - '🦇'
        - '🐺'
        - '🐗'
        - '🐴'
        - '🦄'
        - '🐝'
        - '🪱'
        - '🐛'
        - '🦋'
        - '🐌'
        - '🐞'
        - '🐜'
        - '🪰'
        - '🪲'
        - '🪳'
        - '🦟'
        - '🦗'
        - '🕷'
        - '🕸'
        - '🦂'
        - '🐢'
        - '🐍'
        - '🦎'
        - '🦖'
        - '🦕'
        - '🐙'
        - '🦑'
        - '🦐'
        - '🦞'
        - '🦀'
        - '🪸'
        - '🐡'
        - '🐠'
        - '🐟'
        - '🐬'
        - '🐳'
        - '🐋'
        - '🦈'
        - '🐊'
        - '🐅'
        - '🐆'
        - '🦓'
        - '🦍'
        - '🦧'
        - '🦣'
        - '🐘'
        - '🦛'
        - '🦏'
        - '🐪'
        - '🐫'
        - '🦒'
        - '🦘'
        - '🦬'
        - '🐃'
        - '🐂'
        - '🐄'
        - '🐎'
        - '🐖'
        - '🐏'
        - '🐑'
        - '🦙'
        - '🐐'
        - '🦌'
        - '🐕'
        - '🐩'
        - '🦮'
        - '🐕‍🦺'
        - '🐈'
        - '🐈‍⬛'
        - '🪶'
        - '🐓'
        - '🦃'
        - '🦤'
        - '🦚'
        - '🦜'
        - '🦢'
        - '🦩'
        - '🕊'
        - '🐇'
        - '🦝'
        - '🦨'
        - '🦡'
        - '🦫'
        - '🦦'
        - '🦥'
        - '🐁'
        - '🐀'
        - '🐿'
        - '🦔'
        - '🐾'
        - '🐉'
        - '🐲'
        - '🌵'
        - '🎄'
        - '🌲'
        - '🌳'
        - '🌴'
        - '🪹'
        - '🪺'
        - '🪵'
        - '🌱'
        - '🌿'
        - '☘️'
        - '🍀'
        - '🎍'
        - '🪴'
        - '🎋'
        - '🍃'
        - '🍂'
        - '🍁'
        - '🍄'
        - '🐚'
        - '🪨'
        - '🌾'
        - '💐'
        - '🌷'
        - '🪷'
        - '🌹'
        - '🥀'
        - '🌺'
        - '🌸'
        - '🌼'
        - '🌻'
        - '🌞'
        - '🌝'
        - '🌛'
        - '🌜'
        - '🌚'
        - '🌕'
        - '🌖'
        - '🌗'
        - '🌘'
        - '🌑'
        - '🌒'
        - '🌓'
        - '🌔'
        - '🌙'
        - '🌎'
        - '🌍'
        - '🌏'
        - '🪐'
        - '💫'
        - '⭐️'
        - '🌟'
        - '✨'
        - '⚡️'
        - '☄️'
        - '💥'
        - '🔥'
        - '🌪'
        - '🌈'
        - '☀️'
        - '🌤'
        - '⛅️'
        - '🌥'
        - '☁️'
        - '🌦'
        - '🌧'
        - '⛈'
        - '🌩'
        - '🌨'
        - '❄️'
        - '☃️'
        - '⛄️'
        - '🌬'
        - '💨'
        - '💧'
        - '💦'
        - '🫧'
        - '☔️'
        - '☂️'
        - '🌊'
        - '🌫🍏'
        - '🍎'
        - '🍐'
        - '🍊'
        - '🍋'
        - '🍌'
        - '🍉'
        - '🍇'
        - '🍓'
        - '🫐'
        - '🍈'
        - '🍒'
        - '🍑'
        - '🥭'
        - '🍍'
        - '🥥'
        - '🥝'
        - '🍅'
        - '🍆'
        - '🥑'
        - '🥦'
        - '🥬'
        - '🥒'
        - '🌶'
        - '🫑'
        - '🌽'
        - '🥕'
        - '🫒'
        - '🧄'
        - '🧅'
        - '🥔'
        - '🍠'
        - '🫘'
        - '🥐'
        - '🥯'
        - '🍞'
        - '🥖'
        - '🥨'
        - '🧀'
        - '🥚'
        - '🍳'
        - '🧈'
        - '🥞'
        - '🧇'
        - '🥓'
        - '🥩'
        - '🍗'
        - '🍖'
        - '🦴'
        - '🌭'
        - '🍔'
        - '🍟'
        - '🍕'
        - '🫓'
        - '🥪'
        - '🥙'
        - '🧆'
        - '🌮'
        - '🌯'
        - '🫔'
        - '🥗'
        - '🥘'
        - '🫕'
        - '🥫'
        - '🍝'
        - '🍜'
        - '🍲'
        - '🍛'
        - '🍣'
        - '🍱'
        - '🥟'
        - '🦪'
        - '🍤'
        - '🍙'
        - '🍚'
        - '🍘'
        - '🍥'
        - '🥠'
        - '🥮'
        - '🍢'
        - '🍡'
        - '🍧'
        - '🍨'
        - '🍦'
        - '🥧'
        - '🧁'
        - '🍰'
        - '🎂'
        - '🍮'
        - '🍭'
        - '🍬'
        - '🍫'
        - '🍿'
        - '🍩'
        - '🍪'
        - '🌰'
        - '🥜'
        - '🍯'
        - '🥛'
        - '🍼'
        - '🫖'
        - '☕️'
        - '🍵'
        - '🧃'
        - '🥤'
        - '🧋'
        - '🫙'
        - '🍶'
        - '🍺'
        - '🍻'
        - '🥂'
        - '🍷'
        - '🫗'
        - '🥃'
        - '🍸'
        - '🍹'
        - '🧉'
        - '🍾'
        - '🧊'
        - '🥄'
        - '🍴'
        - '🍽'
        - '🥣'
        - '🥡'
        - '🥢'
        - '🧂'
        - '⚽️'
        - '🏀'
        - '🏈'
        - '⚾️'
        - '🥎'
        - '🎾'
        - '🏐'
        - '🏉'
        - '🥏'
        - '🎱'
        - '🪀'
        - '🏓'
        - '🏸'
        - '🏒'
        - '🏑'
        - '🥍'
        - '🏏'
        - '🪃'
        - '🥅'
        - '⛳️'
        - '🪁'
        - '🏹'
        - '🎣'
        - '🤿'
        - '🥊'
        - '🥋'
        - '🎽'
        - '🛹'
        - '🛼'
        - '🛷'
        - '⛸'
        - '🥌'
        - '🎿'
        - '⛷'
        - '🏂'
        - '🪂'
        - '🏋️‍♀️'
        - '🏋️'
        - '🏋️‍♂️'
        - '🤼‍♀️'
        - '🤼'
        - '🤼‍♂️'
        - '🤸‍♀️'
        - '🤸'
        - '🤸‍♂️'
        - '⛹️‍♀️'
        - '⛹️'
        - '⛹️‍♂️'
        - '🤺'
        - '🤾‍♀️'
        - '🤾'
        - '🤾‍♂️'
        - '🏌️‍♀️'
        - '🏌️'
        - '🏌️‍♂️'
        - '🏇'
        - '🧘‍♀️'
        - '🧘'
        - '🧘‍♂️'
        - '🏄‍♀️'
        - '🏄'
        - '🏄‍♂️'
        - '🏊‍♀️'
        - '🏊'
        - '🏊‍♂️'
        - '🤽‍♀️'
        - '🤽'
        - '🤽‍♂️'
        - '🚣‍♀️'
        - '🚣'
        - '🚣‍♂️'
        - '🧗‍♀️'
        - '🧗'
        - '🧗‍♂️'
        - '🚵‍♀️'
        - '🚵'
        - '🚵‍♂️'
        - '🚴‍♀️'
        - '🚴'
        - '🚴‍♂️'
        - '🏆'
        - '🥇'
        - '🥈'
        - '🥉'
        - '🏅'
        - '🎖'
        - '🏵'
        - '🎗'
        - '🎫'
        - '🎟'
        - '🎪'
        - '🤹'
        - '🤹‍♂️'
        - '🤹‍♀️'
        - '🎭'
        - '🩰'
        - '🎨'
        - '🎬'
        - '🎤'
        - '🎧'
        - '🎼'
        - '🎹'
        - '🥁'
        - '🪘'
        - '🎷'
        - '🎺'
        - '🪗'
        - '🎸'
        - '🪕'
        - '🎻'
        - '🎲'
        - '♟'
        - '🎯'
        - '🎳'
        - '🎮'
        - '🎰'
        - '🧩'
        - '🚗'
        - '🚕'
        - '🚙'
        - '🚌'
        - '🚎'
        - '🏎'
        - '🚓'
        - '🚑'
        - '🚒'
        - '🚐'
        - '🛻'
        - '🚚'
        - '🚛'
        - '🚜'
        - '🦯'
        - '🦽'
        - '🦼'
        - '🛴'
        - '🚲'
        - '🛵'
        - '🏍'
        - '🛺'
        - '🚨'
        - '🚔'
        - '🚍'
        - '🚘'
        - '🚖'
        - '🛞'
        - '🚡'
        - '🚠'
        - '🚟'
        - '🚃'
        - '🚋'
        - '🚞'
        - '🚝'
        - '🚄'
        - '🚅'
        - '🚈'
        - '🚂'
        - '🚆'
        - '🚇'
        - '🚊'
        - '🚉'
        - '✈️'
        - '🛫'
        - '🛬'
        - '🛩'
        - '💺'
        - '🛰'
        - '🚀'
        - '🛸'
        - '🚁'
        - '🛶'
        - '⛵️'
        - '🚤'
        - '🛥'
        - '🛳'
        - '⛴'
        - '🚢'
        - '⚓️'
        - '🛟'
        - '🪝'
        - '⛽️'
        - '🚧'
        - '🚦'
        - '🚥'
        - '🚏'
        - '🗺'
        - '🗿'
        - '🗽'
        - '🗼'
        - '🏰'
        - '🏯'
        - '🏟'
        - '🎡'
        - '🎢'
        - '🛝'
        - '🎠'
        - '⛲️'
        - '⛱'
        - '🏖'
        - '🏝'
        - '🏜'
        - '🌋'
        - '⛰'
        - '🏔'
        - '🗻'
        - '🏕'
        - '⛺️'
        - '🛖'
        - '🏠'
        - '🏡'
        - '🏘'
        - '🏚'
        - '🏗'
        - '🏭'
        - '🏢'
        - '🏬'
        - '🏣'
        - '🏤'
        - '🏥'
        - '🏦'
        - '🏨'
        - '🏪'
        - '🏫'
        - '🏩'
        - '💒'
        - '🏛'
        - '⛪️'
        - '🕌'
        - '🕍'
        - '🛕'
        - '🕋'
        - '⛩'
        - '🛤'
        - '🛣'
        - '🗾'
        - '🎑'
        - '🏞'
        - '🌅'
        - '🌄'
        - '🌠'
        - '🎇'
        - '🎆'
        - '🌇'
        - '🌆'
        - '🏙'
        - '🌃'
        - '🌌'
        - '🌉'
        - '🌁'
        - '⌚️'
        - '📱'
        - '📲'
        - '💻'
        - '⌨️'
        - '🖥'
        - '🖨'
        - '🖱'
        - '🖲'
        - '🕹'
        - '🗜'
        - '💽'
        - '💾'
        - '💿'
        - '📀'
        - '📼'
        - '📷'
        - '📸'
        - '📹'
        - '🎥'
        - '📽'
        - '🎞'
        - '📞'
        - '☎️'
        - '📟'
        - '📠'
        - '📺'
        - '📻'
        - '🎙'
        - '🎚'
        - '🎛'
        - '🧭'
        - '⏱'
        - '⏲'
        - '⏰'
        - '🕰'
        - '⌛️'
        - '⏳'
        - '📡'
        - '🔋'
        - '🪫'
        - '🔌'
        - '💡'
        - '🔦'
        - '🕯'
        - '🪔'
        - '🧯'
        - '🛢'
        - '💸'
        - '💵'
        - '💴'
        - '💶'
        - '💷'
        - '🪙'
        - '💰'
        - '💳'
        - '💎'
        - '⚖️'
        - '🪜'
        - '🧰'
        - '🪛'
        - '🔧'
        - '🔨'
        - '⚒'
        - '🛠'
        - '⛏'
        - '🪚'
        - '🔩'
        - '⚙️'
        - '🪤'
        - '🧱'
        - '⛓'
        - '🧲'
        - '🔫'
        - '💣'
        - '🧨'
        - '🪓'
        - '🔪'
        - '🗡'
        - '⚔️'
        - '🛡'
        - '🚬'
        - '⚰️'
        - '🪦'
        - '⚱️'
        - '🏺'
        - '🔮'
        - '📿'
        - '🧿'
        - '🪬'
        - '💈'
        - '⚗️'
        - '🔭'
        - '🔬'
        - '🕳'
        - '🩹'
        - '🩺'
        - '🩻'
        - '🩼'
        - '💊'
        - '💉'
        - '🩸'
        - '🧬'
        - '🦠'
        - '🧫'
        - '🧪'
        - '🌡'
        - '🧹'
        - '🪠'
        - '🧺'
        - '🧻'
        - '🚽'
        - '🚰'
        - '🚿'
        - '🛁'
        - '🛀'
        - '🧼'
        - '🪥'
        - '🪒'
        - '🧽'
        - '🪣'
        - '🧴'
        - '🛎'
        - '🔑'
        - '🗝'
        - '🚪'
        - '🪑'
        - '🛋'
        - '🛏'
        - '🛌'
        - '🧸'
        - '🪆'
        - '🖼'
        - '🪞'
        - '🪟'
        - '🛍'
        - '🛒'
        - '🎁'
        - '🎈'
        - '🎏'
        - '🎀'
        - '🪄'
        - '🪅'
        - '🎊'
        - '🎉'
        - '🪩'
        - '🎎'
        - '🏮'
        - '🎐'
        - '🧧'
        - '✉️'
        - '📩'
        - '📨'
        - '📧'
        - '💌'
        - '📥'
        - '📤'
        - '📦'
        - '🏷'
        - '🪧'
        - '📪'
        - '📫'
        - '📬'
        - '📭'
        - '📮'
        - '📯'
        - '📜'
        - '📃'
        - '📄'
        - '📑'
        - '🧾'
        - '📊'
        - '📈'
        - '📉'
        - '🗒'
        - '🗓'
        - '📆'
        - '📅'
        - '🗑'
        - '🪪'
        - '📇'
        - '🗃'
        - '🗳'
        - '🗄'
        - '📋'
        - '📁'
        - '📂'
        - '🗂'
        - '🗞'
        - '📰'
        - '📓'
        - '📔'
        - '📒'
        - '📕'
        - '📗'
        - '📘'
        - '📙'
        - '📚'
        - '📖'
        - '🔖'
        - '🧷'
        - '🔗'
        - '📎'
        - '🖇'
        - '📐'
        - '📏'
        - '🧮'
        - '📌'
        - '📍'
        - '✂️'
        - '🖊'
        - '🖋'
        - '✒️'
        - '🖌'
        - '🖍'
        - '📝'
        - '✏️'
        - '🔍'
        - '🔎'
        - '🔏'
        - '🔐'
        - '🔒'
        - '🔓❤️'
        - '🧡'
        - '💛'
        - '💚'
        - '💙'
        - '💜'
        - '🖤'
        - '🤍'
        - '🤎'
        - '❤️‍🔥'
        - '❤️‍🩹'
        - '💔'
        - '❣️'
        - '💕'
        - '💞'
        - '💓'
        - '💗'
        - '💖'
        - '💘'
        - '💝'
        - '💟'
        - '☮️'
        - '✝️'
        - '☪️'
        - '🕉'
        - '☸️'
        - '✡️'
        - '🔯'
        - '🕎'
        - '☯️'
        - '☦️'
        - '🛐'
        - '⛎'
        - '♈️'
        - '♉️'
        - '♊️'
        - '♋️'
        - '♌️'
        - '♍️'
        - '♎️'
        - '♏️'
        - '♐️'
        - '♑️'
        - '♒️'
        - '♓️'
        - '🆔'
        - '⚛️'
        - '🉑'
        - '☢️'
        - '☣️'
        - '📴'
        - '📳'
        - '🈶'
        - '🈚️'
        - '🈸'
        - '🈺'
        - '🈷️'
        - '✴️'
        - '🆚'
        - '💮'
        - '🉐'
        - '㊙️'
        - '㊗️'
        - '🈴'
        - '🈵'
        - '🈹'
        - '🈲'
        - '🅰️'
        - '🅱️'
        - '🆎'
        - '🆑'
        - '🅾️'
        - '🆘'
        - '❌'
        - '⭕️'
        - '🛑'
        - '⛔️'
        - '📛'
        - '🚫'
        - '💯'
        - '💢'
        - '♨️'
        - '🚷'
        - '🚯'
        - '🚳'
        - '🚱'
        - '🔞'
        - '📵'
        - '🚭'
        - '❗️'
        - '❕'
        - '❓'
        - '❔'
        - '‼️'
        - '⁉️'
        - '🔅'
        - '🔆'
        - '〽️'
        - '⚠️'
        - '🚸'
        - '🔱'
        - '⚜️'
        - '🔰'
        - '♻️'
        - '✅'
        - '🈯️'
        - '💹'
        - '❇️'
        - '✳️'
        - '❎'
        - '🌐'
        - '💠'
        - 'Ⓜ️'
        - '🌀'
        - '💤'
        - '🏧'
        - '🚾'
        - '♿️'
        - '🅿️'
        - '🛗'
        - '🈳'
        - '🈂️'
        - '🛂'
        - '🛃'
        - '🛄'
        - '🛅'
        - '🚹'
        - '🚺'
        - '🚼'
        - '⚧'
        - '🚻'
        - '🚮'
        - '🎦'
        - '📶'
        - '🈁'
        - '🔣'
        - 'ℹ️'
        - '🔤'
        - '🔡'
        - '🔠'
        - '🆖'
        - '🆗'
        - '🆙'
        - '🆒'
        - '🆕'
        - '🆓'
        - '0️⃣'
        - '1️⃣'
        - '2️⃣'
        - '3️⃣'
        - '4️⃣'
        - '5️⃣'
        - '6️⃣'
        - '7️⃣'
        - '8️⃣'
        - '9️⃣'
        - '🔟'
        - '🔢'
        - '#️⃣'
        - '*️⃣'
        - '⏏️'
        - '▶️'
        - '⏸'
        - '⏯'
        - '⏹'
        - '⏺'
        - '⏭'
        - '⏮'
        - '⏩'
        - '⏪'
        - '⏫'
        - '⏬'
        - '◀️'
        - '🔼'
        - '🔽'
        - '➡️'
        - '⬅️'
        - '⬆️'
        - '⬇️'
        - '↗️'
        - '↘️'
        - '↙️'
        - '↖️'
        - '↕️'
        - '↔️'
        - '↪️'
        - '↩️'
        - '⤴️'
        - '⤵️'
        - '🔀'
        - '🔁'
        - '🔂'
        - '🔄'
        - '🔃'
        - '🎵'
        - '🎶'
        - '➕'
        - '➖'
        - '➗'
        - '✖️'
        - '🟰'
        - '♾'
        - '💲'
        - '💱'
        - '™️'
        - '©️'
        - '®️'
        - '〰️'
        - '➰'
        - '➿'
        - '🔚'
        - '🔙'
        - '🔛'
        - '🔝'
        - '🔜'
        - '✔️'
        - '☑️'
        - '🔘'
        - '🔴'
        - '🟠'
        - '🟡'
        - '🟢'
        - '🔵'
        - '🟣'
        - '⚫️'
        - '⚪️'
        - '🟤'
        - '🔺'
        - '🔻'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`CommandLine`	match	`#️⃣` `*️⃣` `0️⃣` `1️⃣` `2️⃣` `3️⃣` `4️⃣` `5️⃣` `6️⃣` `7️⃣` `8️⃣` `9️⃣` `©️` `®️` `‼️` `⁉️` `™️` `ℹ️` `↔️` `↕️` `↖️` `↗️` `↘️` `↙️` `↩️` `↪️` `⌚️` `⌛️` `⌨️` `⏏️` `⏩` `⏪` `⏫` `⏬` `⏭` `⏮` `⏯` `⏰` `⏱` `⏲` `⏳` `⏸` `⏹` `⏺` `Ⓜ️` `▶️` `◀️` `☀️` `☁️` `☂️` corpus 2 (sigma 2) `☃️` `☄️` `☎️` `☑️` `☔️` `☕️` `☘️` `☢️` `☣️` `☦️` `☪️` `☮️` `☯️` `☸️` `♈️` `♉️` `♊️` `♋️` `♌️` `♍️` `♎️` `♏️` `♐️` `♑️` `♒️` `♓️` `♟` corpus 2 (sigma 2) `♨️` `♻️` `♾` `♿️` `⚒` `⚓️` `⚔️` `⚖️` `⚗️` `⚙️` `⚛️` `⚜️` `⚠️` `⚡️` `⚧` `⚪️` `⚫️` `⚰️` `⚱️` `⚽️` `⚾️` `⛄️` `⛅️` `⛈` `⛎` `⛏` `⛓` `⛔️` `⛩` `⛪️` `⛰` `⛱` `⛲️` `⛳️` `⛴` `⛵️` `⛷` `⛸` `⛹️` `⛹️‍♀️` `⛹️‍♂️` `⛺️` `⛽️` `✂️` `✅` `✈️` `✉️` `✏️` `✒️` `✔️` `✖️` `✝️` `✡️` `✨` `✳️` `✴️` `❄️` `❇️` `❌` `❎` `❓` `❔` `❕` `❗️` `❣️` `❤️‍🔥` corpus 2 (sigma 2) `❤️‍🩹` corpus 2 (sigma 2) `➕` `➖` `➗` `➡️` `➰` `➿` `⤴️` `⤵️` `⬅️` `⬆️` `⬇️` `⭐️` `⭕️` `〰️` `〽️` `㊗️` `㊙️` `🅰️` `🅱️` `🅾️` `🅿️` `🆎` `🆑` `🆒` `🆓` `🆔` `🆕` `🆖` `🆗` `🆘` `🆙` `🆚` `🈁` `🈂️` `🈚️` `🈯️` `🈲` `🈳` `🈴` `🈵` `🈶` `🈷️` `🈸` `🈹` `🈺` `🉐` `🉑` `🌀` `🌁` `🌃` `🌄` `🌅` `🌆` `🌇` `🌈` `🌉` `🌊` `🌋` `🌌` `🌍` `🌎` `🌏` `🌐` `🌑` `🌒` `🌓` `🌔` `🌕` `🌖` `🌗` `🌘` `🌙` `🌚` `🌛` `🌜` `🌝` `🌞` `🌟` `🌠` `🌡` `🌤` `🌥` `🌦` `🌧` `🌨` `🌩` `🌪` `🌫🍏` `🌬` `🌭` `🌮` `🌯` `🌰` `🌱` `🌲` `🌳` `🌴` `🌵` `🌶` `🌷` `🌸` `🌹` `🌺` `🌻` `🌼` `🌽` `🌾` `🌿` `🍀` `🍁` `🍂` `🍃` `🍄` `🍅` `🍆` `🍇` `🍈` `🍉` `🍊` `🍋` `🍌` `🍍` `🍎` `🍐` `🍑` `🍒` `🍓` `🍔` `🍕` `🍖` `🍗` `🍘` `🍙` `🍚` `🍛` `🍜` `🍝` `🍞` `🍟` `🍠` `🍡` `🍢` `🍣` `🍤` `🍥` `🍦` `🍧` `🍨` `🍩` `🍪` `🍫` `🍬` `🍭` `🍮` `🍯` `🍰` `🍱` `🍲` `🍳` `🍴` `🍵` `🍶` `🍷` `🍸` `🍹` `🍺` `🍻` `🍼` `🍽` `🍾` `🍿` `🎀` `🎁` `🎂` `🎄` `🎆` `🎇` `🎈` `🎉` `🎊` `🎋` `🎍` `🎎` `🎏` `🎐` `🎑` `🎖` `🎗` `🎙` `🎚` `🎛` `🎞` `🎟` `🎠` `🎡` `🎢` `🎣` `🎤` `🎥` `🎦` `🎧` `🎨` `🎪` `🎫` `🎬` `🎭` `🎮` `🎯` `🎰` `🎱` `🎲` `🎳` `🎵` `🎶` `🎷` `🎸` `🎹` `🎺` `🎻` `🎼` `🎽` `🎾` `🎿` `🏀` `🏂` `🏄` `🏄‍♀️` `🏄‍♂️` `🏅` `🏆` `🏇` `🏈` `🏉` `🏊` `🏊‍♀️` `🏊‍♂️` `🏋️` `🏋️‍♀️` `🏋️‍♂️` `🏌️` `🏌️‍♀️` `🏌️‍♂️` `🏍` `🏎` `🏏` `🏐` `🏑` `🏒` `🏓` `🏔` `🏕` `🏖` `🏗` `🏘` `🏙` `🏚` `🏛` `🏜` `🏝` `🏞` `🏟` `🏠` `🏡` `🏢` `🏣` `🏤` `🏥` `🏦` `🏧` `🏨` `🏩` `🏪` `🏫` `🏬` `🏭` `🏮` `🏯` `🏰` `🏵` `🏷` `🏸` `🏹` `🏺` `🐀` `🐁` `🐂` `🐃` `🐄` `🐅` `🐆` `🐇` `🐈` `🐈‍⬛` `🐉` `🐊` `🐋` `🐌` `🐍` `🐎` `🐏` `🐐` `🐑` `🐓` `🐕` `🐕‍🦺` `🐖` `🐗` `🐘` `🐙` `🐚` `🐛` `🐜` `🐝` `🐞` `🐟` `🐠` `🐡` `🐢` `🐩` `🐪` `🐫` `🐬` `🐲` `🐳` `🐴` `🐺` `🐾` `🐿` `💈` `💉` `💊` `💌` `💎` `💐` `💒` `💓` `💔` `💕` `💖` `💗` `💘` `💙` `💚` `💛` `💜` `💝` `💞` `💟` `💠` `💡` `💢` `💣` `💤` `💥` `💦` `💧` `💨` `💫` `💮` `💯` `💰` `💱` `💲` `💳` `💴` `💵` `💶` `💷` `💸` `💹` `💺` `💻` `💽` `💾` `💿` `📀` `📁` `📂` `📃` `📄` `📅` `📆` `📇` `📈` `📉` `📊` `📋` `📌` `📍` `📎` `📏` `📐` `📑` `📒` `📓` `📔` `📕` `📖` `📗` `📘` `📙` `📚` `📛` `📜` `📝` `📞` `📟` `📠` `📡` `📤` `📥` `📦` `📧` `📨` `📩` `📪` `📫` `📬` `📭` `📮` `📯` `📰` `📱` `📲` `📳` `📴` `📵` `📶` `📷` `📸` `📹` `📺` `📻` `📼` `📽` `📿` `🔀` `🔁` `🔂` `🔃` `🔄` `🔅` `🔆` `🔋` `🔌` `🔍` `🔎` `🔏` `🔐` `🔑` `🔒` `🔓❤️` `🔖` `🔗` `🔘` `🔙` `🔚` `🔛` `🔜` `🔝` `🔞` `🔟` `🔠` `🔡` `🔢` `🔣` `🔤` `🔥` `🔦` `🔧` `🔨` `🔩` `🔪` `🔫` `🔬` `🔭` `🔮` `🔯` `🔰` `🔱` `🔴` `🔵` `🔺` `🔻` `🔼` `🔽` `🕉` `🕊` `🕋` `🕌` `🕍` `🕎` `🕯` `🕰` `🕳` `🕷` `🕸` `🕹` `🖇` `🖊` `🖋` `🖌` `🖍` `🖤` `🖥` `🖨` `🖱` `🖲` `🖼` `🗂` `🗃` `🗄` `🗑` `🗒` `🗓` `🗜` `🗝` `🗞` `🗡` `🗳` `🗺` `🗻` `🗼` `🗽` `🗾` `🗿` `🚀` `🚁` `🚂` `🚃` `🚄` `🚅` `🚆` `🚇` `🚈` `🚉` `🚊` `🚋` `🚌` `🚍` `🚎` `🚏` `🚐` `🚑` `🚒` `🚓` `🚔` `🚕` `🚖` `🚗` `🚘` `🚙` `🚚` `🚛` `🚜` `🚝` `🚞` `🚟` `🚠` `🚡` `🚢` `🚣` `🚣‍♀️` `🚣‍♂️` `🚤` `🚥` `🚦` `🚧` `🚨` `🚪` `🚫` `🚬` `🚭` `🚮` `🚯` `🚰` `🚱` `🚲` `🚳` `🚴` `🚴‍♀️` `🚴‍♂️` `🚵` `🚵‍♀️` `🚵‍♂️` `🚷` `🚸` `🚹` `🚺` `🚻` `🚼` `🚽` `🚾` `🚿` `🛀` `🛁` `🛂` `🛃` `🛄` `🛅` `🛋` `🛌` `🛍` `🛎` `🛏` `🛐` `🛑` `🛒` `🛕` `🛖` `🛗` `🛝` corpus 2 (sigma 2) `🛞` corpus 2 (sigma 2) `🛟` corpus 2 (sigma 2) `🛠` `🛡` `🛢` `🛣` `🛤` `🛥` `🛩` `🛫` `🛬` `🛰` `🛳` `🛴` `🛵` `🛶` `🛷` `🛸` `🛹` `🛺` `🛻` `🛼` `🟠` `🟡` `🟢` `🟣` `🟤` `🟰` corpus 2 (sigma 2) `🤍` `🤎` `🤸` `🤸‍♀️` `🤸‍♂️` `🤹` `🤹‍♀️` `🤹‍♂️` `🤺` `🤼` `🤼‍♀️` `🤼‍♂️` `🤽` `🤽‍♀️` `🤽‍♂️` `🤾` `🤾‍♀️` `🤾‍♂️` `🤿` `🥀` `🥁` `🥂` `🥃` `🥄` `🥅` `🥇` `🥈` `🥉` `🥊` `🥋` `🥌` `🥍` `🥎` `🥏` `🥐` `🥑` `🥒` `🥓` `🥔` `🥕` `🥖` `🥗` `🥘` `🥙` `🥚` `🥛` `🥜` `🥝` `🥞` `🥟` `🥠` `🥡` `🥢` `🥣` `🥤` `🥥` `🥦` `🥧` `🥨` `🥩` `🥪` `🥫` `🥬` `🥭` `🥮` `🥯` `🦀` `🦂` `🦃` `🦄` `🦅` `🦆` `🦇` `🦈` `🦉` `🦋` `🦌` `🦍` `🦎` `🦏` `🦐` `🦑` `🦒` `🦓` `🦔` `🦕` `🦖` `🦗` `🦘` `🦙` `🦚` `🦛` `🦜` `🦝` `🦞` `🦟` `🦠` `🦡` `🦢` `🦣` `🦤` `🦥` `🦦` `🦧` `🦨` `🦩` `🦪` `🦫` `🦬` `🦮` `🦯` `🦴` corpus 2 (sigma 2) `🦼` `🦽` `🧀` `🧁` `🧂` `🧃` `🧄` `🧅` `🧆` `🧇` `🧈` `🧉` `🧊` `🧋` `🧗` `🧗‍♀️` `🧗‍♂️` `🧘` `🧘‍♀️` `🧘‍♂️` `🧡` `🧧` `🧨` `🧩` `🧪` `🧫` `🧬` `🧭` `🧮` `🧯` `🧰` `🧱` `🧲` `🧴` `🧷` `🧸` `🧹` `🧺` `🧻` `🧼` `🧽` `🧾` `🧿` `🩰` corpus 2 (sigma 2) `🩸` corpus 2 (sigma 2) `🩹` `🩺` `🩻` corpus 2 (sigma 2) `🩼` corpus 2 (sigma 2) `🪀` `🪁` `🪂` `🪃` `🪄` `🪅` `🪆` `🪐` `🪑` `🪒` `🪓` `🪔` `🪕` `🪗` `🪘` `🪙` `🪚` `🪛` `🪜` `🪝` `🪞` `🪟` `🪠` `🪣` `🪤` `🪥` `🪦` `🪧` `🪨` `🪩` corpus 2 (sigma 2) `🪪` corpus 2 (sigma 2) `🪫` corpus 2 (sigma 2) `🪬` corpus 2 (sigma 2) `🪰` `🪱` `🪲` `🪳` `🪴` `🪵` `🪶` `🪷` corpus 2 (sigma 2) `🪸` corpus 2 (sigma 2) `🪹` corpus 2 (sigma 2) `🪺` corpus 2 (sigma 2) `🫐` `🫑` `🫒` `🫓` `🫔` `🫕` `🫖` `🫗` corpus 2 (sigma 2) `🫘` corpus 2 (sigma 2) `🫙` corpus 2 (sigma 2) `🫧` corpus 2 (sigma 2)

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)

Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 3

MITRE ATT&CK coverage

Event coverage

Rule body yaml

Stages and Predicates

Stage 0: `condition`

Stage 1: `selection`

Indicators

Keyboard shortcuts

Search operators

Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 3

MITRE ATT&CK coverage

Event coverage

Rule body yaml

Stages and Predicates

Stage 0: condition

Stage 1: selection

Indicators

Stage 0: `condition`

Stage 1: `selection`