Command Line Homoglyphs - Windows (PowerShell)

id: '44644.87463'
title: Command Line Homoglyphs - Windows
description: Threat actors may use homoglyph attacks by substituting characters in
  process names or commands with visually similar Unicode symbols to impersonate legitimate
  commands, or messages (e.g., using Cyrillic “а” instead of Latin “a”). This tactic
  is often used to evade string-based detection and confuse analysts during investigation.
  This use case detects Windows processes containing Unicode characters from commonly
  abused homoglyph ranges, including Cyrillic extended, Greek extended, and full-width
  Latin letters and digits.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<" OR zTERM(EventCode=4104) OR "<EventID>4104<") | regex process="\w+([Ѐ-ӿ]+|[Ͱ-Ͽ]+)"
  | table _time, host, user, process, process_name, parent_process_name | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- defense-evasion:obfuscated files or information:command obfuscation
technique_id:
- T1027.010
data_category:
- PowerShell logs
references:
- https://app.any.run/tasks/c044f84a-fd44-47ab-b53f-976debf96e63
- https://www.zdnet.com/article/magecart-group-uses-homoglyph-attacks-to-fool-you-into-visiting-malicious-websites/
- https://www.meshsecurity.io/blog/homoglyph-attacks-understanding-and-mitigating-the-threat
- https://www.bitdefender.com/en-us/blog/businessinsights/homograph-phishing-attacks-when-user-awareness-is-not-enough