IC Catching Emojis Into File Names
Query
// Sergio Albea 16-03-2026 ©️
DeviceFileEvents
| where Timestamp > ago(7d)
| where isnotempty(FileName)
| extend Icons = extract_all(@"([\x{1F300}-\x{1FAFF}\x{2600}-\x{27BF}])", FileName)
| where isnotempty(Icons)
| project InitiatingProcessRemoteSessionIP,MD5,DeviceName,FileName,FolderPath,InitiatingProcessFileName,Icons,ReportId,DeviceIdAbout this query
MITRE ATT&CK Technique(s)
| Technique ID | Title |
|---|---|
| T1036 | Masquerading |
Author: Sergio Albea (05/06/2026)
[IC] - Catching Emojis into File Names
| Technique ID | Title |
|---|---|
| T1036 | Masquerading |
| Author | Sergio Albea (16/03/2026) |
|---|
[IC] - Catching Emojis into File Names Attackers do not only use emojis in the subject. Sometimes they also use them in the file name itself to make the file look more attractive or legitimate. Based on my experience, I am not expecting legitimate files names with icons so it can be an interesting case to easily convert the hunting into a detection. For example:
- 📄Invoice.pdf
- 🔐Reset_Password.html
- 📦Delivery_Document.zip
This can help find:
- Suspicious files dropped on disk
- Files downloaded from phishing emails
- User-downloaded scam files
- Payloads with social engineering names
Explanation
This query is designed to detect suspicious files that have emojis in their filenames, which is a technique used by attackers to make files appear more legitimate or attractive. The query focuses on identifying files that have been created or modified in the last seven days and contain emojis in their names. Here's a simple breakdown of what the query does:
-
Data Source: It looks at
DeviceFileEvents, which records file-related activities on devices. -
Time Frame: It filters events to only include those from the past seven days (
Timestamp > ago(7d)). -
File Name Check: It ensures that the file name is not empty (
isnotempty(FileName)). -
Emoji Extraction: It uses a regular expression to extract emojis from the file names (
extract_all(@"([\x{1F300}-\x{1FAFF}\x{2600}-\x{27BF}])", FileName)). -
Filter for Emojis: It further filters the results to only include files that actually have emojis in their names (
isnotempty(Icons)). -
Output: It selects and displays specific details about these files, such as the IP address of the initiating process, file hash (MD5), device name, file name, folder path, initiating process file name, extracted icons (emojis), report ID, and device ID.
The goal of this query is to help identify potentially malicious files that use social engineering tactics, such as including emojis in file names, to deceive users.
