IC Catching Emojis Into File Names
Query
// Sergio Albea 16-03-2026 ©️
DeviceFileEvents
| where Timestamp > ago(7d)
| where isnotempty(FileName)
| extend Icons = extract_all(@"([\x{1F300}-\x{1FAFF}\x{2600}-\x{27BF}])", FileName)
| where isnotempty(Icons)
| project InitiatingProcessRemoteSessionIP,MD5,DeviceName,FileName,FolderPath,InitiatingProcessFileName,Icons,ReportId,DeviceIdAbout this query
MITRE ATT&CK Technique(s)
| Technique ID | Title |
|---|---|
| T1036 | Masquerading |
Author: Sergio Albea (17/03/2026)
[IC] - Catching Emojis into File Names
| Technique ID | Title |
|---|---|
| T1036 | Masquerading |
| Author | Sergio Albea (16/03/2026) |
|---|
[IC] - Catching Emojis into File Names Attackers do not only use emojis in the subject. Sometimes they also use them in the file name itself to make the file look more attractive or legitimate. Based on my experience, I am not expecting legitimate files names with icons so it can be an interesting case to easily convert the hunting into a detection. For example:
- 📄Invoice.pdf
- 🔐Reset_Password.html
- 📦Delivery_Document.zip
This can help find:
- Suspicious files dropped on disk
- Files downloaded from phishing emails
- User-downloaded scam files
- Payloads with social engineering names
Explanation
This query is designed to detect suspicious files by identifying those with emojis in their filenames, which is a technique often used by attackers to make files appear more legitimate or attractive. Here's a simple breakdown of what the query does:
-
Data Source: It looks at
DeviceFileEvents, which records file-related activities on devices. -
Time Frame: It filters events from the last 7 days.
-
File Name Check: It ensures that the file name is not empty.
-
Emoji Extraction: It uses a regular expression to extract emojis from the file names. Emojis are represented by specific Unicode ranges.
-
Filter for Emojis: It only keeps records where emojis are found in the file names.
-
Output: It displays several details about each suspicious file, including:
- The IP address of the process that initiated the file event.
- The MD5 hash of the file.
- The device name where the file event occurred.
- The file name and its folder path.
- The name of the process that initiated the file event.
- The extracted emojis.
- The report ID and device ID for further investigation.
Overall, this query helps identify potentially malicious files that use social engineering tactics by incorporating emojis in their names, which is not typical for legitimate files.
