Script Interpreter Executing Commands with Non-ASCII Characters

Benjamin Zulliger@benscha

•updated Jun 2, 2026•30•2•377

This rule detects the execution of script interpreters (such as PowerShell, cmd, bash, python, etc.) where the command line contains non-ASCII characters, specifically Cyrillic, Arabic, or Chinese Unicode characters. This pattern can be indicative of obfuscation techniques used by adversaries to evade detection or to target specific regions.