{"id":"8f2a5c3d-9e4b-4a7c-8d1f-2e5a6b9c3d7e","title":"Suspicious Space Characters in TypedPaths Registry Path - FileFix","description":"Detects the occurrence of numerous space characters in TypedPaths registry paths, which may indicate execution via phishing lures using file-fix techniques to hide malicious commands.\n","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-11-04","modified":"","tags":["attack.execution","attack.stealth","attack.t1204.004","attack.t1027.010"],"technique_ids":["T1027.010","T1204.004"],"logsource":{"category":"registry_set","product":"windows"},"falsepositives":["Unlikely"],"references":["https://expel.com/blog/cache-smuggling-when-a-picture-isnt-a-thousand-words/","https://mrd0x.com/filefix-clickfix-alternative/"],"source_path":"rules/windows/registry/registry_set/registry_set_susp_typedpaths_space_characters.yml","source_sha256":"c4ce5775bdffabc0249ef4e574683d867a6c4a509fd0b0e48ce873f4d84f1744","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_susp_typedpaths_space_characters.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious Space Characters in TypedPaths Registry Path - FileFix\nid: 8f2a5c3d-9e4b-4a7c-8d1f-2e5a6b9c3d7e\nrelated:\n    - id: 3ae9974a-eb09-4044-8e70-8980a50c12c8\n      type: similar\nstatus: experimental\ndescription: |\n    Detects the occurrence of numerous space characters in TypedPaths registry paths, which may indicate execution via phishing lures using file-fix techniques to hide malicious commands.\nreferences:\n    - https://expel.com/blog/cache-smuggling-when-a-picture-isnt-a-thousand-words/\n    - https://mrd0x.com/filefix-clickfix-alternative/\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\ndate: 2025-11-04\ntags:\n    - attack.execution\n    - attack.stealth\n    - attack.t1204.004\n    - attack.t1027.010\nlogsource:\n    category: registry_set\n    product: windows\ndetection:\n    selection_key:\n        TargetObject|endswith: '\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\TypedPaths\\url1'\n        Details|contains: '#'\n    selection_space_variation:\n        Details|contains:\n            - '            ' # En Quad (U+2000)\n            - '            ' # Em Quad (U+2001)\n            - '            ' # En Space (U+2002)\n            - '            ' # Em Space (U+2003)\n            - '            ' # Three-Per-Em Space (U+2004)\n            - '            ' # Four-Per-Em Space (U+2005)\n            - '            ' # Six-Per-Em Space (U+2006)\n            - '            ' # Figure Space (U+2007)\n            - '            ' # Punctuation Space (U+2008)\n            - '            ' # Thin Space (U+2009)\n            - '            ' # Hair Space (U+200A)\n            - '            ' # No-Break Space (U+00A0)\n            - '            ' # Normal space\n    condition: all of selection_*\nfalsepositives:\n    - Unlikely\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1027.010","id":"T1027.010","name":"Command Obfuscation","page":"techniques/enterprise/T1027.010/"},{"key":"enterprise/T1204.004","id":"T1204.004","name":"Malicious Copy and Paste","page":"techniques/enterprise/T1204.004/"}],"data_path":"data/detection-rules/8f2a5c3d-9e4b-4a7c-8d1f-2e5a6b9c3d7e.json","kind":"sigma"}