{"id":"b5b29e4e-31fa-4fdf-b058-296e7a1aa0c2","title":"Suspicious FileFix Execution Pattern","description":"Detects suspicious FileFix execution patterns where users are tricked into running malicious commands through browser file upload dialog manipulation.\nThis attack typically begins when users visit malicious websites impersonating legitimate services or news platforms,\nwhich may display fake CAPTCHA challenges or direct instructions to open file explorer and paste clipboard content.\nThe clipboard content usually contains commands that download and execute malware, such as information stealing tools.\n","author":"0xFustang, Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-11-24","modified":"","tags":["attack.execution","attack.t1204.004"],"technique_ids":["T1204.004"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Legitimate use of PowerShell or other utilities launched from browser extensions or automation tools"],"references":["https://mrd0x.com/filefix-clickfix-alternative/","https://expel.com/blog/cache-smuggling-when-a-picture-isnt-a-thousand-words/","https://blog.checkpoint.com/research/filefix-the-new-social-engineering-attack-building-on-clickfix-tested-in-the-wild/"],"source_path":"rules/windows/process_creation/proc_creation_win_susp_filefix_execution_pattern.yml","source_sha256":"e60c301f36e6292ba79622e7961fdceaef9ad5f137f4f2d744cadfbd0017ae5a","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_filefix_execution_pattern.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious FileFix Execution Pattern\nid: b5b29e4e-31fa-4fdf-b058-296e7a1aa0c2\nrelated:\n    - id: 4fee3d51-8069-4a4c-a0f7-924fcaff2c70\n      type: similar\n    - id: 4be03877-d5b6-4520-85c9-a5911c0a656c\n      type: obsolete\nstatus: experimental\ndescription: |\n    Detects suspicious FileFix execution patterns where users are tricked into running malicious commands through browser file upload dialog manipulation.\n    This attack typically begins when users visit malicious websites impersonating legitimate services or news platforms,\n    which may display fake CAPTCHA challenges or direct instructions to open file explorer and paste clipboard content.\n    The clipboard content usually contains commands that download and execute malware, such as information stealing tools.\nreferences:\n    - https://mrd0x.com/filefix-clickfix-alternative/\n    - https://expel.com/blog/cache-smuggling-when-a-picture-isnt-a-thousand-words/ # phishing lure directly asking users to open file explorer and paste command\n    - https://blog.checkpoint.com/research/filefix-the-new-social-engineering-attack-building-on-clickfix-tested-in-the-wild/\nauthor: 0xFustang, Swachchhanda Shrawan Poudel (Nextron Systems)\ndate: 2025-11-24\ntags:\n    - attack.execution\n    - attack.t1204.004\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_exec_parent:\n        # This is case where phishing pages trick users to paste commands in browser file upload dialog\n        ParentImage|endswith:\n            - '\\brave.exe'\n            - '\\chrome.exe'\n            - '\\firefox.exe'\n            - '\\msedge.exe'\n        CommandLine|contains: '#'\n    selection_cli_lolbin:\n        CommandLine|contains:\n            - '%comspec%'\n            - 'bitsadmin'\n            - 'certutil'\n            - 'cmd'\n            - 'cscript'\n            - 'curl'\n            - 'finger'\n            - 'mshta'\n            - 'powershell'\n            - 'pwsh'\n            - 'regsvr32'\n            - 'rundll32'\n            - 'schtasks'\n            - 'wget'\n            - 'wscript'\n    selection_cli_captcha:\n        CommandLine|contains:\n            - 'account'\n            - 'anti-bot'\n            - 'botcheck'\n            - 'captcha'\n            - 'challenge'\n            - 'confirmation'\n            - 'fraud'\n            - 'human'\n            - 'identification'\n            - 'identificator'\n            - 'identity'\n            - 'robot'\n            - 'validation'\n            - 'verification'\n            - 'verify'\n    condition: selection_exec_parent and 1 of selection_cli_*\nfalsepositives:\n    - Legitimate use of PowerShell or other utilities launched from browser extensions or automation tools\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1204.004","id":"T1204.004","name":"Malicious Copy and Paste","page":"techniques/enterprise/T1204.004/"}],"data_path":"data/detection-rules/b5b29e4e-31fa-4fdf-b058-296e7a1aa0c2.json","kind":"sigma"}