{"id":"d487ed4a-fd24-436d-a0b2-f4e95f7b2635","title":"Suspicious ClickFix/FileFix Execution Pattern","description":"Detects suspicious execution patterns where users are tricked into running malicious commands via clipboard manipulation, either through the Windows Run dialog (ClickFix) or File Explorer address bar (FileFix).\nAttackers leverage social engineering campaigns—such as fake CAPTCHA challenges or urgent alerts—encouraging victims to paste clipboard contents, often executing mshta.exe, powershell.exe, or similar commands to infect systems.\n","author":"montysecurity, Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-11-19","modified":"","tags":["attack.execution","attack.t1204.001","attack.t1204.004"],"technique_ids":["T1204.001","T1204.004"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unlikely"],"references":["https://github.com/JohnHammond/recaptcha-phish","https://www.zscaler.com/blogs/security-research/deepseek-lure-using-captchas-spread-malware","https://www.threatdown.com/blog/clipboard-hijacker-tries-to-install-a-trojan/","https://app.any.run/tasks/5c16b4db-4b36-4039-a0ed-9b09abff8be2","https://www.esentire.com/security-advisories/netsupport-rat-clickfix-distribution","https://www.scpx.com.au/2025/11/16/decades-old-finger-protocol-abused-in-clickfix-malware-attacks/"],"source_path":"rules/windows/process_creation/proc_creation_win_susp_clickfix_filefix_execution.yml","source_sha256":"1be41e59cb4fe10f8029110aa0b9041d328077b327ad4ff8f9718b7a8e7490ef","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_clickfix_filefix_execution.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious ClickFix/FileFix Execution Pattern\nid: d487ed4a-fd24-436d-a0b2-f4e95f7b2635\nrelated:\n    - id: f5fe36cf-f1ec-4c23-903d-09a3110f6bbb\n      type: similar\nstatus: experimental\ndescription: |\n    Detects suspicious execution patterns where users are tricked into running malicious commands via clipboard manipulation, either through the Windows Run dialog (ClickFix) or File Explorer address bar (FileFix).\n    Attackers leverage social engineering campaigns—such as fake CAPTCHA challenges or urgent alerts—encouraging victims to paste clipboard contents, often executing mshta.exe, powershell.exe, or similar commands to infect systems.\nreferences:\n    - https://github.com/JohnHammond/recaptcha-phish\n    - https://www.zscaler.com/blogs/security-research/deepseek-lure-using-captchas-spread-malware\n    - https://www.threatdown.com/blog/clipboard-hijacker-tries-to-install-a-trojan/\n    - https://app.any.run/tasks/5c16b4db-4b36-4039-a0ed-9b09abff8be2\n    - https://www.esentire.com/security-advisories/netsupport-rat-clickfix-distribution\n    - https://www.scpx.com.au/2025/11/16/decades-old-finger-protocol-abused-in-clickfix-malware-attacks/ # filefix variant\nauthor: montysecurity, Swachchhanda Shrawan Poudel (Nextron Systems)\ndate: 2025-11-19\ntags:\n    - attack.execution\n    - attack.t1204.001\n    - attack.t1204.004\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_parent:\n        ParentImage|endswith: '\\explorer.exe'\n        CommandLine|contains: '#'\n    selection_cli_captcha:\n        CommandLine|contains:\n            - 'account'\n            - 'anti-bot'\n            - 'botcheck'\n            - 'captcha'\n            - 'challenge'\n            - 'confirmation'\n            - 'fraud'\n            - 'human'\n            - 'identification'\n            - 'identificator'\n            - 'identity'\n            - 'robot'\n            - 'validation'\n            - 'verification'\n            - 'verify'\n    condition: all of selection_*\nfalsepositives:\n    - Unlikely\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1204.001","id":"T1204.001","name":"Malicious Link","page":"techniques/enterprise/T1204.001/"},{"key":"enterprise/T1204.004","id":"T1204.004","name":"Malicious Copy and Paste","page":"techniques/enterprise/T1204.004/"}],"data_path":"data/detection-rules/d487ed4a-fd24-436d-a0b2-f4e95f7b2635.json","kind":"sigma"}