Suspicious FileFix Execution Pattern

Hunt Hypothesis

Detects suspicious FileFix execution patterns where users are tricked into running malicious commands through browser file upload dialog manipulation. This attack typically begins when users visit mal

Detection Rule

Sigma (Original)

title: Suspicious FileFix Execution Pattern
id: b5b29e4e-31fa-4fdf-b058-296e7a1aa0c2
related:
    - id: 4fee3d51-8069-4a4c-a0f7-924fcaff2c70
      type: similar
    - id: 4be03877-d5b6-4520-85c9-a5911c0a656c
      type: obsolete
status: experimental
description: |
    Detects suspicious FileFix execution patterns where users are tricked into running malicious commands through browser file upload dialog manipulation.
    This attack typically begins when users visit malicious websites impersonating legitimate services or news platforms,
    which may display fake CAPTCHA challenges or direct instructions to open file explorer and paste clipboard content.
    The clipboard content usually contains commands that download and execute malware, such as information stealing tools.
references:
    - https://mrd0x.com/filefix-clickfix-alternative/
    - https://expel.com/blog/cache-smuggling-when-a-picture-isnt-a-thousand-words/ # phishing lure directly asking users to open file explorer and paste command
    - https://blog.checkpoint.com/research/filefix-the-new-social-engineering-attack-building-on-clickfix-tested-in-the-wild/
author: 0xFustang, Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-11-24
tags:
    - attack.execution
    - attack.t1204.004
logsource:
    category: process_creation
    product: windows
detection:
    selection_exec_parent:
        # This is case where phishing pages trick users to paste commands in browser file upload dialog
        ParentImage|endswith:
            - '\brave.exe'
            - '\chrome.exe'
            - '\firefox.exe'
            - '\msedge.exe'
        CommandLine|contains: '#'
    selection_cli_lolbin:
        CommandLine|contains:
            - '%comspec%'
            - 'bitsadmin'
            - 'certutil'
            - 'cmd'
            - 'cscript'
            - 'curl'
            - 'finger'
            - 'mshta'
            - 'powershell'
            - 'pwsh'
            - 'regsvr32'
            - 'rundll32'
            - 'schtasks'
            - 'wget'
            - 'wscript'
    selection_cli_captcha:
        CommandLine|contains:
            - 'account'
            - 'anti-bot'
            - 'botcheck'
            - 'captcha'
            - 'challenge'
            - 'confirmation'
            - 'fraud'
            - 'human'
            - 'identification'
            - 'identificator'
            - 'identity'
            - 'robot'
            - 'validation'
            - 'verification'
            - 'verify'
    condition: selection_exec_parent and 1 of selection_cli_*
falsepositives:
    - Legitimate use of PowerShell or other utilities launched from browser extensions or automation tools
level: high

KQL (Azure Sentinel)

imProcessCreate
| where (((ParentProcessName endswith "\\brave.exe" or ParentProcessName endswith "\\chrome.exe" or ParentProcessName endswith "\\firefox.exe" or ParentProcessName endswith "\\msedge.exe") or (ActingProcessName endswith "\\brave.exe" or ActingProcessName endswith "\\chrome.exe" or ActingProcessName endswith "\\firefox.exe" or ActingProcessName endswith "\\msedge.exe")) and TargetProcessCommandLine contains "#") and ((TargetProcessCommandLine contains "%comspec%" or TargetProcessCommandLine contains "bitsadmin" or TargetProcessCommandLine contains "certutil" or TargetProcessCommandLine contains "cmd" or TargetProcessCommandLine contains "cscript" or TargetProcessCommandLine contains "curl" or TargetProcessCommandLine contains "finger" or TargetProcessCommandLine contains "mshta" or TargetProcessCommandLine contains "powershell" or TargetProcessCommandLine contains "pwsh" or TargetProcessCommandLine contains "regsvr32" or TargetProcessCommandLine contains "rundll32" or TargetProcessCommandLine contains "schtasks" or TargetProcessCommandLine contains "wget" or TargetProcessCommandLine contains "wscript") or (TargetProcessCommandLine contains "account" or TargetProcessCommandLine contains "anti-bot" or TargetProcessCommandLine contains "botcheck" or TargetProcessCommandLine contains "captcha" or TargetProcessCommandLine contains "challenge" or TargetProcessCommandLine contains "confirmation" or TargetProcessCommandLine contains "fraud" or TargetProcessCommandLine contains "human" or TargetProcessCommandLine contains "identification" or TargetProcessCommandLine contains "identificator" or TargetProcessCommandLine contains "identity" or TargetProcessCommandLine contains "robot" or TargetProcessCommandLine contains "validation" or TargetProcessCommandLine contains "verification" or TargetProcessCommandLine contains "verify"))

Required Data Sources

False Positive Guidance

• Legitimate use of PowerShell or other utilities launched from browser extensions or automation tools

MITRE ATT&CK Context

• Tactic: Execution
• Technique: T1204.004 — T1204.004

References

• https://mrd0x.com/filefix-clickfix-alternative/
• https://expel.com/blog/cache-smuggling-when-a-picture-isnt-a-thousand-words/
• https://blog.checkpoint.com/research/filefix-the-new-social-engineering-attack-building-on-clickfix-tested-in-the-wild/
• SigmaHQ Rule