Sigma rule: FileFix - Suspicious Child Process from Browser File Upload Abuse

Rule

Title

FileFix - Suspicious Child Process from Browser File Upload Abuse

Status

deprecated

Level

high

Author

0xFustang

Date

2025-06-26

Modified

2025-11-24

File

deprecated/windows/proc_creation_win_filefix_browsers.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects potentially suspicious subprocesses such as LOLBINs spawned by web browsers. This activity could be associated with the "FileFix" social engineering technique,
where users are tricked into launching the file explorer via a browser-based phishing page and pasting malicious commands into the address bar.
The technique abuses clipboard manipulation and disguises command execution as benign file path access, resulting in covert execution of system utilities.

Log source

product

windows

category

process_creation

Detection

selection:
    ParentImage|endswith:
        - '\brave.exe'
        - '\chrome.exe'
        - '\firefox.exe'
        - '\msedge.exe'
    Image|endswith:
        - '\bitsadmin.exe'
        - '\certutil.exe'
        - '\cmd.exe'
        - '\mshta.exe'
        - '\powershell.exe'
        - '\pwsh.exe'
        - '\regsvr32.exe'
    CommandLine|contains: '#'
condition: selection

False positives (as the rule lists them)

• Legitimate use of PowerShell or other utilities launched from browser extensions or automation tools

Tags

• attack.execution
• attack.t1204.004

MITRE ATT&CK ids this rule names

• T1204.004

References

• https://mrd0x.com/filefix-clickfix-alternative/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/deprecated/windows/proc_creation_win_filefix_browsers.yml