Sigma rule: Suspicious FileFix Execution Pattern

Rule

Title

Suspicious FileFix Execution Pattern

Status

experimental

Level

high

Author

0xFustang, Swachchhanda Shrawan Poudel (Nextron Systems)

Date

2025-11-24

File

rules/windows/process_creation/proc_creation_win_susp_filefix_execution_pattern.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects suspicious FileFix execution patterns where users are tricked into running malicious commands through browser file upload dialog manipulation.
This attack typically begins when users visit malicious websites impersonating legitimate services or news platforms,
which may display fake CAPTCHA challenges or direct instructions to open file explorer and paste clipboard content.
The clipboard content usually contains commands that download and execute malware, such as information stealing tools.

Log source

product

windows

category

process_creation

Detection

selection_exec_parent:
    # This is case where phishing pages trick users to paste commands in browser file upload dialog
    ParentImage|endswith:
        - '\brave.exe'
        - '\chrome.exe'
        - '\firefox.exe'
        - '\msedge.exe'
    CommandLine|contains: '#'
selection_cli_lolbin:
    CommandLine|contains:
        - '%comspec%'
        - 'bitsadmin'
        - 'certutil'
        - 'cmd'
        - 'cscript'
        - 'curl'
        - 'finger'
        - 'mshta'
        - 'powershell'
        - 'pwsh'
        - 'regsvr32'
        - 'rundll32'
        - 'schtasks'
        - 'wget'
        - 'wscript'
selection_cli_captcha:
    CommandLine|contains:
        - 'account'
        - 'anti-bot'
        - 'botcheck'
        - 'captcha'
        - 'challenge'
        - 'confirmation'
        - 'fraud'
        - 'human'
        - 'identification'
        - 'identificator'
        - 'identity'
        - 'robot'
        - 'validation'
        - 'verification'
        - 'verify'
condition: selection_exec_parent and 1 of selection_cli_*

False positives (as the rule lists them)

• Legitimate use of PowerShell or other utilities launched from browser extensions or automation tools

Tags

• attack.execution
• attack.t1204.004

MITRE ATT&CK ids this rule names

• T1204.004

Related rules

• 4fee3d51-8069-4a4c-a0f7-924fcaff2c70 (similar)
• 4be03877-d5b6-4520-85c9-a5911c0a656c (obsolete)

References

• https://mrd0x.com/filefix-clickfix-alternative/
• https://expel.com/blog/cache-smuggling-when-a-picture-isnt-a-thousand-words/
• https://blog.checkpoint.com/research/filefix-the-new-social-engineering-attack-building-on-clickfix-tested-in-the-wild/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_susp_filefix_execution_pattern.yml