Query: write Sigma for Detects suspicious FileFix execution patterns where users are tricked into running malicious commands through browser fi
Matching passage: Sigma rule: Detects suspicious FileFix execution patterns where users are tricked into running malicious commands through browser fi. Logsource: windows / process_creation. Rule: title: Suspicious FileFix Execution Pattern id: b5b29e4e-31fa-4fdf-b058-296e7a1aa0c2 related: - id: 4fee3d51-8069-4a4c-a0f7-924fcaff2c70 type: similar - id: 4be03877-d5b6-4520-85c9-a5911c0a656c type: obsolete status: experimental description: 'Detects suspicious FileFix execution patterns where users are tricked into running malicious commands through browser file upload dialog manipulation. This attack typically begins when users visit malicious websites impersonating legitimate services or news platforms, which may display fake CAPTCHA challenges or direct instructions to open file explorer and paste clipboard content. The clipboard content usually contains commands that download and execute malware, such as information stealing tools. ' references: - https://mrd0x.com/filefix-clickfix-alternative/ - https://expel.com/blog/cache-smuggling-when-a-picture-isnt-a-thousand-words/ - https://blog.checkpoint.com/research/filefix-the-new-social-engineering-attack-building-on-clickfix-tested-in-the-wild/ author: 0xFustang, Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-11-24 tags: - attack.execution - attack.t1204.004 logsource: category: process_creation product: windows detection: selection_exec_parent: ParentImage|endswith: - \brave.exe - \chrome.exe - \firefox.exe - \msedge.exe CommandLine|contains: '#' selection_cli_lolbin: CommandLine|contains: - '%comspec%' - bitsadmin - certutil - cmd - cscript - curl - finger - mshta - powershell - pwsh - regsvr32 - rundll32 - schtasks - wget - wscript selection_cli_captcha: CommandLine|contains: - account - anti-bot - botcheck - captcha - challenge - confirmation - fraud - human - identification - identificator - identity - robot - validation - verification - verify condition: selection_exec_parent and 1 of selection_cli_* falsepositives: - Legitimate use of PowerShell or other utilities launched from browser extensions or automation tools level: high
Near-miss passage: Sigma rule: Detects the execution of Xwizard tool with the "RunWizard" flag and a GUID like argument. This utility can be abused in. Logsource: windows / process_creation. Rule: title: COM Object Execution via Xwizard.EXE id: 53d4bb30-3f36-4e8a-b078-69d36c4a79ff status: test description: 'Detects the execution of Xwizard tool with the "RunWizard" flag and a GUID like argument. This utility can be abused in order to run custom COM object created in the registry. ' references: - https://lolbas-project.github.io/lolbas/Binaries/Xwizard/ - https://www.elastic.co/guide/en/security/current/execution-of-com-object-via-xwizard.html - https://www.hexacorn.com/blog/2017/07/31/the-wizard-of-x-oppa-plugx-style/ author: Ensar Şamil, @sblmsrsn, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems) date: 2020-10-07 modified: 2024-08-15 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: CommandLine: RunWizard CommandLine|re: \{[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}\} condition: selection falsepositives: - Unknown level: medium