Query: rule covering Detects suspicious FileFix execution patterns where users are tricked into running malicious commands through browser fi
Matching passage: Sigma rule: Detects suspicious FileFix execution patterns where users are tricked into running malicious commands through browser fi. Logsource: windows / process_creation. Rule: title: Suspicious FileFix Execution Pattern id: b5b29e4e-31fa-4fdf-b058-296e7a1aa0c2 related: - id: 4fee3d51-8069-4a4c-a0f7-924fcaff2c70 type: similar - id: 4be03877-d5b6-4520-85c9-a5911c0a656c type: obsolete status: experimental description: 'Detects suspicious FileFix execution patterns where users are tricked into running malicious commands through browser file upload dialog manipulation. This attack typically begins when users visit malicious websites impersonating legitimate services or news platforms, which may display fake CAPTCHA challenges or direct instructions to open file explorer and paste clipboard content. The clipboard content usually contains commands that download and execute malware, such as information stealing tools. ' references: - https://mrd0x.com/filefix-clickfix-alternative/ - https://expel.com/blog/cache-smuggling-when-a-picture-isnt-a-thousand-words/ - https://blog.checkpoint.com/research/filefix-the-new-social-engineering-attack-building-on-clickfix-tested-in-the-wild/ author: 0xFustang, Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-11-24 tags: - attack.execution - attack.t1204.004 logsource: category: process_creation product: windows detection: selection_exec_parent: ParentImage|endswith: - \brave.exe - \chrome.exe - \firefox.exe - \msedge.exe CommandLine|contains: '#' selection_cli_lolbin: CommandLine|contains: - '%comspec%' - bitsadmin - certutil - cmd - cscript - curl - finger - mshta - powershell - pwsh - regsvr32 - rundll32 - schtasks - wget - wscript selection_cli_captcha: CommandLine|contains: - account - anti-bot - botcheck - captcha - challenge - confirmation - fraud - human - identification - identificator - identity - robot - validation - verification - verify condition: selection_exec_parent and 1 of selection_cli_* falsepositives: - Legitimate use of PowerShell or other utilities launched from browser extensions or automation tools level: high
Near-miss passage: Sigma rule: One of the Windows Eventlogs has been cleared. e.g. caused by "wevtutil cl" command execution. Logsource: windows / security. Rule: title: Security Eventlog Cleared id: d99b79d2-0a6f-4f46-ad8b-260b6e17f982 related: - id: f2f01843-e7b8-4f95-a35a-d23584476423 type: obsolete - id: a122ac13-daf8-4175-83a2-72c387be339d type: obsolete status: test description: One of the Windows Eventlogs has been cleared. e.g. caused by "wevtutil cl" command execution references: - https://twitter.com/deviouspolack/status/832535435960209408 - https://www.hybrid-analysis.com/sample/027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745?environmentId=100 - https://github.com/Azure/Azure-Sentinel/blob/f99542b94afe0ad2f19a82cc08262e7ac8e1428e/Detections/SecurityEvent/SecurityEventLogCleared.yaml author: Florian Roth (Nextron Systems) date: 2017-01-10 modified: 2022-02-24 tags: - attack.defense-impairment - attack.t1685.005 - car.2016-04-002 logsource: product: windows service: security detection: selection_517: EventID: 517 Provider_Name: Security selection_1102: EventID: 1102 Provider_Name: Microsoft-Windows-Eventlog condition: 1 of selection_* falsepositives: - Rollout of log collection agents (the setup routine often includes a reset of the local Eventlog) - System provisioning (system reset before the golden image creation) level: high