Query: Sigma rule for Detects suspicious FileFix execution patterns where users are tricked into running malicious commands through browser fi
Matching passage: Sigma rule: Detects suspicious FileFix execution patterns where users are tricked into running malicious commands through browser fi. Logsource: windows / process_creation. Rule: title: Suspicious FileFix Execution Pattern id: b5b29e4e-31fa-4fdf-b058-296e7a1aa0c2 related: - id: 4fee3d51-8069-4a4c-a0f7-924fcaff2c70 type: similar - id: 4be03877-d5b6-4520-85c9-a5911c0a656c type: obsolete status: experimental description: 'Detects suspicious FileFix execution patterns where users are tricked into running malicious commands through browser file upload dialog manipulation. This attack typically begins when users visit malicious websites impersonating legitimate services or news platforms, which may display fake CAPTCHA challenges or direct instructions to open file explorer and paste clipboard content. The clipboard content usually contains commands that download and execute malware, such as information stealing tools. ' references: - https://mrd0x.com/filefix-clickfix-alternative/ - https://expel.com/blog/cache-smuggling-when-a-picture-isnt-a-thousand-words/ - https://blog.checkpoint.com/research/filefix-the-new-social-engineering-attack-building-on-clickfix-tested-in-the-wild/ author: 0xFustang, Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-11-24 tags: - attack.execution - attack.t1204.004 logsource: category: process_creation product: windows detection: selection_exec_parent: ParentImage|endswith: - \brave.exe - \chrome.exe - \firefox.exe - \msedge.exe CommandLine|contains: '#' selection_cli_lolbin: CommandLine|contains: - '%comspec%' - bitsadmin - certutil - cmd - cscript - curl - finger - mshta - powershell - pwsh - regsvr32 - rundll32 - schtasks - wget - wscript selection_cli_captcha: CommandLine|contains: - account - anti-bot - botcheck - captcha - challenge - confirmation - fraud - human - identification - identificator - identity - robot - validation - verification - verify condition: selection_exec_parent and 1 of selection_cli_* falsepositives: - Legitimate use of PowerShell or other utilities launched from browser extensions or automation tools level: high
Near-miss passage: Sigma rule: Detects a suspicious call to Invoke-WebRequest cmdlet where the and output is located in a suspicious location. Logsource: windows / process_creation. Rule: title: Suspicious Invoke-WebRequest Execution id: 5e3cc4d8-3e68-43db-8656-eaaeefdec9cc related: - id: e218595b-bbe7-4ee5-8a96-f32a24ad3468 type: derived status: test description: Detects a suspicious call to Invoke-WebRequest cmdlet where the and output is located in a suspicious location references: - https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-02 modified: 2025-07-18 tags: - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell_ise.exe - \powershell.exe - \pwsh.exe - OriginalFileName: - powershell_ise.EXE - PowerShell.EXE - pwsh.dll selection_commands: CommandLine|contains: - 'curl ' - Invoke-WebRequest - 'iwr ' - 'wget ' selection_flags: CommandLine|contains: - ' -ur' - ' -o' selection_susp_locations: CommandLine|contains: - \AppData\ - \Desktop\ - \Temp\ - \Users\Public\ - '%AppData%' - '%Public%' - '%Temp%' - '%tmp%' - :\Windows\ condition: all of selection_* falsepositives: - Unknown level: high