Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects suspicious FileFix execution patterns where users are tricked into running malicious commands through browser fi. Logsource: windows / process_creation. Rule: title: Suspicious FileFix Execution Pattern id: b5b29e4e-31fa-4fdf-b058-296e7a1aa0c2 related: - id: 4fee3d51-8069-4a4c-a0f7-924fcaff2c70 type: similar - id: 4be03877-d5b6-4520-85c9-a5911c0a656c type: obsolete status: experimental description: 'Detects suspicious FileFix execution patterns where users are tricked into running malicious commands through browser file upload dialog manipulation. This attack typically begins when users visit malicious websites impersonating legitimate services or news platforms, which may display fake CAPTCHA challenges or direct instructions to open file explorer and paste clipboard content. The clipboard content usually contains commands that download and execute malware, such as information stealing tools. ' references: - https://mrd0x.com/filefix-clickfix-alternative/ - https://expel.com/blog/cache-smuggling-when-a-picture-isnt-a-thousand-words/ - https://blog.checkpoint.com/research/filefix-the-new-social-engineering-attack-building-on-clickfix-tested-in-the-wild/ author: 0xFustang, Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-11-24 tags: - attack.execution - attack.t1204.004 logsource: category: process_creation product: windows detection: selection_exec_parent: ParentImage|endswith: - \brave.exe - \chrome.exe - \firefox.exe - \msedge.exe CommandLine|contains: '#' selection_cli_lolbin: CommandLine|contains: - '%comspec%' - bitsadmin - certutil - cmd - cscript - curl - finger - mshta - powershell - pwsh - regsvr32 - rundll32 - schtasks - wget - wscript selection_cli_captcha: CommandLine|contains: - account - anti-bot - botcheck - captcha - challenge - confirmation - fraud - human - identification - identificator - identity - robot - validation - verification - verify condition: selection_exec_parent and 1 of selection_cli_* falsepositives: - Legitimate use of PowerShell or other utilities launched from browser extensions or automation tools level: high
Near-miss passage: Sigma rule: Detects file creation events with filename patterns used by CrackMapExec.. Logsource: windows / file_event. Rule: title: HackTool - CrackMapExec File Indicators id: 736ffa74-5f6f-44ca-94ef-1c0df4f51d2a related: - id: 9433ff9c-5d3f-4269-99f8-95fc826ea489 type: obsolete status: test description: Detects file creation events with filename patterns used by CrackMapExec. references: - https://github.com/byt3bl33d3r/CrackMapExec/ author: Nasreddine Bencherchali (Nextron Systems) date: 2024-03-11 modified: 2024-06-27 tags: - attack.credential-access - attack.t1003.001 logsource: product: windows category: file_event detection: selection_path: TargetFilename|startswith: C:\Windows\Temp\ selection_names_str: TargetFilename|endswith: - \temp.ps1 - \msol.ps1 selection_names_re: - TargetFilename|re: \\[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.txt$ - TargetFilename|re: \\[a-zA-Z]{8}\.tmp$ condition: selection_path and 1 of selection_names_* falsepositives: - Unknown level: high