Suspicious ClickFix/FileFix Execution Pattern

Status: experimental
Severity: high
Log source: category process_creation, product windows
Author: montysecurity, Swachchhanda Shrawan Poudel (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects suspicious execution patterns where users are tricked into running malicious commands via clipboard manipulation, either through the Windows Run dialog (ClickFix) or File Explorer address bar (FileFix). Attackers leverage social engineering campaigns—such as fake CAPTCHA challenges or urgent alerts—encouraging victims to paste clipboard contents, often executing mshta.exe, powershell.exe, or similar commands to infect systems.

Known false positives

Unlikely

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1204.001` User Execution: Malicious Link `T1204.004` User Execution: Malicious Copy and Paste

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Security-Auditing	Event ID 4688: A new process has been created.

Rule body

title: Suspicious ClickFix/FileFix Execution Pattern
id: d487ed4a-fd24-436d-a0b2-f4e95f7b2635
related:
    - id: f5fe36cf-f1ec-4c23-903d-09a3110f6bbb
      type: similar
status: experimental
description: |
    Detects suspicious execution patterns where users are tricked into running malicious commands via clipboard manipulation, either through the Windows Run dialog (ClickFix) or File Explorer address bar (FileFix).
    Attackers leverage social engineering campaigns—such as fake CAPTCHA challenges or urgent alerts—encouraging victims to paste clipboard contents, often executing mshta.exe, powershell.exe, or similar commands to infect systems.
references:
    - https://github.com/JohnHammond/recaptcha-phish
    - https://www.zscaler.com/blogs/security-research/deepseek-lure-using-captchas-spread-malware
    - https://www.threatdown.com/blog/clipboard-hijacker-tries-to-install-a-trojan/
    - https://app.any.run/tasks/5c16b4db-4b36-4039-a0ed-9b09abff8be2
    - https://www.esentire.com/security-advisories/netsupport-rat-clickfix-distribution
    - https://www.scpx.com.au/2025/11/16/decades-old-finger-protocol-abused-in-clickfix-malware-attacks/ # filefix variant
author: montysecurity, Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-11-19
tags:
    - attack.execution
    - attack.t1204.001
    - attack.t1204.004
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\explorer.exe'
        CommandLine|contains: '#'
    selection_cli_captcha:
        CommandLine|contains:
            - 'account'
            - 'anti-bot'
            - 'botcheck'
            - 'captcha'
            - 'challenge'
            - 'confirmation'
            - 'fraud'
            - 'human'
            - 'identification'
            - 'identificator'
            - 'identity'
            - 'robot'
            - 'validation'
            - 'verification'
            - 'verify'
    condition: all of selection_*
falsepositives:
    - Unlikely
level: high

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_parent`

selection_parent:
    ParentImage|endswith: '\explorer.exe'
    CommandLine|contains: '#'

Stage 2: `selection_cli_captcha`

selection_cli_captcha:
    CommandLine|contains:
        - 'account'
        - 'anti-bot'
        - 'botcheck'
        - 'captcha'
        - 'challenge'
        - 'confirmation'
        - 'fraud'
        - 'human'
        - 'identification'
        - 'identificator'
        - 'identity'
        - 'robot'
        - 'validation'
        - 'verification'
        - 'verify'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`#` corpus 3 (sigma 3) `account` corpus 2 (sigma 2) `anti-bot` corpus 2 (sigma 2) `botcheck` corpus 2 (sigma 2) `captcha` corpus 2 (sigma 2) `challenge` corpus 2 (sigma 2) `confirmation` corpus 2 (sigma 2) `fraud` corpus 2 (sigma 2) `human` corpus 2 (sigma 2) `identification` corpus 2 (sigma 2) `identificator` corpus 2 (sigma 2) `identity` corpus 2 (sigma 2) `robot` corpus 2 (sigma 2) `validation` corpus 2 (sigma 2) `verification` corpus 2 (sigma 2) `verify` corpus 2 (sigma 2)	`field:"CommandLine" kind:match`
`ParentImage`	ends_with	`\explorer.exe` corpus 13 (sigma 13)	`field:"ParentImage" kind:ends_with value:"\explorer.exe"`