Detection rules › Sigma

Suspicious ClickFix/FileFix Execution Pattern

Status
experimental
Severity
high
Log source
product windows, category process_creation
Author
montysecurity, Swachchhanda Shrawan Poudel (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects suspicious execution patterns where users are tricked into running malicious commands via clipboard manipulation, either through the Windows Run dialog (ClickFix) or File Explorer address bar (FileFix). Attackers leverage social engineering campaigns—such as fake CAPTCHA challenges or urgent alerts—encouraging victims to paste clipboard contents, often executing mshta.exe, powershell.exe, or similar commands to infect systems.

MITRE ATT&CK coverage

Event coverage

Rule body yaml

title: Suspicious ClickFix/FileFix Execution Pattern
id: d487ed4a-fd24-436d-a0b2-f4e95f7b2635
related:
    - id: f5fe36cf-f1ec-4c23-903d-09a3110f6bbb
      type: similar
status: experimental
description: |
    Detects suspicious execution patterns where users are tricked into running malicious commands via clipboard manipulation, either through the Windows Run dialog (ClickFix) or File Explorer address bar (FileFix).
    Attackers leverage social engineering campaigns—such as fake CAPTCHA challenges or urgent alerts—encouraging victims to paste clipboard contents, often executing mshta.exe, powershell.exe, or similar commands to infect systems.
references:
    - https://github.com/JohnHammond/recaptcha-phish
    - https://www.zscaler.com/blogs/security-research/deepseek-lure-using-captchas-spread-malware
    - https://www.threatdown.com/blog/clipboard-hijacker-tries-to-install-a-trojan/
    - https://app.any.run/tasks/5c16b4db-4b36-4039-a0ed-9b09abff8be2
    - https://www.esentire.com/security-advisories/netsupport-rat-clickfix-distribution
    - https://www.scpx.com.au/2025/11/16/decades-old-finger-protocol-abused-in-clickfix-malware-attacks/ # filefix variant
author: montysecurity, Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-11-19
tags:
    - attack.execution
    - attack.t1204.001
    - attack.t1204.004
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\explorer.exe'
        CommandLine|contains: '#'
    selection_cli_captcha:
        CommandLine|contains:
            - 'account'
            - 'anti-bot'
            - 'botcheck'
            - 'captcha'
            - 'challenge'
            - 'confirmation'
            - 'fraud'
            - 'human'
            - 'identification'
            - 'identificator'
            - 'identity'
            - 'robot'
            - 'validation'
            - 'verification'
            - 'verify'
    condition: all of selection_*
falsepositives:
    - Unlikely
level: high

Stages and Predicates

Stage 0: condition

all of selection_*

Stage 1: selection_parent

selection_parent:
    ParentImage|endswith: '\explorer.exe'
    CommandLine|contains: '#'

Stage 2: selection_cli_captcha

selection_cli_captcha:
    CommandLine|contains:
        - 'account'
        - 'anti-bot'
        - 'botcheck'
        - 'captcha'
        - 'challenge'
        - 'confirmation'
        - 'fraud'
        - 'human'
        - 'identification'
        - 'identificator'
        - 'identity'
        - 'robot'
        - 'validation'
        - 'verification'
        - 'verify'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • # corpus 3 (sigma 3)
  • account corpus 2 (sigma 2)
  • anti-bot corpus 2 (sigma 2)
  • botcheck corpus 2 (sigma 2)
  • captcha corpus 2 (sigma 2)
  • challenge corpus 2 (sigma 2)
  • confirmation corpus 2 (sigma 2)
  • fraud corpus 2 (sigma 2)
  • human corpus 2 (sigma 2)
  • identification corpus 2 (sigma 2)
  • identificator corpus 2 (sigma 2)
  • identity corpus 2 (sigma 2)
  • robot corpus 2 (sigma 2)
  • validation corpus 2 (sigma 2)
  • verification corpus 2 (sigma 2)
  • verify corpus 2 (sigma 2)
ParentImageends_with
  • \explorer.exe corpus 13 (sigma 13)