Suspicious FileFix Execution Pattern (via process_creation)

This rule detects anomalous FileFix execution patterns where users are tricked into running hostile commands through browser file upload dialog manipulation. This attack usually begins when users visit hostile websites impersonating legitimate services or news platforms, which may display fake CAPTCHA challenges or direct instructions to open file explorer and paste clipboard content. The clipboard content usually contains commands that download and execute malware, such as information stealing tools.