huntrule

Windows ClickFix/FileFix Clipboard Phishing Leading to Suspicious mshta/powershell Command Execution

Alerts on explorer.exe child process launches with clipboard markers and anti-bot/CAPTCHA-related wording indicating ClickFix/FileFix execution.

FreeUnreviewedSigmahighv1
title: Windows ClickFix/FileFix Clipboard Phishing Leading to Suspicious mshta/powershell Command Execution
id: 1f7643b0-140d-4892-9966-689ab50224f1
related:
  - id: f5fe36cf-f1ec-4c23-903d-09a3110f6bbb
    type: similar
  - id: d487ed4a-fd24-436d-a0b2-f4e95f7b2635
    type: derived
status: experimental
description: This rule flags suspicious Windows process executions initiated from explorer.exe where the command line contains a clipboard-manipulation marker (#) and includes terms commonly associated with CAPTCHA or anti-bot prompts (for example, captcha, challenge, verification, robot). Attackers use social engineering to trick users into pasting clipboard contents into UI elements like the Run dialog or Explorer address bar, often resulting in execution of attacker-supplied commands. It relies on process creation telemetry capturing the parent process path, the full command line, and keyword matches within that command line.
references:
  - https://github.com/JohnHammond/recaptcha-phish
  - https://www.zscaler.com/blogs/security-research/deepseek-lure-using-captchas-spread-malware
  - https://www.threatdown.com/blog/clipboard-hijacker-tries-to-install-a-trojan/
  - https://app.any.run/tasks/5c16b4db-4b36-4039-a0ed-9b09abff8be2
  - https://www.esentire.com/security-advisories/netsupport-rat-clickfix-distribution
  - https://www.scpx.com.au/2025/11/16/decades-old-finger-protocol-abused-in-clickfix-malware-attacks/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_clickfix_filefix_execution.yml
author: montysecurity, Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-11-19
tags:
  - attack.execution
  - attack.t1204.001
  - attack.t1204.004
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \explorer.exe
    CommandLine|contains: "#"
  selection_cli_captcha:
    CommandLine|contains:
      - account
      - anti-bot
      - botcheck
      - captcha
      - challenge
      - confirmation
      - fraud
      - human
      - identification
      - identificator
      - identity
      - robot
      - validation
      - verification
      - verify
  condition: all of selection_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1

What it detects

This rule flags suspicious Windows process executions initiated from explorer.exe where the command line contains a clipboard-manipulation marker (#) and includes terms commonly associated with CAPTCHA or anti-bot prompts (for example, captcha, challenge, verification, robot). Attackers use social engineering to trick users into pasting clipboard contents into UI elements like the Run dialog or Explorer address bar, often resulting in execution of attacker-supplied commands. It relies on process creation telemetry capturing the parent process path, the full command line, and keyword matches within that command line.

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.