Windows ClickFix/FileFix Clipboard Phishing Leading to Suspicious mshta/powershell Command Execution

Alerts on explorer.exe child process launches with clipboard markers and anti-bot/CAPTCHA-related wording indicating ClickFix/FileFix execution.

FreeReviewedSigma · High · v1

Product: windows
Category: process_creation
Author: montysecurity, Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2025-11-19
Updated: 2026-07-30

Analysis Detection

ATT&CK techniques

Execution

Recon
Resource Dev
Initial Access
Execution
- T1204User Execution
- T1204.001Malicious Link
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags suspicious Windows process executions initiated from explorer.exe where the command line contains a clipboard-manipulation marker (#) and includes terms commonly associated with CAPTCHA or anti-bot prompts (for example, captcha, challenge, verification, robot). Attackers use social engineering to trick users into pasting clipboard contents into UI elements like the Run dialog or Explorer address bar, often resulting in execution of attacker-supplied commands. It relies on process creation telemetry capturing the parent process path, the full command line, and keyword matches within that command line.

Reporting behind it

Related detections9 linkedT1204.001 — drag to rearrange

macOS Script Editor Spawns Suspicious Command-Line Interpreters

Suspicious Script Interpreter Spawned by Explorer via ClickFix Run Dialog (via process_creation)

Malicious Edge Abuse for Payload Download via Console (via process_creation)

Suspicious Masqueraded Windows Update Python Script Execution

ClickFix Pastejacking via Script Interpreter Command in Run Dialog MRU (via registry_set)

Obfuscated Edge/Chrome Headless Feature Abuse for Payload Download (via process_creation)

Suspicious cscript Execution of JavaScript Spawned by PowerShell

Suspicious Ukraine-Themed LNK Lure Files Dropped (via file_event)

Suspicious Renamed MySQL Binary Executed from Temp via ClickFix (via process_creation)

Windows ClickFix/FileFix Clipboard Phishing Leading to Suspicious mshta/powershell Command Execution

Pivot detection · T1204.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-clickfix-filefix-clipboard-phishing-leading-to-suspicious-mshta-powershe-d487ed4a

title: Windows ClickFix/FileFix Clipboard Phishing Leading to Suspicious mshta/powershell Command Execution
id: 1f7643b0-140d-4892-9966-689ab50224f1
related:
  - id: f5fe36cf-f1ec-4c23-903d-09a3110f6bbb
    type: similar
  - id: d487ed4a-fd24-436d-a0b2-f4e95f7b2635
    type: derived
status: experimental
description: This rule flags suspicious Windows process executions initiated from explorer.exe where the command line contains a clipboard-manipulation marker (#) and includes terms commonly associated with CAPTCHA or anti-bot prompts (for example, captcha, challenge, verification, robot). Attackers use social engineering to trick users into pasting clipboard contents into UI elements like the Run dialog or Explorer address bar, often resulting in execution of attacker-supplied commands. It relies on process creation telemetry capturing the parent process path, the full command line, and keyword matches within that command line.
references:
  - https://github.com/JohnHammond/recaptcha-phish
  - https://www.zscaler.com/blogs/security-research/deepseek-lure-using-captchas-spread-malware
  - https://www.threatdown.com/blog/clipboard-hijacker-tries-to-install-a-trojan/
  - https://app.any.run/tasks/5c16b4db-4b36-4039-a0ed-9b09abff8be2
  - https://www.esentire.com/security-advisories/netsupport-rat-clickfix-distribution
  - https://www.scpx.com.au/2025/11/16/decades-old-finger-protocol-abused-in-clickfix-malware-attacks/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_clickfix_filefix_execution.yml
author: montysecurity, Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-11-19
tags:
  - attack.execution
  - attack.t1204.001
  - attack.t1204.004
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \explorer.exe
    CommandLine|contains: "#"
  selection_cli_captcha:
    CommandLine|contains:
      - account
      - anti-bot
      - botcheck
      - captcha
      - challenge
      - confirmation
      - fraud
      - human
      - identification
      - identificator
      - identity
      - robot
      - validation
      - verification
      - verify
  condition: all of selection_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL