huntrule

Windows ClickFix/FileFix Clipboard Phishing Leading to Suspicious mshta/powershell Command Execution

Alerts on explorer.exe child process launches with clipboard markers and anti-bot/CAPTCHA-related wording indicating ClickFix/FileFix execution.

FreeReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
montysecurity, Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2025-11-19
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Execution

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags suspicious Windows process executions initiated from explorer.exe where the command line contains a clipboard-manipulation marker (#) and includes terms commonly associated with CAPTCHA or anti-bot prompts (for example, captcha, challenge, verification, robot). Attackers use social engineering to trick users into pasting clipboard contents into UI elements like the Run dialog or Explorer address bar, often resulting in execution of attacker-supplied commands. It relies on process creation telemetry capturing the parent process path, the full command line, and keyword matches within that command line.

Reporting behind it

Related detections9 linkedT1204.001 — drag to rearrange
macOS Script Editor Spawns Suspicious Command-Line Interpreters
Malicious MuddyRot Implant Execution From ProgramData SoftwareMemory Path
Suspicious Base64 Decoded Shell Dropper via Command Line
Malicious Rundll32 Execution of Image File Export via PLUSDROP
Suspicious Web Browser Spawning Scripting or Command Interpreter (via process_creation)
Malicious PowerShell Spawned by File Explorer via FileFix Social Engineering (via process_creation)
Suspicious search-ms Protocol Handler Abuse for Remote Payload via PureHVNC (via process_creation)
Malicious ClickFix Clipboard Command Execution via PowerShell
Suspicious Child Process Spawned by WinRAR via Process Creation
Windows ClickFix/FileFix Clipboard Phishing Leading to Suspicious mshta/powershell Command Execution
Pivot detection · T1204.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.