Windows Process Creation: File Upload Clickfix Lure via Browser to Command Execution

title: "Windows Process Creation: File Upload Clickfix Lure via Browser to Command Execution"
id: f6dfe5a3-48a3-46da-8c32-b485bcbf1365
related:
  - id: 4fee3d51-8069-4a4c-a0f7-924fcaff2c70
    type: similar
  - id: 4be03877-d5b6-4520-85c9-a5911c0a656c
    type: obsolete
  - id: b5b29e4e-31fa-4fdf-b058-296e7a1aa0c2
    type: derived
status: experimental
description: This rule flags Windows process creation where the parent process is a common web browser (Brave/Chrome/Firefox/Edge) and the spawned command line contains the '#' character, suggesting a browser file-upload dialog clickfix-style paste trick. It further requires the child command line to include one of several common command-line utilities or scripting tools and to include at least one human-verification/captcha/challenge-related term. This pattern matters because attackers can use social engineering to induce users to trigger execution of malicious download-and-run commands, and the detection relies on process parent/child command-line telemetry from Windows.
references:
  - https://mrd0x.com/filefix-clickfix-alternative/
  - https://expel.com/blog/cache-smuggling-when-a-picture-isnt-a-thousand-words/
  - https://blog.checkpoint.com/research/filefix-the-new-social-engineering-attack-building-on-clickfix-tested-in-the-wild/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_filefix_execution_pattern.yml
author: 0xFustang, Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-11-24
tags:
  - attack.execution
  - attack.t1204.004
logsource:
  category: process_creation
  product: windows
detection:
  selection_exec_parent:
    ParentImage|endswith:
      - \brave.exe
      - \chrome.exe
      - \firefox.exe
      - \msedge.exe
    CommandLine|contains: "#"
  selection_cli_lolbin:
    CommandLine|contains:
      - "%comspec%"
      - bitsadmin
      - certutil
      - cmd
      - cscript
      - curl
      - finger
      - mshta
      - powershell
      - pwsh
      - regsvr32
      - rundll32
      - schtasks
      - wget
      - wscript
  selection_cli_captcha:
    CommandLine|contains:
      - account
      - anti-bot
      - botcheck
      - captcha
      - challenge
      - confirmation
      - fraud
      - human
      - identification
      - identificator
      - identity
      - robot
      - validation
      - verification
      - verify
  condition: selection_exec_parent and 1 of selection_cli_*
falsepositives:
  - Legitimate use of PowerShell or other utilities launched from browser extensions or automation tools
level: high
license: DRL-1.1