Windows Process Creation: File Upload Clickfix Lure via Browser to Command Execution
Alerts when browser-launched processes include clickfix-style command markers plus tool and captcha-related terms on Windows.
- Product
- windows
- Category
- process_creation
- Author
- 0xFustang, Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2025-11-24
- Updated
- 2026-07-30
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process creation where the parent process is a common web browser (Brave/Chrome/Firefox/Edge) and the spawned command line contains the '#' character, suggesting a browser file-upload dialog clickfix-style paste trick. It further requires the child command line to include one of several common command-line utilities or scripting tools and to include at least one human-verification/captcha/challenge-related term. This pattern matters because attackers can use social engineering to induce users to trigger execution of malicious download-and-run commands, and the detection relies on process parent/child command-line telemetry from Windows.
Reporting behind it
- mrd0x.comhttps://mrd0x.com/filefix-clickfix-alternative/
- expel.comhttps://expel.com/blog/cache-smuggling-when-a-picture-isnt-a-thousand-words/
- blog.checkpoint.comhttps://blog.checkpoint.com/research/filefix-the-new-social-engineering-attack-building-on-clickfix-tested-in-the-wild/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_filefix_execution_pattern.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: File Upload Clickfix Lure via Browser to Command Execution"
id: f6dfe5a3-48a3-46da-8c32-b485bcbf1365
related:
- id: 4fee3d51-8069-4a4c-a0f7-924fcaff2c70
type: similar
- id: 4be03877-d5b6-4520-85c9-a5911c0a656c
type: obsolete
- id: b5b29e4e-31fa-4fdf-b058-296e7a1aa0c2
type: derived
status: experimental
description: This rule flags Windows process creation where the parent process is a common web browser (Brave/Chrome/Firefox/Edge) and the spawned command line contains the '#' character, suggesting a browser file-upload dialog clickfix-style paste trick. It further requires the child command line to include one of several common command-line utilities or scripting tools and to include at least one human-verification/captcha/challenge-related term. This pattern matters because attackers can use social engineering to induce users to trigger execution of malicious download-and-run commands, and the detection relies on process parent/child command-line telemetry from Windows.
references:
- https://mrd0x.com/filefix-clickfix-alternative/
- https://expel.com/blog/cache-smuggling-when-a-picture-isnt-a-thousand-words/
- https://blog.checkpoint.com/research/filefix-the-new-social-engineering-attack-building-on-clickfix-tested-in-the-wild/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_filefix_execution_pattern.yml
author: 0xFustang, Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-11-24
tags:
- attack.execution
- attack.t1204.004
logsource:
category: process_creation
product: windows
detection:
selection_exec_parent:
ParentImage|endswith:
- \brave.exe
- \chrome.exe
- \firefox.exe
- \msedge.exe
CommandLine|contains: "#"
selection_cli_lolbin:
CommandLine|contains:
- "%comspec%"
- bitsadmin
- certutil
- cmd
- cscript
- curl
- finger
- mshta
- powershell
- pwsh
- regsvr32
- rundll32
- schtasks
- wget
- wscript
selection_cli_captcha:
CommandLine|contains:
- account
- anti-bot
- botcheck
- captcha
- challenge
- confirmation
- fraud
- human
- identification
- identificator
- identity
- robot
- validation
- verification
- verify
condition: selection_exec_parent and 1 of selection_cli_*
falsepositives:
- Legitimate use of PowerShell or other utilities launched from browser extensions or automation tools
level: high
license: DRL-1.1