Windows Registry Set: FileFix-style Command Evidence in TypedPaths url1

title: "Windows Registry Set: FileFix-style Command Evidence in TypedPaths url1"
id: 71296a9e-1793-4f4e-ba69-890e0d3f91aa
related:
  - id: 4be03877-d5b6-4520-85c9-a5911c0a656c
    type: similar
  - id: 4fee3d51-8069-4a4c-a0f7-924fcaff2c70
    type: derived
status: experimental
description: This rule looks for registry updates to the Explorer TypedPaths value url1, where the data contains both a URL indicator ('#' and 'http') and a set of execution-related command or scripting keywords. The presence of these command strings alongside URL fragments can indicate an attempt to embed or evidence user targeting consistent with the FileFix technique. It relies on registry_set telemetry that records the TargetObject path and the modified Details content for TypedPaths values.
references:
  - https://x.com/russianpanda9xx/status/1940831134759506029
  - https://mrd0x.com/filefix-clickfix-alternative/
  - https://www.scpx.com.au/2025/11/16/decades-old-finger-protocol-abused-in-clickfix-malware-attacks/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_filefix_typedpath_commands.yml
author: Alfie Champion (delivr.to), Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-07-05
modified: 2025-11-19
tags:
  - attack.execution
  - attack.t1204.004
logsource:
  category: registry_set
  product: windows
detection:
  selection_base:
    TargetObject|endswith: \Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths\url1
    Details|contains|all:
      - "#"
      - http
  selection_cmd:
    - Details|contains:
        - account
        - anti-bot
        - botcheck
        - captcha
        - challenge
        - confirmation
        - fraud
        - human
        - identification
        - identificator
        - identity
        - robot
        - validation
        - verification
        - verify
    - Details|contains:
        - "%comspec%"
        - bitsadmin
        - certutil
        - cmd
        - cscript
        - curl
        - finger
        - mshta
        - powershell
        - pwsh
        - regsvr32
        - rundll32
        - schtasks
        - wget
        - wscript
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1