huntrule

Windows Registry Set: FileFix-style Command Evidence in TypedPaths url1

Flags Windows registry TypedPaths url1 updates containing URL fragments and command/script keywords consistent with FileFix behavior.

FreeReviewedSigma · High · v1
Product
windows
Category
registry_set
Author
Alfie Champion (delivr.to), Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2025-07-05
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Execution

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule looks for registry updates to the Explorer TypedPaths value url1, where the data contains both a URL indicator ('#' and 'http') and a set of execution-related command or scripting keywords. The presence of these command strings alongside URL fragments can indicate an attempt to embed or evidence user targeting consistent with the FileFix technique. It relies on registry_set telemetry that records the TargetObject path and the modified Details content for TypedPaths values.

Reporting behind it

Related detections9 linkedT1204.004 — drag to rearrange
Windows Process Creation: File Upload Clickfix Lure via Browser to Command Execution
Windows Registry RunMRU Path with Suspicious Space Characters and Delimiter
Suspicious Base64 Decoded Shell Dropper via Command Line
Suspicious ClickFix RunMRU Entry Recording LOLBIN Command from Run Dialog
Suspicious RunMRU Entry Launching LOLBIN via ClickFix Run Dialog
Suspicious macOS ClickFix Execution Piping curl to zsh via UNC1069
Suspicious msdt Execution of Audio Diagnostic via UNC1069 ClickFix
Suspicious ClickFix Clipboard PowerShell Execution from Run Dialog
Suspicious Web Browser Spawning Scripting or Command Interpreter (via process_creation)
Windows Registry Set: FileFix-style Command Evidence in TypedPaths url1
Pivot detection · T1204.004 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.