Windows Registry Set: FileFix-style Command Evidence in TypedPaths url1
Flags Windows registry TypedPaths url1 updates containing URL fragments and command/script keywords consistent with FileFix behavior.
- Product
- windows
- Category
- registry_set
- Author
- Alfie Champion (delivr.to), Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2025-07-05
- Updated
- 2026-07-30
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule looks for registry updates to the Explorer TypedPaths value url1, where the data contains both a URL indicator ('#' and 'http') and a set of execution-related command or scripting keywords. The presence of these command strings alongside URL fragments can indicate an attempt to embed or evidence user targeting consistent with the FileFix technique. It relies on registry_set telemetry that records the TargetObject path and the modified Details content for TypedPaths values.
Reporting behind it
- x.comhttps://x.com/russianpanda9xx/status/1940831134759506029
- mrd0x.comhttps://mrd0x.com/filefix-clickfix-alternative/
- scpx.com.auhttps://www.scpx.com.au/2025/11/16/decades-old-finger-protocol-abused-in-clickfix-malware-attacks/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_filefix_typedpath_commands.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Registry Set: FileFix-style Command Evidence in TypedPaths url1"
id: 71296a9e-1793-4f4e-ba69-890e0d3f91aa
related:
- id: 4be03877-d5b6-4520-85c9-a5911c0a656c
type: similar
- id: 4fee3d51-8069-4a4c-a0f7-924fcaff2c70
type: derived
status: experimental
description: This rule looks for registry updates to the Explorer TypedPaths value url1, where the data contains both a URL indicator ('#' and 'http') and a set of execution-related command or scripting keywords. The presence of these command strings alongside URL fragments can indicate an attempt to embed or evidence user targeting consistent with the FileFix technique. It relies on registry_set telemetry that records the TargetObject path and the modified Details content for TypedPaths values.
references:
- https://x.com/russianpanda9xx/status/1940831134759506029
- https://mrd0x.com/filefix-clickfix-alternative/
- https://www.scpx.com.au/2025/11/16/decades-old-finger-protocol-abused-in-clickfix-malware-attacks/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_filefix_typedpath_commands.yml
author: Alfie Champion (delivr.to), Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-07-05
modified: 2025-11-19
tags:
- attack.execution
- attack.t1204.004
logsource:
category: registry_set
product: windows
detection:
selection_base:
TargetObject|endswith: \Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths\url1
Details|contains|all:
- "#"
- http
selection_cmd:
- Details|contains:
- account
- anti-bot
- botcheck
- captcha
- challenge
- confirmation
- fraud
- human
- identification
- identificator
- identity
- robot
- validation
- verification
- verify
- Details|contains:
- "%comspec%"
- bitsadmin
- certutil
- cmd
- cscript
- curl
- finger
- mshta
- powershell
- pwsh
- regsvr32
- rundll32
- schtasks
- wget
- wscript
condition: all of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1