Potential FileFix Command via Windows Explorer Address Bar

  1[metadata]
  2creation_date = "2026/09/28"
  3integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
  4maturity = "production"
  5updated_date = "2026/10/05"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies suspicious commands written to the Windows Explorer address bar history (TypedPaths). Adversaries socially
 11engineer users to paste a command into the address bar of File Explorer or of a browser's file upload dialog, a
 12pattern known as FileFix; the writing process is therefore explorer.exe or the browser hosting the dialog. Stored
 13commands that invoke PowerShell, cmd, mshta, msiexec, rundll32, or another living-off-the-land binary are unusual for
 14this key, which normally contains file and folder paths. Investigate the process tree for a child of the writing
 15process that matches the stored command.
 16"""
 17from = "now-9m"
 18language = "esql"
 19license = "Elastic License v2"
 20name = "Potential FileFix Command via Windows Explorer Address Bar"
 21note = """## Triage and analysis
 22
 23### Investigating Potential FileFix Command via Windows Explorer Address Bar
 24
 25#### Possible investigation steps
 26
 27- What command was stored in the Explorer address bar history?
 28  - Why: TypedPaths records the string submitted through the File Explorer address bar. FileFix pages instruct the victim to paste that string, often padding it so the visible end looks like a document path while the command sits at the front.
 29  - Focus: `registry.data.strings` and `registry.path`.
 30  - Implication: escalate when the string invokes PowerShell, pwsh, cmd, mshta, msiexec, rundll32, curl, wget, certutil, certreq, bitsadmin, wscript, cscript, conhost, or forfiles. A quiet local install such as msiexec with `/q`, `/qb`, or `/qn` against a user-profile or Downloads package is the same pattern. Lower suspicion only when the string is a real folder path from a recognized workflow and contains no command switches, URL, or shell operator.
 31
 32- Did the writing process launch a child that matches the stored command?
 33  - Why: the alerting process is whichever process hosted the address bar: explorer.exe for File Explorer, or chrome.exe, msedge.exe, or firefox.exe for a file upload dialog. The pasted command runs as a child of that process.
 34  - Focus: child process starts where `process.parent.entity_id` equals the alert `process.entity_id`. Compare child `process.name`, `process.executable`, and `process.command_line` with `registry.data.strings`.
 35  - Implication: escalate when a child shell, script host, installer, or living-off-the-land binary matches the TypedPaths string. A browser as the writer is the expected FileFix shape, not an anomaly. No matching child leaves execution unproven.
 36
 37- What did that child do next?
 38  - Focus: descendants of the recovered child `process.entity_id`, plus file and network events scoped to that child. Review `process.command_line`, `file.path`, `dns.question.name`, and `destination.ip`.
 39  - Hint: if the child entity id is absent, fall back to `host.id` plus the child `process.pid` in a tight window. Missing file or network telemetry leaves those questions unresolved.
 40  - Implication: escalate when the child retrieves a payload, writes a script or executable under a user-writable path, installs a package, spawns further shells, or contacts an unusual destination.
 41
 42- Does the user and host context fit a planned paste-and-run action?
 43  - Focus: `user.id`, `user.name`, `host.id`, and `host.name`, plus browser, chat, or mail activity just before the TypedPaths write. The decoy path at the end of `registry.data.strings` is the file the page told the user to open.
 44  - Implication: escalate when an end-user host has no change window for the command. A lab or awareness exercise is lower suspicion only when the command, user, and host all match that exercise.
 45
 46- Escalate when the TypedPaths command shows a living-off-the-land binary, a quiet installer, download, decode, or hidden execution, and the process tree, artifacts, destinations, or related alerts support execution. Close only when the stored command, launched child, user, and host bind to one authorized simulation or lab workflow with no contradiction. If evidence is mixed or visibility is incomplete, preserve evidence and escalate.
 47
 48### False positive analysis
 49
 50- Security-awareness, phishing-simulation, red-team, and malware-analysis labs can paste these commands into the File Explorer address bar. Confirm one workflow: the `registry.data.strings` value, the expected child `process.executable` and `process.command_line`, and a bounded `user.id` / `host.id`, with recovered children and destinations inside the exercise.
 51- Administrators sometimes launch a signed installer or diagnostic through the address bar. Close only when the stored command and child process are that exact tool, with no download cradle, encoded command, hidden window, or second-stage child.
 52- A typed folder path can contain a tool name followed by a space, such as a directory named "powershell scripts". Close only when the full string is that directory, the user opened it, and no child process matches a command in the string.
 53- Before an exception, require the same `registry.data.strings` fragment, `user.id`, and `host.id` across prior alerts from this rule. Avoid exceptions on the writing process.name, the TypedPaths path, or `user.name` alone.
 54
 55### Response and remediation
 56
 57- If confirmed benign, reverse temporary containment and record the command, child identity, `user.id`, and `host.id` that proved the workflow. Create an exception only when that exact workflow recurs.
 58- If suspicious but unconfirmed, export the registry event, `registry.data.strings`, the explorer `process.entity_id`, and the child process tree, command lines, file paths, and destinations before cleanup. Apply reversible controls first, such as temporary destination blocks, a browser-session reset, or heightened monitoring. Isolate the host when retrieval, package installation, or second-stage execution makes continued connectivity risky.
 59- If confirmed malicious, isolate the host, then terminate the child process and suspicious descendants after recording identifiers. Remove staged scripts, installers, archives, and payloads, and block confirmed domains, IPs, hashes, or URLs. Reset credentials only when the investigation shows account misuse.
 60- Post-incident hardening: retain registry and process telemetry for Explorer address bar triage, review browser and paste-execution controls, and record the lure wording and paste-run chain in the case notes.
 61"""
 62references = [
 63  "https://mrd0x.com/filefix-clickfix-alternative/",
 64  "https://www.elastic.co/security-labs/threat-command/telepuz-maas-malware-clickfix",
 65  "https://www.elastic.co/security-labs/threat-command/mimicrat-custom-rat-mimics-c2-frameworks",
 66]
 67risk_score = 73
 68rule_id = "56099694-8a36-444c-a918-2141b613d293"
 69setup = """## Setup
 70
 71This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
 72
 73Setup instructions: https://ela.st/install-elastic-defend
 74
 75### Additional data sources
 76
 77This rule also supports the following third-party data sources. For setup instructions, refer to the links below:
 78
 79- [CrowdStrike](https://ela.st/crowdstrike-integration)
 80- [Microsoft Defender XDR](https://ela.st/m365-defender)
 81- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
 82- [Sysmon Registry Events](https://ela.st/sysmon-event-reg-setup)
 83"""
 84severity = "high"
 85tags = [
 86    "Domain: Endpoint",
 87    "OS: Windows",
 88    "Use Case: Threat Detection",
 89    "Tactic: Execution",
 90    "Tactic: Defense Evasion",
 91    "Tactic: Initial Access",
 92    "Tactic: Command and Control",
 93    "Data Source: Elastic Defend",
 94    "Data Source: Sysmon",
 95    "Data Source: Microsoft Defender XDR",
 96    "Data Source: SentinelOne",
 97    "Data Source: Crowdstrike",
 98    "Resources: Investigation Guide",
 99    "Threat: ClickFix",
100    "Threat: Living off the Land",
101    "Rule Type: ES|QL",
102    "Platform: Windows",
103]
104timestamp_override = "event.ingested"
105type = "esql"
106
107query = '''
108from logs-endpoint.events.registry-*, logs-windows.sysmon_operational-*, winlogbeat-*,
109  logs-windows.forwarded-*, logs-m365_defender.event-*, logs-sentinel_one_cloud_funnel.*,
110  logs-crowdstrike.fdr* metadata _id, _version, _index
111| where KQL(""" host.os.type : "windows" AND event.category:"registry" AND event.type : ("creation" or "change") """)
112  and registry.data.strings is not null
113  and (
114    to_lower(registry.path) like """hkey_users\\*\\software\\microsoft\\windows\\currentversion\\explorer\\typedpaths\\*"""
115    or to_lower(registry.path) like """\\registry\\user\\*\\software\\microsoft\\windows\\currentversion\\explorer\\typedpaths\\*"""
116    or to_lower(registry.path) like """hku\\*\\software\\microsoft\\windows\\currentversion\\explorer\\typedpaths\\*"""
117    or to_lower(registry.path) like """hkcu\\software\\microsoft\\windows\\currentversion\\explorer\\typedpaths\\*"""
118    or to_lower(registry.path) like """hkey_current_user\\software\\microsoft\\windows\\currentversion\\explorer\\typedpaths\\*"""
119  )
120| eval registry_data = to_lower(mv_concat(registry.data.strings, " "))
121| where
122  // Command form only. A bare path to the binary, such as ...\\powershell.exe, does not match.
123  // PowerShell / PowerShell 7
124  registry_data like "*powershell *" or
125  registry_data like "*powershell.exe *" or
126  registry_data like "*powershell.exe\" *" or
127  registry_data like "*pwsh *" or
128  registry_data like "*pwsh.exe *" or
129  registry_data like "*pwsh.exe\" *" or
130  // Mshta
131  registry_data like "*mshta *" or
132  registry_data like "*mshta.exe *" or
133  registry_data like "*mshta.exe\" *" or
134  // Msiexec, including a quiet local package such as msiexec /i "\\users\\...\\file.msi" /qb
135  registry_data like "*msiexec *" or
136  registry_data like "*msiexec.exe *" or
137  registry_data like "*msiexec.exe\" *" or
138  // Rundll32
139  registry_data like "*rundll32 *" or
140  registry_data like "*rundll32.exe *" or
141  registry_data like "*rundll32.exe\" *" or
142  // Cmd. Require /c, /k, cmd.exe, or comspec so a folder name containing "cmd" does not match.
143  registry_data like "*cmd.exe *" or
144  registry_data like "*cmd.exe\" *" or
145  registry_data like "*cmd /c *" or
146  registry_data like "*cmd /k *" or
147  registry_data like "*cmd.exe /c *" or
148  registry_data like "*cmd* /d /c for /r*" or 
149  registry_data like "*cmd* in (f_*" or 
150  registry_data like "*%comspec%*" or
151  // Other living-off-the-land binaries used in FileFix and ClickFix paste chains
152  registry_data like "*curl *" or
153  registry_data like "*curl.exe *" or
154  registry_data like "*curl.exe\" *" or
155  registry_data like "*wget *" or
156  registry_data like "*wget.exe *" or
157  registry_data like "*wget.exe\" *" or
158  registry_data like "*certutil *" or
159  registry_data like "*certutil.exe *" or
160  registry_data like "*certutil.exe\" *" or
161  registry_data like "*certreq *" or
162  registry_data like "*certreq.exe *" or
163  registry_data like "*certreq.exe\" *" or
164  registry_data like "*bitsadmin *" or
165  registry_data like "*bitsadmin.exe *" or
166  registry_data like "*bitsadmin.exe\" *" or
167  registry_data like "*wscript *" or
168  registry_data like "*wscript.exe *" or
169  registry_data like "*wscript.exe\" *" or
170  registry_data like "*cscript *" or
171  registry_data like "*cscript.exe *" or
172  registry_data like "*cscript.exe\" *" or
173  registry_data like "*conhost *" or
174  registry_data like "*conhost.exe *" or
175  registry_data like "*conhost.exe\" *" or
176  registry_data like "*forfiles *" or
177  registry_data like "*forfiles.exe *" or
178  registry_data like "*forfiles.exe\" *"
179| keep _id, _version, _index, data_stream.namespace, @timestamp, event.dataset, user.id, user.name, user.domain, host.id, host.name, agent.id, process.name, process.entity_id, process.executable, process.pid, registry.data.strings, registry.path, registry.value
180'''
181
182
183[[rule.threat]]
184framework = "MITRE ATT&CK"
185[[rule.threat.technique]]
186id = "T1059"
187name = "Command and Scripting Interpreter"
188reference = "https://attack.mitre.org/techniques/T1059/"
189[[rule.threat.technique.subtechnique]]
190id = "T1059.001"
191name = "PowerShell"
192reference = "https://attack.mitre.org/techniques/T1059/001/"
193
194[[rule.threat.technique.subtechnique]]
195id = "T1059.003"
196name = "Windows Command Shell"
197reference = "https://attack.mitre.org/techniques/T1059/003/"
198
199
200[[rule.threat.technique]]
201id = "T1204"
202name = "User Execution"
203reference = "https://attack.mitre.org/techniques/T1204/"
204[[rule.threat.technique.subtechnique]]
205id = "T1204.002"
206name = "Malicious File"
207reference = "https://attack.mitre.org/techniques/T1204/002/"
208
209[[rule.threat.technique.subtechnique]]
210id = "T1204.004"
211name = "Malicious Copy and Paste"
212reference = "https://attack.mitre.org/techniques/T1204/004/"
213
214
215
216[rule.threat.tactic]
217id = "TA0002"
218name = "Execution"
219reference = "https://attack.mitre.org/tactics/TA0002/"
220[[rule.threat]]
221framework = "MITRE ATT&CK"
222[[rule.threat.technique]]
223id = "T1218"
224name = "System Binary Proxy Execution"
225reference = "https://attack.mitre.org/techniques/T1218/"
226[[rule.threat.technique.subtechnique]]
227id = "T1218.005"
228name = "Mshta"
229reference = "https://attack.mitre.org/techniques/T1218/005/"
230
231[[rule.threat.technique.subtechnique]]
232id = "T1218.007"
233name = "Msiexec"
234reference = "https://attack.mitre.org/techniques/T1218/007/"
235
236[[rule.threat.technique.subtechnique]]
237id = "T1218.011"
238name = "Rundll32"
239reference = "https://attack.mitre.org/techniques/T1218/011/"
240
241
242
243[rule.threat.tactic]
244id = "TA0005"
245name = "Defense Evasion"
246reference = "https://attack.mitre.org/tactics/TA0005/"
247[[rule.threat]]
248framework = "MITRE ATT&CK"
249[[rule.threat.technique]]
250id = "T1566"
251name = "Phishing"
252reference = "https://attack.mitre.org/techniques/T1566/"
253[[rule.threat.technique.subtechnique]]
254id = "T1566.001"
255name = "Spearphishing Attachment"
256reference = "https://attack.mitre.org/techniques/T1566/001/"
257
258[[rule.threat.technique.subtechnique]]
259id = "T1566.002"
260name = "Spearphishing Link"
261reference = "https://attack.mitre.org/techniques/T1566/002/"
262
263
264[rule.threat.tactic]
265id = "TA0001"
266name = "Initial Access"
267reference = "https://attack.mitre.org/tactics/TA0001/"
268[[rule.threat]]
269framework = "MITRE ATT&CK"
270[[rule.threat.technique]]
271id = "T1105"
272name = "Ingress Tool Transfer"
273reference = "https://attack.mitre.org/techniques/T1105/"
274
275
276[rule.threat.tactic]
277id = "TA0011"
278name = "Command and Control"
279reference = "https://attack.mitre.org/tactics/TA0011/"
280
281[rule.investigation_fields]
282field_names = [
283    "@timestamp",
284    "host.name",
285    "host.id",
286    "user.name",
287    "user.id",
288    "process.entity_id",
289    "process.pid",
290    "process.name",
291    "process.executable",
292    "registry.path",
293    "registry.value",
294    "registry.data.strings",
295]