Potential Execution via FileFix Phishing Attack

  1[metadata]
  2creation_date = "2025/08/20"
  3integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender"]
  4maturity = "production"
  5updated_date = "2026/09/28"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies the execution of Windows commands or downloaded files via the browser's dialog box. Adversaries may use
 11phishing to instruct the victim to copy and paste malicious commands for execution via crafted phishing web pages.
 12"""
 13from = "now-9m"
 14index = [
 15    "logs-endpoint.events.process-*",
 16    "logs-m365_defender.event-*",
 17    "logs-sentinel_one_cloud_funnel.*",
 18    "logs-windows.sysmon_operational-*",
 19    "winlogbeat-*"
 20]
 21language = "eql"
 22license = "Elastic License v2"
 23name = "Potential Execution via FileFix Phishing Attack"
 24references = ["https://mrd0x.com/filefix-clickfix-alternative/"]
 25risk_score = 73
 26rule_id = "7dc45430-7407-4790-b89e-c857c3f6bf23"
 27severity = "high"
 28tags = [
 29    "Domain: Endpoint",
 30    "OS: Windows",
 31    "Use Case: Threat Detection",
 32    "Tactic: Execution",
 33    "Data Source: Windows Security Event Logs",
 34    "Data Source: Elastic Defend",
 35    "Data Source: Sysmon",
 36    "Data Source: SentinelOne",
 37    "Data Source: Microsoft Defender XDR",
 38    "Resources: Investigation Guide",
 39    "Noise: Medium",
 40    "Performance: Normal",
 41    "Profile: Recommended",
 42    "Threat: ClickFix",
 43    "Threat: Living off the Land",
 44    "Rule Type: Event Correlation (EQL)",
 45    "Platform: Windows",
 46]
 47timestamp_override = "event.ingested"
 48type = "eql"
 49
 50query = '''
 51process where host.os.type == "windows" and event.type == "start" and
 52 process.parent.args == "--message-loop-type-ui" and process.parent.args == "--service-sandbox-type=none" and
 53 (
 54  process.name : ("pwsh.exe", "powershell.exe", "curl.exe", "msiexec.exe", "mshta.exe", "wscript.exe", "cscript.exe", "rundll32.exe", "certutil.exe", "certreq.exe") or
 55  process.executable : "?:\\Users\\*\\Downloads\\*"
 56  ) and
 57not (
 58    process.name : "rundll32.exe" and
 59    process.args : (
 60      "ndfapi.dll,NdfRunDllDiagnoseWithAnswerFile",
 61      "shwebsvc.dll,AddNetPlaceRunDll",
 62      "?:\\WINDOWS\\Installer\\MSI*.tmp,zzzzInvokeManagedCustomActionOutOfProc",
 63      "*cryptext.dll,CryptExtOpenCER",
 64      "*cryptext.dll,CryptExtOpenCRL",
 65      "*cryptext.dll,CryptExtOpenPKCS7",
 66      "*cryptext.dll,CryptExtAddPFX",
 67      "?:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll,*",
 68      "?:\\WINDOWS\\*\\hotplug.dll,HotPlugSafeRemovalDriveNotification"
 69    )
 70  ) and
 71  not (process.name : "certutil.exe" and process.args : "-hashfile")
 72'''
 73
 74note = """## Triage and analysis
 75
 76### Investigating Potential Execution via FileFix Phishing Attack
 77
 78#### Possible investigation steps
 79
 80- Does the alert show the FileFix browser-to-Explorer execution path?
 81  - Focus: alert-local `process.parent.executable`, `process.parent.args`, `process.name`, `process.executable`, and `process.command_line`.
 82  - Implication: escalate when a Chromium-style file-picker parent using "--message-loop-type-ui" and "--service-sandbox-type=none" launches PowerShell, curl, certutil, certreq, msiexec, mshta, rundll32, wscript, cscript, or a "?:\\Users\\*\\Downloads\\*" executable; lower suspicion only when the child is a signed installer or diagnostic tool and the parent/command shape matches a recognized browser-initiated support or install flow.
 83- Is the launched child the expected binary for that workflow?
 84  - Focus: `process.executable`, `process.pe.original_file_name`, `process.code_signature.subject_name`, and `process.code_signature.trusted`; recover absent values from same-process events. $investigate_0
 85  - Implication: escalate when the path is user-writable or signer/original name mismatches the expected tool; lower identity risk when signer, original name, path, and known hash history fit, but continue command-intent checks.
 86- Does the command line reveal pasted-command social engineering?
 87  - Focus: `process.command_line` and `process.name`.
 88  - Implication: escalate when the command hides execution before a fake path or comment, invokes PowerShell or a LOLBin to retrieve/run content, or starts a "%USERPROFILE%\\Downloads" payload directly; lower suspicion only when arguments open the signed installer or diagnostic tool with no hidden command, URL, or shell operator.
 89- Does a Downloads-path child look newly staged or renamed?
 90  - Focus: `process.executable`, `process.Ext.relative_file_creation_time`, `process.Ext.relative_file_name_modify_time`, `process.code_signature.thumbprint_sha256`, and same-process file writes/renames; recover absent process values from same-process events. $investigate_2
 91  - Hint: for the downloaded-EXE variant, process file-age is the recovery signal; absent file provenance does not make a Downloads path benign.
 92  - Implication: escalate when a Downloads or other user-profile executable runs shortly after creation or rename, especially with weak identity; lower suspicion when file age, stable signer, and path match the same recognized update or support workflow.
 93- Did the launched child spawn follow-on tools?
 94  - Focus: child process starts from `process.entity_id`, then descendant `process.executable` and `process.command_line`. $investigate_1
 95  - Hint: if entity IDs are unavailable, fall back to parent PID plus a tight alert-time window on the same host.
 96  - Implication: escalate when the chain fans out into shells, script hosts, installers, archive tools, or task/scheduler utilities; no descendants keeps scope local but does not clear suspicious command intent or identity mismatch.
 97- Did the launched child contact retrieval or staging destinations?
 98  - Focus: same-process network events for `destination.ip`, `destination.port`, and destination ownership when available. $investigate_3
 99  - Implication: escalate when PowerShell, curl, certutil, certreq, mshta, or another child reaches external staging, paste, storage, or command-and-control infrastructure; missing network telemetry is unresolved, not benign.
100- If local evidence remains suspicious or unresolved, does the pattern recur for this user or host?
101  - Focus: related alerts and process starts for the same `user.id` and `host.id`, comparing `process.parent.args` and child `process.command_line`.
102  - Hint: review related user alerts with $investigate_4
103  - Hint: review related host alerts with $investigate_5
104  - Implication: broaden scope when the same browser-parented shell, LOLBin, or Downloads-path launch repeats for this user, host, or other users; keep the case local when it is isolated and the process evidence resolves cleanly.
105- Escalate when ancestry, child identity, command intent, file age, descendants, network, or recurrence supports user-assisted command execution or downloaded payload launch; close only when process evidence shows a signed installer or diagnostic identity, non-hidden command shape, expected file age/path, no suspicious descendants, no suspicious network where telemetry exists, and no related spread; preserve evidence and escalate when facts conflict or remain incomplete.
106
107### False positive analysis
108
109- Signed browser-initiated installer/diagnostic workflows or authorized security tests can trigger. Confirm exact alignment across parent flags, child path, signer, hash, command line, user, host, timing, and absence of suspicious descendants; do not close on a ticket or owner statement if process evidence conflicts.
110- The query excludes browser file-picker launches of certutil `-hashfile`, rundll32 `cryptext.dll` certificate dialogs, Windows Photo Viewer, MSI `zzzzInvokeManagedCustomActionOutOfProc` custom actions, and `hotplug.dll` safe-removal notifications.
111- Before creating an exception, require recurrence with stable `process.parent.executable`, `process.parent.args`, `process.executable`, `process.code_signature.thumbprint_sha256`, command-line shape, `user.id`, and `host.id`. Avoid exceptions on browser parentage, `process.name`, or Downloads-path execution alone.
112
113### Response and remediation
114
115- If suspicious but unconfirmed, first preserve the alert event, same-process event export, descendant process timeline, command-line text, parent context, child binary copy, hash and signature details, and the affected user/host identifiers.
116- Apply reversible containment only after preservation, such as restricting the affected browser session or account, blocking the exact child hash, or quarantining the downloaded child binary. Escalate to host isolation only when command intent, identity, or descendants indicate likely payload execution.
117- If confirmed malicious, isolate the host when the launched child or descendants executed payloads, then terminate the child and descendants after recording identifiers. Do not reset credentials from this alert alone; use identity response only when separate evidence proves credential exposure or account misuse.
118- Eradicate only the downloaded executables, scripts, task utilities, or secondary payloads identified in the process timeline, then remediate the phishing page access or browser session that enabled the user-assisted execution.
119- If confirmed benign, reverse temporary containment and document the exact parent flags, child identity, command shape, user, host, and outside confirmation that proved the workflow. Create an exception only after the stable bounded pattern recurs.
120- Post-incident hardening: restrict direct execution from user download locations where feasible, warn on browser-file-picker social engineering, retain process telemetry needed for the pivots above, and document the FileFix variant observed in the case record."""
121
122setup = """## Setup
123
124This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
125
126Setup instructions: https://ela.st/install-elastic-defend
127
128### Additional data sources
129
130This rule also supports the following third-party data sources. For setup instructions, refer to the links below:
131
132- [Microsoft Defender XDR](https://ela.st/m365-defender)
133- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
134- [Sysmon Event ID 1 - Process Creation](https://ela.st/sysmon-event-1-setup)
135"""
136
137[rule.investigation_fields]
138field_names = [
139    "@timestamp",
140    "host.id",
141    "user.id",
142    "process.entity_id",
143    "process.pid",
144    "process.executable",
145    "process.command_line",
146    "process.pe.original_file_name",
147    "process.code_signature.subject_name",
148    "process.code_signature.trusted",
149    "process.code_signature.thumbprint_sha256",
150    "process.Ext.relative_file_creation_time",
151    "process.Ext.relative_file_name_modify_time",
152    "process.parent.executable",
153    "process.parent.command_line",
154]
155
156[transform]
157
158[[transform.investigate]]
159label = "Events for the launched process on this host"
160description = ""
161providers = [
162  [
163    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" },
164    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" }
165  ]
166]
167relativeFrom = "now-1h"
168relativeTo = "now"
169
170[[transform.investigate]]
171label = "Child process starts from the launched process"
172description = ""
173providers = [
174  [
175    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" },
176    { excluded = false, field = "event.type", queryType = "phrase", value = "start", valueType = "string" },
177    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
178    { excluded = false, field = "process.parent.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" }
179  ],
180  [
181    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" },
182    { excluded = false, field = "event.type", queryType = "phrase", value = "start", valueType = "string" },
183    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
184    { excluded = false, field = "process.parent.pid", queryType = "phrase", value = "{{process.pid}}", valueType = "string" }
185  ]
186]
187relativeFrom = "now-1h"
188relativeTo = "now"
189
190[[transform.investigate]]
191label = "File events for the launched process"
192description = ""
193providers = [
194  [
195    { excluded = false, field = "event.category", queryType = "phrase", value = "file", valueType = "string" },
196    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
197    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" }
198  ],
199  [
200    { excluded = false, field = "event.category", queryType = "phrase", value = "file", valueType = "string" },
201    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
202    { excluded = false, field = "process.pid", queryType = "phrase", value = "{{process.pid}}", valueType = "string" }
203  ]
204]
205relativeFrom = "now-1h"
206relativeTo = "now"
207
208[[transform.investigate]]
209label = "Network events for the launched process"
210description = ""
211providers = [
212  [
213    { excluded = false, field = "event.category", queryType = "phrase", value = "network", valueType = "string" },
214    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
215    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" }
216  ],
217  [
218    { excluded = false, field = "event.category", queryType = "phrase", value = "network", valueType = "string" },
219    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
220    { excluded = false, field = "process.pid", queryType = "phrase", value = "{{process.pid}}", valueType = "string" }
221  ]
222]
223relativeFrom = "now-1h"
224relativeTo = "now"
225
226[[transform.investigate]]
227label = "Alerts associated with the user"
228description = ""
229providers = [
230  [
231    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
232    { excluded = false, field = "user.id", queryType = "phrase", value = "{{user.id}}", valueType = "string" }
233  ]
234]
235relativeFrom = "now-48h/h"
236relativeTo = "now"
237
238[[transform.investigate]]
239label = "Alerts associated with the host"
240description = ""
241providers = [
242  [
243    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
244    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" }
245  ]
246]
247relativeFrom = "now-48h/h"
248relativeTo = "now"
249
250[[rule.threat]]
251framework = "MITRE ATT&CK"
252
253[[rule.threat.technique]]
254id = "T1059"
255name = "Command and Scripting Interpreter"
256reference = "https://attack.mitre.org/techniques/T1059/"
257
258[[rule.threat.technique.subtechnique]]
259id = "T1059.001"
260name = "PowerShell"
261reference = "https://attack.mitre.org/techniques/T1059/001/"
262
263[[rule.threat.technique.subtechnique]]
264id = "T1059.003"
265name = "Windows Command Shell"
266reference = "https://attack.mitre.org/techniques/T1059/003/"
267
268[[rule.threat.technique]]
269id = "T1204"
270name = "User Execution"
271reference = "https://attack.mitre.org/techniques/T1204/"
272
273[[rule.threat.technique.subtechnique]]
274id = "T1204.002"
275name = "Malicious File"
276reference = "https://attack.mitre.org/techniques/T1204/002/"
277
278[[rule.threat.technique.subtechnique]]
279id = "T1204.004"
280name = "Malicious Copy and Paste"
281reference = "https://attack.mitre.org/techniques/T1204/004/"
282
283[rule.threat.tactic]
284id = "TA0002"
285name = "Execution"
286reference = "https://attack.mitre.org/tactics/TA0002/"
287
288[[rule.threat]]
289framework = "MITRE ATT&CK"
290
291[[rule.threat.technique]]
292id = "T1218"
293name = "System Binary Proxy Execution"
294reference = "https://attack.mitre.org/techniques/T1218/"
295
296[[rule.threat.technique.subtechnique]]
297id = "T1218.005"
298name = "Mshta"
299reference = "https://attack.mitre.org/techniques/T1218/005/"
300
301[rule.threat.tactic]
302id = "TA0005"
303name = "Defense Evasion"
304reference = "https://attack.mitre.org/tactics/TA0005/"
305
306[[rule.threat]]
307framework = "MITRE ATT&CK"
308
309[[rule.threat.technique]]
310id = "T1566"
311name = "Phishing"
312reference = "https://attack.mitre.org/techniques/T1566/"
313
314[[rule.threat.technique.subtechnique]]
315id = "T1566.001"
316name = "Spearphishing Attachment"
317reference = "https://attack.mitre.org/techniques/T1566/001/"
318
319[[rule.threat.technique.subtechnique]]
320id = "T1566.002"
321name = "Spearphishing Link"
322reference = "https://attack.mitre.org/techniques/T1566/002/"
323
324[rule.threat.tactic]
325id = "TA0001"
326name = "Initial Access"
327reference = "https://attack.mitre.org/tactics/TA0001/"