FileFix - Suspicious Child Process from Browser File Upload Abuse

0xFustang

Detects potentially suspicious subprocesses such as LOLBINs spawned by web browsers. This activity could be associated with the "FileFix" social engineering technique, where users are tricked into launching the file explorer via a browser-based phishing page and pasting malicious commands into the address bar. The technique abuses clipboard manipulation and disguises command execution as benign file path access, resulting in covert execution of system utilities.

2025-06-26 00:00:00

2025-06-30 00:00:00

4be03877-d5b6-4520-85c9-a5911c0a656c

attack.execution attack.t1204.004

Community Rule

Alfie Champion

Merge PR #5503 from @ajpc500 - include cmd.exe child process

2025-07-01

Mathieu

Merge PR #5501 from @0xFustang - FileFix - Suspicious Sub-processes Spawned by Web Browsers

2025-06-27