Skip to content

Commit 251be1e

Browse files
swachchhanda000frack113phantinuss
authored
Merge PR #5743 from @swachchhanda000 - new: clickfix/filefix space character padding
new: Suspicious Explorer Process with Whitespace Padding - ClickFix/FileFix new: Suspicious Space Characters in RunMRU Registry Path - ClickFix new: Suspicious Space Characters in TypedPaths Registry Path - FileFix --------- Co-authored-by: frack113 <62423083+frack113@users.noreply.github.com> Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com>
1 parent 3a20687 commit 251be1e

File tree

3 files changed

+136
-0
lines changed

3 files changed

+136
-0
lines changed

‎rules/windows/process_creation/proc_creation_win_susp_clickfix_filefix_whitespace_padding.yml‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
title: Suspicious Explorer Process with Whitespace Padding - ClickFix/FileFix
2+
id: 3ae9974a-eb09-4044-8e70-8980a50c12c8
3+
related:
4+
- id: 8f2a5c3d-9e4b-4a7c-8d1f-2e5a6b9c3d7e
5+
type: similar
6+
- id: 7a1b4c5e-8f3d-4b9a-7c2e-1f4a5b8c6d9e
7+
type: similar
8+
status: experimental
9+
description: |
10+
Detects process creation with suspicious whitespace padding followed by a '#' character, which may indicate ClickFix or FileFix techniques used to conceal malicious commands from visual inspection.
11+
ClickFix and FileFix are social engineering attack techniques where adversaries distribute phishing documents or malicious links that deceive users into opening the Windows Run dialog box or File Explorer search bar.
12+
The victims are then instructed to paste commands from their clipboard, which contain extensive whitespace padding using various Unicode space characters to push the actual malicious command far to the right, effectively hiding it from immediate view.
13+
references:
14+
- https://expel.com/blog/cache-smuggling-when-a-picture-isnt-a-thousand-words/
15+
- https://mrd0x.com/filefix-clickfix-alternative/
16+
author: Swachchhanda Shrawan Poudel (Nextron Systems)
17+
date: 2025-11-04
18+
tags:
19+
- attack.execution
20+
- attack.t1204.004
21+
- attack.defense-evasion
22+
- attack.t1027.010
23+
logsource:
24+
category: process_creation
25+
product: windows
26+
detection:
27+
selection_explorer:
28+
Image|endswith: '\explorer.exe'
29+
CommandLine|contains: '#'
30+
selection_space_variation:
31+
CommandLine|contains:
32+
- '            ' # En Quad (U+2000)
33+
- '            ' # Em Quad (U+2001)
34+
- '            ' # En Space (U+2002)
35+
- '            ' # Em Space (U+2003)
36+
- '            ' # Three-Per-Em Space (U+2004)
37+
- '            ' # Four-Per-Em Space (U+2005)
38+
- '            ' # Six-Per-Em Space (U+2006)
39+
- '            ' # Figure Space (U+2007)
40+
- '            ' # Punctuation Space (U+2008)
41+
- '            ' # Thin Space (U+2009)
42+
- '            ' # Hair Space (U+200A)
43+
- '            ' # No-Break Space (U+00A0)
44+
- ' ' # Normal space (0x20)
45+
condition: all of selection_*
46+
falsepositives:
47+
- Unknown
48+
level: high

‎rules/windows/registry/registry_set/registry_set_susp_runmru_space_character.yml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
title: Suspicious Space Characters in RunMRU Registry Path - ClickFix
2+
id: 7a1b4c5e-8f3d-4b9a-7c2e-1f4a5b8c6d9e
3+
related:
4+
- id: 3ae9974a-eb09-4044-8e70-8980a50c12c8
5+
type: similar
6+
status: experimental
7+
description: |
8+
Detects the occurrence of numerous space characters in RunMRU registry paths, which may indicate execution via phishing lures using clickfix techniques to hide malicious commands in the Windows Run dialog box from naked eyes.
9+
references:
10+
- https://expel.com/blog/cache-smuggling-when-a-picture-isnt-a-thousand-words/
11+
- https://github.com/JohnHammond/recaptcha-phish
12+
author: Swachchhanda Shrawan Poudel (Nextron Systems)
13+
date: 2025-11-04
14+
tags:
15+
- attack.execution
16+
- attack.t1204.004
17+
- attack.defense-evasion
18+
- attack.t1027.010
19+
logsource:
20+
category: registry_set
21+
product: windows
22+
detection:
23+
selection_key:
24+
TargetObject|contains: '\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU\'
25+
Details|contains: '#'
26+
selection_space_variation:
27+
Details|contains:
28+
- '            ' # En Quad (U+2000)
29+
- '            ' # Em Quad (U+2001)
30+
- '            ' # En Space (U+2002)
31+
- '            ' # Em Space (U+2003)
32+
- '            ' # Three-Per-Em Space (U+2004)
33+
- '            ' # Four-Per-Em Space (U+2005)
34+
- '            ' # Six-Per-Em Space (U+2006)
35+
- '            ' # Figure Space (U+2007)
36+
- '            ' # Punctuation Space (U+2008)
37+
- '            ' # Thin Space (U+2009)
38+
- '            ' # Hair Space (U+200A)
39+
- '            ' # No-Break Space (U+00A0)
40+
- ' ' # Normal space
41+
condition: all of selection_*
42+
falsepositives:
43+
- Unlikely
44+
level: high

‎rules/windows/registry/registry_set/registry_set_susp_typedpaths_space_characters.yml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
title: Suspicious Space Characters in TypedPaths Registry Path - FileFix
2+
id: 8f2a5c3d-9e4b-4a7c-8d1f-2e5a6b9c3d7e
3+
related:
4+
- id: 3ae9974a-eb09-4044-8e70-8980a50c12c8
5+
type: similar
6+
status: experimental
7+
description: |
8+
Detects the occurrence of numerous space characters in TypedPaths registry paths, which may indicate execution via phishing lures using file-fix techniques to hide malicious commands.
9+
references:
10+
- https://expel.com/blog/cache-smuggling-when-a-picture-isnt-a-thousand-words/
11+
- https://mrd0x.com/filefix-clickfix-alternative/
12+
author: Swachchhanda Shrawan Poudel (Nextron Systems)
13+
date: 2025-11-04
14+
tags:
15+
- attack.execution
16+
- attack.t1204.004
17+
- attack.defense-evasion
18+
- attack.t1027.010
19+
logsource:
20+
category: registry_set
21+
product: windows
22+
detection:
23+
selection_key:
24+
TargetObject|endswith: '\Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths\url1'
25+
Details|contains: '#'
26+
selection_space_variation:
27+
Details|contains:
28+
- '            ' # En Quad (U+2000)
29+
- '            ' # Em Quad (U+2001)
30+
- '            ' # En Space (U+2002)
31+
- '            ' # Em Space (U+2003)
32+
- '            ' # Three-Per-Em Space (U+2004)
33+
- '            ' # Four-Per-Em Space (U+2005)
34+
- '            ' # Six-Per-Em Space (U+2006)
35+
- '            ' # Figure Space (U+2007)
36+
- '            ' # Punctuation Space (U+2008)
37+
- '            ' # Thin Space (U+2009)
38+
- '            ' # Hair Space (U+200A)
39+
- '            ' # No-Break Space (U+00A0)
40+
- ' ' # Normal space
41+
condition: all of selection_*
42+
falsepositives:
43+
- Unlikely
44+
level: high

0 commit comments

Comments
 (0)