Suspicious Space Characters in TypedPaths Registry Path - FileFix

SigmaHQ Detections@sigmaHQ

•updated Nov 5, 2025•1•0•53

Detects the occurrence of numerous space characters in TypedPaths registry paths, which may indicate execution via phishing lures using file-fix techniques to hide malicious commands. This technique is often used to bypass security controls that might inspect the command line for malicious strings.