FileFix Suspicious LOLBin Child Process from Browser (File Upload Abuse)
Detects LOLBins (cmd.exe, powershell.exe, rundll32.exe, mshta.exe, etc.) spawned directly by a web browser, indicative of FileFix or ClickFix-style social engineering execution. In these attacks, a malicious webpage silently copies a disguised command to the user's clipboard; the user is then instructed to paste it into the Windows File Explorer address bar or Run dialog, resulting in LOLBin execution under the browser's process context. Observed delivering loaders, RATs, and ransomware precursors in the wild since July 2025. Exclusions applied for Chrome Native Messaging IPC, ClickOnce application launchers, and OAuth2/OIDC SSO token redirect fragments.
Microsoft Sentinel (KQL)
