Browser Spawning Command Interpreter via FileFix Attack

J S@jsh0x

•updated Jun 26, 2025•4•28

Detects suspicious process creation where a web browser spawns a command interpreter or scripting host. This behavior is indicative of the "FileFix" attack, where users are socially engineered to paste malicious commands into the File Explorer address bar opened by a browser's file upload functionality.