Suspicious Explorer Process with Whitespace Padding - ClickFix/FileFix

Title: Suspicious Explorer Process with Whitespace Padding - ClickFix/FileFix
Status: experimental
Description:Detects process creation with suspicious whitespace padding followed by a '#' character, which may indicate ClickFix or FileFix techniques used to conceal malicious commands from visual inspection. ClickFix and FileFix are social engineering attack techniques where adversaries distribute phishing documents or malicious links that deceive users into opening the Windows Run dialog box or File Explorer search bar. The victims are then instructed to paste commands from their clipboard, which contain extensive whitespace padding using various Unicode space characters to push the actual malicious command far to the right, effectively hiding it from immediate view.
References:
  -https://expel.com/blog/cache-smuggling-when-a-picture-isnt-a-thousand-words/
  -https://mrd0x.com/filefix-clickfix-alternative/
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-11-04
modified:None
Tags:

• -'attack.execution'
• -'attack.t1204.004'
• -'attack.defense-evasion'
• -'attack.t1027.010'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_explorer:
    Image|endswith: '\explorer.exe'
    CommandLine|contains: '#'
  selection_space_variation:
    CommandLine|contains:
      -'            '
      -'            '
      -'            '
      -'            '
      -'            '
      -'            '
      -'            '
      -'            '
      -'            '
      -'            '
      -'            '
      -'            '
      -' '

  condition:all of selection_*
Falsepositives:
  -Unknown
Level: high