FileFix and browser-spawned payloads: what threat hunters need now

TL;DR: FileFix shifts attacker execution from a browser-driven prompt into the trusted File Explorer address bar, bypassing Mark of the Web protections and making social engineering harder to spot, according to Intel 471. The pattern shows why behavior-based hunting has to complement IoC searches when browsers spawn scripting tools.

Editorial analysis by NHI Mgmt Group, based on content published by Intel 471: “Threat Hunting Case Study: FileFix”.

Key questions

Q: What breaks when users run commands through trusted Windows interfaces instead of downloaded files?

A: File-origin controls lose much of their value because there may be no file to inspect, tag or warn on.

Q: Why do browser-spawned scripting processes matter in threat hunting?

A: A browser spawning a shell or scripting engine is a strong behavioural anomaly because it rarely fits normal workstation use.

Q: How should security teams reduce the risk of clipboard-based phishing leading to code execution?

A: Security teams should disable or restrict risky script paths, monitor for suspicious parent-child process chains, and train users that copy-and-paste into Explorer can execute commands.

Practitioner guidance

• Hunt for browser-to-shell process chains Flag browsers spawning cmd.exe, powershell.exe, wscript.exe or python.exe, and review the parent process, child process and command line together before deciding whether the event is benign.
• Monitor File Explorer execution paths Add detections for suspicious command execution via explorer.exe and review typed paths, clipboard-driven execution and address-bar command entry as part of triage.
• Correlate IoCs with behavioural telemetry Use known-bad hashes or infrastructure only as a starting point, then validate whether the same behaviour appears in process lineage, command-line data and historical logs.

Bottom line: FileFix is effective because it exploits trust in native Windows behaviour rather than relying on a classic malicious download.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →