Command Executed Via Run Dialog Box - Registry
Detects the execution of commands via the Windows Run dialog box by monitoring modifications to the `RunMRU` registry key. This technique is often abused by threat actors to trick users into pasting and executing malicious commands, sometimes disguised as CAPTCHA verification steps. The rule filters out common legitimate entries to reduce false positives.
Sigma
