RunMRU Registry Key Deletion via reg.exe

SigmaHQ Detections@sigmaHQ

•updated Oct 22, 2025•0•50

Detects the deletion of the RunMRU registry key, which stores the history of commands executed via the Run dialog. Adversaries may delete this key to cover their tracks after executing commands, particularly in techniques like those used in clickfix where phishing lures instruct users to execute malicious commands via the Run dialog.