RunMRU Registry Key Deletion
Detects attempts to delete the RunMRU registry key, which stores the history of commands executed via the run dialog. Adversaries may delete this key to cover their tracks after executing commands, especially in scenarios like clickfix techniques where users are lured into executing malicious commands via the run dialog.
Sigma
