Potentially Suspicious Command Execution via Run Dialog Box (RunMRU Registry)
Detects the execution of commands via the Windows Run dialog box by monitoring modifications to the "RunMRU" registry key. This technique has been observed in campaigns where threat actors trick users into pasting and executing malicious commands, often under the guise of CAPTCHA verification steps, to deliver malware like Lumma Stealer.
Sigma
