CrashFix Command in RunMRU History
This query detects evidence of the CrashFix malicious command being stored in the Windows Run dialog (Win+R) history. The RunMRU registry key stores commands executed via the Run dialog. This is a strong indicator that a user was prompted to and did execute the malicious command.
Microsoft Sentinel (KQL)
