Detect RunMRU Command History obfuscated DNS
Detects registry value set events in HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU where the parent process is userinit.exe, indicating Run dialog command history updates during interactive logon sessions. The rule flags nslookup including obfuscated character separated variants, and other common network discovery tooling often used in social engineering driven copy paste execution workflows. This can indicate ClickFix style activity or early stage network discovery typed via Win plus R.
Microsoft Sentinel (KQL)
