ClickFix Attack - RunMRU Command Injection + Active User Discovery
This rule detects post-social-engineering activity where adversaries trick users into pasting malicious commands into the Windows Run dialog (Win+R). The command is recorded in the RunMRU registry key and typically abuses nslookup.exe to perform DNS lookups against rogue servers that return encoded payloads in the "Name" field of the DNS response. The rule identifies the exact command injected via ClickFix lures, enriches the result with the active user session at the time of execution, and provides a risk score based on the severity of the indicators found. It specifically looks for suspicious RunMRU events with commands longer than 50 characters, excluding common legitimate paths. Detection indicators include obfuscated nslookup using carets, nslookup with hardcoded external DNS server IPs, payload execution via `cmd` and `echo` or `for /f`, registry tampering related to UAC/security policies, and execution of Living Off The Land Binaries (LOLBins) such as `powershell`, `mshta`, `wscript`, `cscript`, `certutil`, `rundll32`, `regsvr32`, `msiexec`, `wmic`, or `bitsadmin`.
Microsoft Sentinel (KQL)
