Windows Runmru Suspicious Entry Then Process Activity
This rule detects suspicious activity involving the Windows RunMRU registry key followed by a process launch. Specifically, it looks for modifications to the `RunMRU` registry key that contain certain suspicious strings (e.g., `nslookup`, `dig`, `powershell`, `cmd.exe`, `curl`, `wget`, `certutil`, `bitsadmin`, or various command-line obfuscation/download patterns). Subsequently, it correlates this registry modification with a process launch on the same host and by the same user, where the process command line also contains one of these suspicious strings. This behavior could indicate an adversary attempting to establish persistence or execute malicious commands.
YARA-L
