RunMRU ClickFix Detection

Benjamin Zulliger@benscha

•updated Feb 23, 2026•12•0•88

This rule detects modifications to the 'RunMRU' registry key, specifically looking for new or changed entries where the command string is unusually long (greater than 50 characters). This can indicate an attempt to persist or execute malicious code via the RunMRU list, which stores recently executed commands.