Dohdoor Anti-Forensic Activity: RunMRU Deletion and Clipboard Clearing
Detects the deletion of the RunMRU registry key and the clearing of the clipboard within a short time window on the same host. This sequence of anti-forensic actions is used by the batch script component of the Dohdoor malware campaign to hide its tracks.
Microsoft Sentinel (KQL)
