NetSupport RAT Persistence and RunMRU Cleanup (IClickFix TTP)
Detects NetSupport RAT persistence established via a Registry Run key, followed by the clearing of the RunMRU history. This sequence of events is a known TTP associated with the IClickFix framework, where adversaries attempt to hide the initial execution command after achieving persistence.
Microsoft Sentinel (KQL)
