Suspicious RunMRU Registry Modification via Explorer.exe
This alert detects potentially suspicious command entries written to the RunMRU registry key by explorer.exe, which is commonly used to store user-executed commands from the Windows Run dialog. While RunMRU activity is often benign, this detection specifically looks for indicators that may suggest malicious or risky behavior, including the presence of scripting engines, command-line utilities, download or execution functions, encoded payload patterns, or unusual symbols. Such artifacts are frequently associated with adversary techniques involving user-assisted execution, obfuscated commands, or living-off-the-land binaries (LOLBins). The activity warrants review to determine whether the command originated from legitimate user behavior or represents an attempt to execute or stage malicious code through the Run dialog.
Microsoft Sentinel (KQL)
