Suspicious RunMRU Command Execution
Detects suspicious command line interpreters or downloaders stored in the Windows RunMRU registry key. This technique is often used in ClickFix attacks where users are socially engineered into pasting malicious commands into the Windows Run dialog.
Microsoft Sentinel (KQL)
