Multiple Commands Executed via Run Dialog (RunMRU)

Ankit Mehta@Secvyn

•updated Jun 5, 2026•1•0•4

Detects when a user executes more than 3 commands via the Windows Run dialog, as indicated by entries in the 'Explorer\RunMRU' registry key. This activity could be indicative of an attacker performing reconnaissance or executing multiple commands, or it could be a legitimate power user or administrator activity.