Run Dialog Disabled via Explorer Policy (NoRun)
This rule detects the creation or modification of the 'NoRun' registry value under the Explorer policies key. This policy is used to remove the 'Run' command from the Start Menu, effectively preventing users from launching applications via the standard Run dialog. Adversaries may use this to impair user interaction or as part of a broader defense evasion effort to restrict access to system utilities.
Sigma
