Registry RunMRU Artifact of ClickFix rundll32 WebDAV Execution
Detects evidence of ClickFix-style social engineering attacks in the Windows Registry RunMRU key. Attackers often trick users into copying and pasting malicious commands into the Run dialog; these commands frequently involve using rundll32.exe with WebDAV paths (@SSL) or headless execution of utilities like conhost.exe to execute malicious payloads.
Sigma
