CastleLoader - Click Fix Suspicious Command Execution with finger
This rule monitors the Windows Registry 'RunMRU' key for entries that include command execution patterns such as 'cmd.exe' or '%COMSPEC%' combined with suspicious arguments like 'finger' or 'cmd /c'. The RunMRU key stores the history of commands entered into the Windows 'Run' dialog, and this detection identifies potentially malicious command execution patterns often associated with malware loaders attempting to run secondary payloads or obfuscated commands via the shell history.
Microsoft Sentinel (KQL)
