Powershell Execution With Download Cradle From Runmru

Tim Peck@timpeck

•updated Aug 21, 2025•1•1•63

Detects PowerShell commands, particularly those involving download and execution cradles (irm/iex), being written to the RunMRU registry key. This behavior is indicative of social engineering attacks like 'ClickFix' where users are tricked into pasting and running malicious commands via the Windows Run dialog.