Detection of LegionLoader via Clickfix Vector Executing .msi from RunMRU Registry Key

ryan o riordan@riordz

•updated Jul 28, 2025•1•1•34

This detection identifies suspicious use of the Windows RunMRU registry key — typically used by Explorer to store command history — to execute .msi installer files. It specifically flags cases where a registry value under the RunMRU key contains a reference to a .msi file, which can indicate abuse by malware droppers such as LegionLoader.