Threat Hunt: ClickFix Windows run box execution via registry
Looking for strings entered into and executed from the Windows run box, which is leveraged by ClickFix campaigns for initial access. Looking modifications to the Windows Registry's 'RunMRU' key, which stores the history of commands executed via the 'Run' dialog box (Windows Key + R), we can detect when new run box commands are executed.
Microsoft Sentinel (KQL)
