Detection of Commands Executed via Run Dialog
This KQL rule detects commands executed via the Run dialog by monitoring changes to the "Runmru" registry key. This key stores a history of commands entered into the Run dialog. Attackers or malicious scripts often use this method to launch tools like PowerShell, cmd, or malicious payloads, particularly in social engineering attacks where users are tricked into running commands.
Microsoft Sentinel (KQL)
