• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    Lumma Stealer RunMRU Detection

    avatar
    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Robert Fly@robertfly
    •updated May 23, 2025•1•2•70

    Detects suspicious command execution patterns in the RunMRU registry key often associated with Lumma Stealer ClickFix delivery using specific executables and unusual character sets.

    Microsoft Sentinel (KQL)

    Tags

    S1213 - Lumma StealerT1197 - BITS JobsT1105 - Ingress Tool TransferT1059 - Command and Scripting InterpreterT1218.007 - MshtaT1218.005 - MsiexecT1547.001 - Registry Run Keys / Startup ItemsT1059.003 - Windows Command ShellT1059.001 - PowerShellT1027 - Obfuscated Files or InformationRegistry Value SetCommand ExecutionRegistry Key ModificationWindowsWindows Defender Atp

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?