Suspicious Execution via Windows Run Dialog (RunMRU)(ClickFix)

F S@Fsdr

•updated Jul 31, 2025•5•1•104

This detection identifies when a user executes a potentially malicious command via the Windows Run dialog (Win+R). It monitors the RunMRU registry key for commands associated with living-off-the-land binaries (LOLBins) and scripting engines like PowerShell, MSHTA, Bitsadmin, and others. Such activity is often a sign of initial access, where an attacker has tricked a user into running a payload downloader or stager command