Sigma rule: Command Executed Via Run Dialog Box - Registry

Rule

Title

Command Executed Via Run Dialog Box - Registry

Status

test

Level

low

Author

Ahmed Farouk, Nasreddine Bencherchali

Date

2024-11-01

File

rules-threat-hunting/windows/registry/registry_set/registry_set_runmru_command_execution.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects execution of commands via the run dialog box on Windows by checking values of the "RunMRU" registry key.
This technique was seen being abused by threat actors to deceive users into pasting and executing malicious commands, often disguised as CAPTCHA verification steps.

Log source

product

windows

category

registry_set

Detection

selection:
    TargetObject|contains: '\Microsoft\Windows\CurrentVersion\Explorer\RunMRU'
filter_main_mrulist:
    TargetObject|endswith: '\MRUList'
filter_optional_ping:
    Details|contains: 'ping'
filter_optional_generic:
    Details:
        - '%appdata%\1'
        - '%localappdata%\1'
        - '%public%\1'
        - '%temp%\1'
        - 'calc\1'
        - 'dxdiag\1'
        - 'explorer\1'
        - 'gpedit.msc\1'
        - 'mmc\1'
        - 'notepad\1'
        - 'regedit\1'
        - 'services.msc\1'
        - 'winver\1'
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*

False positives (as the rule lists them)

• Likely

Tags

• detection.threat-hunting
• attack.execution

Related rules

• a7df0e9e-91a5-459a-a003-4cde67c2ff5d (derived)

References

• https://www.forensafe.com/blogs/runmrukey.html
• https://medium.com/@shaherzakaria8/downloading-trojan-lumma-infostealer-through-capatcha-1f25255a0e71
• https://redcanary.com/blog/threat-intelligence/intelligence-insights-october-2024/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-threat-hunting/windows/registry/registry_set/registry_set_runmru_command_execution.yml