Suspicious RunMRU Registry Key Removal - Registry (via registry_delete)

This rule detects attempts to delete the RunMRU registry key, which stores the history of commands executed via the run dialog. In the clickfix techniques, the phishing lures instruct users to open a run dialog through (Win + R) and execute hostile commands. Adversaries may delete this key to cover their tracks after running commands.