Windows: Detect reg.exe Deletion of RunMRU Registry Key

Alerts on reg.exe commands that delete the RunMRU registry key, clearing Run dialog command history.

FreeUnreviewedSigmahighv1

windows-detect-reg-exe-deletion-of-runmru-registry-key-c11aecef

title: "Windows: Detect reg.exe Deletion of RunMRU Registry Key"
id: e888eba6-bf63-4ccb-a655-152e5c11a02d
related:
  - id: 3a9b8c1e-5b2e-4f7a-9d1c-2a7f3b6e1c55
    type: similar
  - id: c11aecef-9c37-45a6-9c07-bc0782f963fd
    type: derived
status: experimental
description: This rule flags process creation events where reg.exe is used to delete the RunMRU registry key under HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU. The RunMRU key stores the command history shown when users open the Run dialog, so clearing it can help an attacker reduce evidence of executed commands. It relies on Windows process creation telemetry capturing the executable name and command line containing both the delete operation and the specific RunMRU registry path.
references:
  - https://www.zscaler.com/blogs/security-research/coldriver-updates-arsenal-baitswitch-and-simplefix
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_reg_delete_runmru.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-09-25
tags:
  - attack.stealth
  - attack.t1070.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \reg.exe
    - OriginalFileName: reg.exe
  selection_cli:
    CommandLine|contains|all:
      - " del"
      - \Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1

What it detects

This rule flags process creation events where reg.exe is used to delete the RunMRU registry key under HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU. The RunMRU key stores the command history shown when users open the Run dialog, so clearing it can help an attacker reduce evidence of executed commands. It relies on Windows process creation telemetry capturing the executable name and command line containing both the delete operation and the specific RunMRU registry path.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.