Windows: Detect reg.exe Deletion of RunMRU Registry Key
Alerts on reg.exe commands that delete the RunMRU registry key, clearing Run dialog command history.
- Product
- windows
- Category
- process_creation
- Author
- Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2025-09-25
- Updated
- 2026-07-30
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process creation events where reg.exe is used to delete the RunMRU registry key under HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU. The RunMRU key stores the command history shown when users open the Run dialog, so clearing it can help an attacker reduce evidence of executed commands. It relies on Windows process creation telemetry capturing the executable name and command line containing both the delete operation and the specific RunMRU registry path.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Detect reg.exe Deletion of RunMRU Registry Key"
id: e888eba6-bf63-4ccb-a655-152e5c11a02d
related:
- id: 3a9b8c1e-5b2e-4f7a-9d1c-2a7f3b6e1c55
type: similar
- id: c11aecef-9c37-45a6-9c07-bc0782f963fd
type: derived
status: experimental
description: This rule flags process creation events where reg.exe is used to delete the RunMRU registry key under HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU. The RunMRU key stores the command history shown when users open the Run dialog, so clearing it can help an attacker reduce evidence of executed commands. It relies on Windows process creation telemetry capturing the executable name and command line containing both the delete operation and the specific RunMRU registry path.
references:
- https://www.zscaler.com/blogs/security-research/coldriver-updates-arsenal-baitswitch-and-simplefix
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_reg_delete_runmru.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-09-25
tags:
- attack.stealth
- attack.t1070.003
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \reg.exe
- OriginalFileName: reg.exe
selection_cli:
CommandLine|contains|all:
- " del"
- \Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU
condition: all of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1