Windows: Detect reg.exe Deletion of RunMRU Registry Key

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1070.003Clear Command History
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process creation events where reg.exe is used to delete the RunMRU registry key under HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU. The RunMRU key stores the command history shown when users open the Run dialog, so clearing it can help an attacker reduce evidence of executed commands. It relies on Windows process creation telemetry capturing the executable name and command line containing both the delete operation and the specific RunMRU registry path.

Reporting behind it

Related detections8 linkedT1070.003 — drag to rearrange

Suspicious Shell History Clearing or Disabling (via process_creation)

Suspicious COLDRIVER RunMRU History Clearing via Reg Delete (via process_creation)

Suspicious File Immutability Set via chattr for Anti-Removal on Linux

Suspicious Clearing of Linux Authentication and History Logs

Windows Registry RunMRU Key Deletion

Windows PowerShell Command History Disable via Remove-Module psreadline

Windows PowerShell Clears Console History via Clear-History

Cisco Network OS Log and Archive Clearing via “clear logging” Commands

Windows: Detect reg.exe Deletion of RunMRU Registry Key

Pivot detection · T1070.003 · 8 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-detect-reg-exe-deletion-of-runmru-registry-key-c11aecef

title: "Windows: Detect reg.exe Deletion of RunMRU Registry Key"
id: e888eba6-bf63-4ccb-a655-152e5c11a02d
related:
  - id: 3a9b8c1e-5b2e-4f7a-9d1c-2a7f3b6e1c55
    type: similar
  - id: c11aecef-9c37-45a6-9c07-bc0782f963fd
    type: derived
status: experimental
description: This rule flags process creation events where reg.exe is used to delete the RunMRU registry key under HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU. The RunMRU key stores the command history shown when users open the Run dialog, so clearing it can help an attacker reduce evidence of executed commands. It relies on Windows process creation telemetry capturing the executable name and command line containing both the delete operation and the specific RunMRU registry path.
references:
  - https://www.zscaler.com/blogs/security-research/coldriver-updates-arsenal-baitswitch-and-simplefix
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_reg_delete_runmru.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-09-25
tags:
  - attack.stealth
  - attack.t1070.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \reg.exe
    - OriginalFileName: reg.exe
  selection_cli:
    CommandLine|contains|all:
      - " del"
      - \Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL