Windows: Detect Run dialog command history in RunMRU registry

title: "Windows: Detect Run dialog command history in RunMRU registry"
id: 14e94130-a19c-420f-ae2f-1f8aaa78aa7c
related:
  - id: a7df0e9e-91a5-459a-a003-4cde67c2ff5d
    type: derived
  - id: f9d091f6-f1c7-4873-a24f-050b4a02b4dd
    type: derived
status: test
description: This rule detects entries related to commands executed through the Windows Run dialog by monitoring the RunMRU registry key path. Attackers may leverage this execution pathway to get users to run attacker-supplied commands, leaving command history artifacts in the registry. The detection relies on registry set telemetry capturing the TargetObject path and command-related Details values.
references:
  - https://www.forensafe.com/blogs/runmrukey.html
  - https://medium.com/@shaherzakaria8/downloading-trojan-lumma-infostealer-through-capatcha-1f25255a0e71
  - https://redcanary.com/blog/threat-intelligence/intelligence-insights-october-2024/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/registry/registry_set/registry_set_runmru_command_execution.yml
author: Ahmed Farouk, Nasreddine Bencherchali, Huntrule Team
date: 2024-11-01
tags:
  - detection.threat-hunting
  - attack.execution
logsource:
  product: windows
  category: registry_set
detection:
  selection:
    TargetObject|contains: \Microsoft\Windows\CurrentVersion\Explorer\RunMRU
  filter_main_mrulist:
    TargetObject|endswith: \MRUList
  filter_optional_ping:
    Details|contains: ping
  filter_optional_generic:
    Details:
      - "%appdata%\\1"
      - "%localappdata%\\1"
      - "%public%\\1"
      - "%temp%\\1"
      - calc\1
      - dxdiag\1
      - explorer\1
      - gpedit.msc\1
      - mmc\1
      - notepad\1
      - regedit\1
      - services.msc\1
      - winver\1
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Likely
level: low
license: DRL-1.1