huntrule

Windows Registry RunMRU Key Deletion

Alerts on deletion of the Windows Run dialog command history (RunMRU) registry key.

FreeReviewedSigma · High · v1
Product
windows
Category
registry_delete
Author
Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2025-09-25
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags attempts to delete the RunMRU registry key under Explorer, which stores the history of commands entered via the Windows Run dialog. Removing this key can reduce forensic evidence after an attacker has executed commands through that interface. The detection relies on registry deletion telemetry matching the target registry path ending with \Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU.

Reporting behind it

Related detections8 linkedT1070.003 — drag to rearrange
Suspicious Shell History Clearing or Disabling (via process_creation)
Suspicious COLDRIVER RunMRU History Clearing via Reg Delete (via process_creation)
Suspicious File Immutability Set via chattr for Anti-Removal on Linux
Suspicious Clearing of Linux Authentication and History Logs
Windows: Detect reg.exe Deletion of RunMRU Registry Key
Windows PowerShell Command History Disable via Remove-Module psreadline
Windows PowerShell Clears Console History via Clear-History
Cisco Network OS Log and Archive Clearing via “clear logging” Commands
Windows Registry RunMRU Key Deletion
Pivot detection · T1070.003 · 8 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.