Windows Registry RunMRU Key Deletion

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1070.003Clear Command History
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags attempts to delete the RunMRU registry key under Explorer, which stores the history of commands entered via the Windows Run dialog. Removing this key can reduce forensic evidence after an attacker has executed commands through that interface. The detection relies on registry deletion telemetry matching the target registry path ending with \Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU.

Reporting behind it

Related detections8 linkedT1070.003 — drag to rearrange

Suspicious Shell History Clearing or Disabling (via process_creation)

Suspicious COLDRIVER RunMRU History Clearing via Reg Delete (via process_creation)

Suspicious File Immutability Set via chattr for Anti-Removal on Linux

Suspicious Clearing of Linux Authentication and History Logs

Windows: Detect reg.exe Deletion of RunMRU Registry Key

Windows PowerShell Command History Disable via Remove-Module psreadline

Windows PowerShell Clears Console History via Clear-History

Cisco Network OS Log and Archive Clearing via “clear logging” Commands

Windows Registry RunMRU Key Deletion

Pivot detection · T1070.003 · 8 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-registry-runmru-key-deletion-3a9b8c1e

title: Windows Registry RunMRU Key Deletion
id: 24e82e6b-8d14-46ac-8e48-389ee29a0302
related:
  - id: c11aecef-9c37-45a6-9c07-bc0782f963fd
    type: similar
  - id: 3a9b8c1e-5b2e-4f7a-9d1c-2a7f3b6e1c55
    type: derived
status: experimental
description: This rule flags attempts to delete the RunMRU registry key under Explorer, which stores the history of commands entered via the Windows Run dialog. Removing this key can reduce forensic evidence after an attacker has executed commands through that interface. The detection relies on registry deletion telemetry matching the target registry path ending with \Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU.
references:
  - https://www.zscaler.com/blogs/security-research/coldriver-updates-arsenal-baitswitch-and-simplefix
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_delete/registry_delete_runmru.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-09-25
tags:
  - attack.stealth
  - attack.t1070.003
logsource:
  category: registry_delete
  product: windows
detection:
  selection:
    TargetObject|endswith: \Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU
  condition: selection
falsepositives:
  - Unknown
level: high
regression_tests_path: regression_data/rules/windows/registry/registry_delete/registry_delete_runmru/info.yml
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL