Detectionhightest

Potentially Suspicious Command Executed Via Run Dialog Box - Registry

Detects execution of commands via the run dialog box on Windows by checking values of the "RunMRU" registry key. This technique was seen being abused by threat actors to deceive users into pasting and executing malicious commands, often disguised as CAPTCHA verification steps.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Ahmed Farouk, Nasreddine Bencherchali (Nextron Systems)Created Fri Nov 01a7df0e9e-91a5-459a-a003-4cde67c2ff5dwindows

Log Source

WindowsRegistry Set

ProductWindows← raw: windows

CategoryRegistry Set← raw: registry_set

Detection Logic

detection:
    selection_key:
        TargetObject|contains: '\Microsoft\Windows\CurrentVersion\Explorer\RunMRU'
    selection_powershell_command:
        Details|contains:
            - 'powershell'
            - 'pwsh'
    selection_powershell_susp_keywords:
        Details|contains:
            - ' -e '
            - ' -ec '
            - ' -en '
            - ' -enc '
            - ' -enco'
            - 'ftp'
            - 'Hidden'
            - 'http'
            - 'iex'
            - 'Invoke-'
    selection_wmic_command:
        Details|contains: 'wmic'
    selection_wmic_susp_keywords:
        Details|contains:
            - 'shadowcopy'
            - 'process call create'
    condition: selection_key and (all of selection_powershell_* or all of selection_wmic_*)