this detection may generate a few false positives, such as legitimate software updates or legitimate system maintenance activities that modify the runmru key. however, the exclusion of mrulist value changes helps reduce the number of false positives by focusing only on actual command entries. add any specific false positives to the built in filter to reduce notables as needed.

Techniques

T1202

Sample rules

Windows RunMRU Command Execution

source: splunk
technicques:
- T1202

Description

The following analytic detects modifications to the Windows RunMRU registry key, which stores a history of commands executed through the Run dialog box (Windows+R). It leverages Endpoint Detection and Response (EDR) telemetry to monitor registry events targeting this key. This activity is significant as malware often uses the Run dialog to execute malicious commands while attempting to appear legitimate. If confirmed malicious, this could indicate an attacker using indirect command execution techniques for defense evasion or persistence. The detection excludes MRUList value changes to focus on actual command entries.

Detection logic


| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_key_name="*\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU*" NOT Registry.registry_key_name="*\\MRUList" by Registry.dest Registry.registry_value_data Registry.action  Registry.process_guid Registry.process_id Registry.registry_key_name Registry.user 
| `drop_dm_object_name(Registry)` 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `windows_runmru_command_execution_filter`