RunMRU with non-ASCII characters

Description

Identifies non-ASCII data written to the RunMRU registry key by explorer.

Query · kql

//Identifies non-ASCII data written to the RunMRU registry key by explorer. This may indicate user-pasted commands from social engineering tactics like "ClickFix", where users are tricked into executing code.
DeviceRegistryEvents
  | where InitiatingProcessFileName == "explorer.exe"
  | where ActionType == "RegistryValueSet"
  | where RegistryKey endswith "RunMRU"
  | where RegistryValueData matches regex "[^[:ascii]]"
  // If too noisy add the following filter
  // | where RegistryValueData contains "#"
Raw source RunMRU with non-ASCII characters · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 6e8ee46f-80ee-46f6-be49-49a66f01edce
name: RunMRU with non-ASCII characters
description: |
  Identifies non-ASCII data written to the RunMRU registry key by explorer.
description-detailed: |
  Identifies non-ASCII data written to the RunMRU registry key by explorer. This may indicate user-pasted commands from social engineering tactics like "ClickFix", where users are tricked into executing code.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceRegistryEvents
tactics:
- Execution
relevantTechniques:
- T1204.004
query: |
  //Identifies non-ASCII data written to the RunMRU registry key by explorer. This may indicate user-pasted commands from social engineering tactics like "ClickFix", where users are tricked into executing code.
  DeviceRegistryEvents
    | where InitiatingProcessFileName == "explorer.exe"
    | where ActionType == "RegistryValueSet"
    | where RegistryKey endswith "RunMRU"
    | where RegistryValueData matches regex "[^[:ascii]]"
    // If too noisy add the following filter
    // | where RegistryValueData contains "#"
version: 1.0.1

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.