Command Executed Via Run Dialog Box - Registry

Description

Detects execution of commands via the run dialog box on Windows by checking values of the "RunMRU" registry key. This technique was seen being abused by threat actors to deceive users into pasting and executing malicious commands, often disguised as CAPTCHA verification steps.

Query · sigma

selection:
  TargetObject|contains: \Microsoft\Windows\CurrentVersion\Explorer\RunMRU
filter_main_mrulist:
  TargetObject|endswith: \MRUList
filter_optional_ping:
  Details|contains: ping
filter_optional_generic:
  Details:
  - '%appdata%\1'
  - '%localappdata%\1'
  - '%public%\1'
  - '%temp%\1'
  - calc\1
  - dxdiag\1
  - explorer\1
  - gpedit.msc\1
  - mmc\1
  - notepad\1
  - regedit\1
  - services.msc\1
  - winver\1
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*

Known false positives

  • Likely
Raw source Command Executed Via Run Dialog Box - Registry · Sigma
Esc
Published by SigmaHQ/sigma ↗, licensed under Detection Rule License 1.1 ↗. Reproduced here unmodified. 
title: Command Executed Via Run Dialog Box - Registry
id: f9d091f6-f1c7-4873-a24f-050b4a02b4dd
related:
    - id: a7df0e9e-91a5-459a-a003-4cde67c2ff5d
      type: derived
status: test
description: |
    Detects execution of commands via the run dialog box on Windows by checking values of the "RunMRU" registry key.
    This technique was seen being abused by threat actors to deceive users into pasting and executing malicious commands, often disguised as CAPTCHA verification steps.
references:
    - https://www.forensafe.com/blogs/runmrukey.html
    - https://medium.com/@shaherzakaria8/downloading-trojan-lumma-infostealer-through-capatcha-1f25255a0e71
    - https://redcanary.com/blog/threat-intelligence/intelligence-insights-october-2024/
author: Ahmed Farouk, Nasreddine Bencherchali
date: 2024-11-01
tags:
    - detection.threat-hunting
    - attack.execution
logsource:
    product: windows
    category: registry_set
detection:
    selection:
        TargetObject|contains: '\Microsoft\Windows\CurrentVersion\Explorer\RunMRU'
    filter_main_mrulist:
        TargetObject|endswith: '\MRUList'
    filter_optional_ping:
        Details|contains: 'ping'
    filter_optional_generic:
        Details:
            - '%appdata%\1'
            - '%localappdata%\1'
            - '%public%\1'
            - '%temp%\1'
            - 'calc\1'
            - 'dxdiag\1'
            - 'explorer\1'
            - 'gpedit.msc\1'
            - 'mmc\1'
            - 'notepad\1'
            - 'regedit\1'
            - 'services.msc\1'
            - 'winver\1'
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - Likely
level: low

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.