Microsoft ClickFix - RunMRU Suspicious Commands
This rule detects suspicious commands being added to the Run Most Recently Used (MRU) registry key, often associated with the Microsoft ClickFix social engineering technique. It looks for modifications to the 'RunMRU' registry key by 'explorer.exe' where the 'RegistryValueData' contains specific keywords or patterns. These patterns include the '✅' character, a combination of common scripting/execution tools (powershell, mshta, curl, msiexec) with non-Latin characters, 'mshta' not in typical benign values, 'bitsadmin', 'forfiles', 'ProxyCommand=', or 'cmd'/'powershell' commands with obfuscation techniques, web requests, or code execution indicators.
Microsoft Sentinel (KQL)
