Suspicious Registry RunMRU Obfuscated Commands
This rule detects suspicious entries in the RunMRU (Most Recently Used) registry key that indicate potential persistence mechanisms. It specifically looks for entries containing DNS-related tools (like nslookup, dig, host), other common system utilities (ping, tracert, ipconfig, powershell, cmd.exe, wmic, curl, wget, certutil, bitsadmin), or suspicious flags commonly associated with obfuscated or malicious commands (e.g., base64 encoding, web requests, common sensitive paths). The rule also correlates these registry modifications with subsequent process creations to confirm execution.
Microsoft Sentinel (KQL)
