Suspicious ClickFix command persisted to Explorer RunMRU registry key

Ibrahim Saud@tektrix

•updated 15 days ago•3•0•3

Detects suspicious command-line strings stored in the Windows Explorer RunMRU registry key. Adversaries may use this location to store persistence commands or to obfuscate command-line arguments that are intended to be executed by the user or via automated processes.