Query: alert when Detects execution of commands via the run dialog box on Windows by checking values of the "RunMRU" registry key. This te
Matching passage: Sigma rule: Detects execution of commands via the run dialog box on Windows by checking values of the "RunMRU" registry key. This te. Logsource: windows / registry_set. Rule: title: Potentially Suspicious Command Executed Via Run Dialog Box - Registry id: a7df0e9e-91a5-459a-a003-4cde67c2ff5d related: - id: f9d091f6-f1c7-4873-a24f-050b4a02b4dd type: derived status: test description: 'Detects execution of commands via the run dialog box on Windows by checking values of the "RunMRU" registry key. This technique was seen being abused by threat actors to deceive users into pasting and executing malicious commands, often disguised as CAPTCHA verification steps. ' references: - https://medium.com/@ahmed.moh.farou2/fake-captcha-campaign-on-arabic-pirated-movie-sites-delivers-lumma-stealer-4f203f7adabf - https://medium.com/@shaherzakaria8/downloading-trojan-lumma-infostealer-through-capatcha-1f25255a0e71 - https://www.forensafe.com/blogs/runmrukey.html - https://redcanary.com/blog/threat-intelligence/intelligence-insights-october-2024/ author: Ahmed Farouk, Nasreddine Bencherchali date: 2024-11-01 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: registry_set detection: selection_key: TargetObject|contains: \Microsoft\Windows\CurrentVersion\Explorer\RunMRU selection_powershell_command: Details|contains: - powershell - pwsh selection_powershell_susp_keywords: Details|contains: - ' -e ' - ' -ec ' - ' -en ' - ' -enc ' - ' -enco' - ftp - Hidden - http - iex - Invoke- selection_wmic_command: Details|contains: wmic selection_wmic_susp_keywords: Details|contains: - shadowcopy - process call create condition: selection_key and (all of selection_powershell_* or all of selection_wmic_*) falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects potential COM object hijacking via modification of default system CLSID.. Logsource: windows / registry_set. Rule: title: COM Object Hijacking Via Modification Of Default System CLSID Default Value id: 790317c0-0a36-4a6a-a105-6e576bf99a14 related: - id: 3d968d17-ffa4-4bc0-bfdc-f139de76ce77 type: obsolete - id: a0ff33d8-79e4-4cef-b4f3-9dc4133ccd12 type: obsolete status: experimental description: Detects potential COM object hijacking via modification of default system CLSID. references: - https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/ (idea) - https://unit42.paloaltonetworks.com/snipbot-romcom-malware-variant/ - https://blog.talosintelligence.com/uat-5647-romcom/ - https://global.ptsecurity.com/analytics/pt-esc-threat-intelligence/darkhotel-a-cluster-of-groups-united-by-common-techniques - https://threatbook.io/blog/Analysis-of-APT-C-60-Attack-on-South-Korea - https://catalyst.prodaft.com/public/report/inside-the-latest-espionage-campaign-of-nebulous-mantis - https://github.com/rtecCyberSec/BitlockMove - https://cert.gov.ua/article/6284080 - https://securelist.com/forumtroll-apt-hacking-team-dante-spyware/117851/ author: Nasreddine Bencherchali (Nextron Systems) date: 2024-07-16 modified: 2025-11-10 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.015 logsource: category: registry_set product: windows detection: selection_target_root: TargetObject|contains: \CLSID\ TargetObject|endswith: - \InprocServer32\(Default) - \LocalServer32\(Default) selection_target_builtin_clsid: TargetObject|contains: - \{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\ - \{2155fee3-2419-4373-b102-6843707eb41f}\ - \{4590f811-1d3a-11d0-891f-00aa004b2e24}\ - \{4de225bf-cf59-4cfc-85f7-68b90f185355}\ - \{ddc05a5a-351a-4e06-8eaf-54ec1bc2dcea}\ - \{F56F6FDD-AA9D-4618-A949-C1B91AF43B1A}\ - \{F82B4EF1-93A9-4DDE-8015-F7950A1A6E31}\ - \{7849596a-48ea-486e-8937-a2a3009f31a9}\ - \{0b91a74b-ad7c-4a9d-b563-29eef9167172}\ - \{603D3801-BD81-11d0-A3A5-00C04FD706EC}\ - \{30D49246-D217-465F-B00B-AC9DDD652EB7}\ - \{A7A63E5C-3877-4840-8727-C1EA9D7A4D50}\ - \{2227A280-3AEA-1069-A2DE-08002B30309D}\ - \{2DEA658F-54C1-4227-AF9B-260AB5FC3543}\ - \{AA509086-5Ca9-4C25-8F95-589D3C07B48A}\ selection_susp_location_1: Details|contains: - :\Perflogs\ - \AppData\Local\ - \Desktop\ - \Downloads\ - \Microsoft\Windows\Start Menu\Programs\Startup\ - \System32\spool\drivers\color\ - \Temporary Internet - \Users\Public\ - \Windows\Temp\ - '%appdata%' - '%temp%' - '%tmp%' selection_susp_location_2: - Details|contains|all: - :\Users\ -