RunMRU Registry Key Deletion - Registry

Status: experimental
Severity: high
Log source: category registry_delete, product windows
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects attempts to delete the RunMRU registry key, which stores the history of commands executed via the run dialog. In the clickfix techniques, the phishing lures instruct users to open a run dialog through (Win + R) and execute malicious commands. Adversaries may delete this key to cover their tracks after executing commands.

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1070.003` Indicator Removal: Clear Command History

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 14: RegistryEvent (Key and Value Rename)

Rule body

title: RunMRU Registry Key Deletion - Registry
id: 3a9b8c1e-5b2e-4f7a-9d1c-2a7f3b6e1c55
related:
    - id: c11aecef-9c37-45a6-9c07-bc0782f963fd
      type: similar
status: experimental
description: |
    Detects attempts to delete the RunMRU registry key, which stores the history of commands executed via the run dialog.
    In the clickfix techniques, the phishing lures instruct users to open a run dialog through (Win + R) and execute malicious commands.
    Adversaries may delete this key to cover their tracks after executing commands.
references:
    - https://www.zscaler.com/blogs/security-research/coldriver-updates-arsenal-baitswitch-and-simplefix
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-09-25
tags:
    - attack.stealth
    - attack.t1070.003
logsource:
    category: registry_delete
    product: windows
detection:
    selection:
        TargetObject|endswith: '\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU'
    condition: selection
falsepositives:
    - Unknown
level: high
regression_tests_path: regression_data/rules/windows/registry/registry_delete/registry_delete_runmru/info.yml

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    TargetObject|endswith: '\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`TargetObject`	ends_with	`\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU`	`field:"TargetObject" kind:ends_with value:"\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU"`