Potentially Suspicious Command Executed Via Run Dialog Box - Registry

Status: test
Severity: high
Log source: category registry_set, product windows
Author: Ahmed Farouk, Nasreddine Bencherchali
Source: github.com/SigmaHQ/sigma

Detects execution of commands via the run dialog box on Windows by checking values of the "RunMRU" registry key. This technique was seen being abused by threat actors to deceive users into pasting and executing malicious commands, often disguised as CAPTCHA verification steps.

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1059.001` Command and Scripting Interpreter: PowerShell

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 13: RegistryEvent (Value Set)

Rule body

title: Potentially Suspicious Command Executed Via Run Dialog Box - Registry
id: a7df0e9e-91a5-459a-a003-4cde67c2ff5d
related:
    - id: f9d091f6-f1c7-4873-a24f-050b4a02b4dd
      type: derived
status: test
description: |
    Detects execution of commands via the run dialog box on Windows by checking values of the "RunMRU" registry key.
    This technique was seen being abused by threat actors to deceive users into pasting and executing malicious commands, often disguised as CAPTCHA verification steps.
references:
    - https://medium.com/@ahmed.moh.farou2/fake-captcha-campaign-on-arabic-pirated-movie-sites-delivers-lumma-stealer-4f203f7adabf
    - https://medium.com/@shaherzakaria8/downloading-trojan-lumma-infostealer-through-capatcha-1f25255a0e71
    - https://www.forensafe.com/blogs/runmrukey.html
    - https://redcanary.com/blog/threat-intelligence/intelligence-insights-october-2024/
author: Ahmed Farouk, Nasreddine Bencherchali
date: 2024-11-01
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    category: registry_set
detection:
    selection_key:
        TargetObject|contains: '\Microsoft\Windows\CurrentVersion\Explorer\RunMRU'
    selection_powershell_command:
        Details|contains:
            - 'powershell'
            - 'pwsh'
    selection_powershell_susp_keywords:
        Details|contains:
            - ' -e '
            - ' -ec '
            - ' -en '
            - ' -enc '
            - ' -enco'
            - 'ftp'
            - 'Hidden'
            - 'http'
            - 'iex'
            - 'Invoke-'
    selection_wmic_command:
        Details|contains: 'wmic'
    selection_wmic_susp_keywords:
        Details|contains:
            - 'shadowcopy'
            - 'process call create'
    condition: selection_key and (all of selection_powershell_* or all of selection_wmic_*)
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

selection_key and (all of selection_powershell_* or all of selection_wmic_*)

Stage 1: `selection_key`

selection_key:
    TargetObject|contains: '\Microsoft\Windows\CurrentVersion\Explorer\RunMRU'

Stage 2: `selection_powershell_command`

selection_powershell_command:
    Details|contains:
        - 'powershell'
        - 'pwsh'

Stage 3: `selection_powershell_susp_keywords`

selection_powershell_susp_keywords:
    Details|contains:
        - ' -e '
        - ' -ec '
        - ' -en '
        - ' -enc '
        - ' -enco'
        - 'ftp'
        - 'Hidden'
        - 'http'
        - 'iex'
        - 'Invoke-'

Stage 4: `selection_wmic_command`

selection_wmic_command:
    Details|contains: 'wmic'

Stage 5: `selection_wmic_susp_keywords`

selection_wmic_susp_keywords:
    Details|contains:
        - 'shadowcopy'
        - 'process call create'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Details`	match	`-e` `-ec` `-en` `-enc` `-enco` `Hidden` `Invoke-` corpus 2 (sigma 2) `ftp` `http` corpus 3 (sigma 2, elastic 1) `iex` corpus 2 (sigma 2) `powershell` corpus 11 (sigma 9, elastic 1, chronicle 1) `process call create` `pwsh` corpus 5 (sigma 5) `shadowcopy` `wmic`	`field:"Details" kind:match`
`TargetObject`	match	`\Microsoft\Windows\CurrentVersion\Explorer\RunMRU` corpus 2 (sigma 2)	`field:"TargetObject" kind:match value:"\Microsoft\Windows\CurrentVersion\Explorer\RunMRU"`

Potentially Suspicious Command Executed Via Run Dialog Box - Registry

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection_key

Stage 2: selection_powershell_command

Stage 3: selection_powershell_susp_keywords

Stage 4: selection_wmic_command