Suspicious Space Characters in RunMRU Registry Path - ClickFix

Status: experimental
Severity: high
Log source: category registry_set, product windows
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects the occurrence of numerous space characters in RunMRU registry paths, which may indicate execution via phishing lures using clickfix techniques to hide malicious commands in the Windows Run dialog box from naked eyes.

Known false positives

Unlikely

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1204.004` User Execution: Malicious Copy and Paste
Stealth	`T1027.010` Obfuscated Files or Information: Command Obfuscation

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 13: RegistryEvent (Value Set)

Rule body

title: Suspicious Space Characters in RunMRU Registry Path - ClickFix
id: 7a1b4c5e-8f3d-4b9a-7c2e-1f4a5b8c6d9e
related:
    - id: 3ae9974a-eb09-4044-8e70-8980a50c12c8
      type: similar
status: experimental
description: |
    Detects the occurrence of numerous space characters in RunMRU registry paths, which may indicate execution via phishing lures using clickfix techniques to hide malicious commands in the Windows Run dialog box from naked eyes.
references:
    - https://expel.com/blog/cache-smuggling-when-a-picture-isnt-a-thousand-words/
    - https://github.com/JohnHammond/recaptcha-phish
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-11-04
tags:
    - attack.execution
    - attack.stealth
    - attack.t1204.004
    - attack.t1027.010
logsource:
    category: registry_set
    product: windows
detection:
    selection_key:
        TargetObject|contains: '\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU\'
        Details|contains: '#'
    selection_space_variation:
        Details|contains:
            - '            ' # En Quad (U+2000)
            - '            ' # Em Quad (U+2001)
            - '            ' # En Space (U+2002)
            - '            ' # Em Space (U+2003)
            - '            ' # Three-Per-Em Space (U+2004)
            - '            ' # Four-Per-Em Space (U+2005)
            - '            ' # Six-Per-Em Space (U+2006)
            - '            ' # Figure Space (U+2007)
            - '            ' # Punctuation Space (U+2008)
            - '            ' # Thin Space (U+2009)
            - '            ' # Hair Space (U+200A)
            - '            ' # No-Break Space (U+00A0)
            - '            ' # Normal space
    condition: all of selection_*
falsepositives:
    - Unlikely
level: high

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_key`

selection_key:
    TargetObject|contains: '\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU\'
    Details|contains: '#'

Stage 2: `selection_space_variation`

selection_space_variation:
    Details|contains:
        - '            '
        - '            '
        - '            '
        - '            '
        - '            '
        - '            '
        - '            '
        - '            '
        - '            '
        - '            '
        - '            '
        - '            '
        - '            '

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Details`	match	corpus 2 (sigma 2) `#` corpus 3 (sigma 3) corpus 2 (sigma 2) corpus 2 (sigma 2) corpus 2 (sigma 2) corpus 2 (sigma 2) corpus 2 (sigma 2) corpus 2 (sigma 2) corpus 2 (sigma 2) corpus 2 (sigma 2) corpus 2 (sigma 2) corpus 2 (sigma 2) corpus 2 (sigma 2) corpus 2 (sigma 2)	`field:"Details" kind:match`
`TargetObject`	match	`\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU\` corpus 2 (sigma 2)	`field:"TargetObject" kind:match value:"\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU\"`