{"id":"7a1b4c5e-8f3d-4b9a-7c2e-1f4a5b8c6d9e","title":"Suspicious Space Characters in RunMRU Registry Path - ClickFix","description":"Detects the occurrence of numerous space characters in RunMRU registry paths, which may indicate execution via phishing lures using clickfix techniques to hide malicious commands in the Windows Run dialog box from naked eyes.\n","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-11-04","modified":"","tags":["attack.execution","attack.stealth","attack.t1204.004","attack.t1027.010"],"technique_ids":["T1027.010","T1204.004"],"logsource":{"category":"registry_set","product":"windows"},"falsepositives":["Unlikely"],"references":["https://expel.com/blog/cache-smuggling-when-a-picture-isnt-a-thousand-words/","https://github.com/JohnHammond/recaptcha-phish"],"source_path":"rules/windows/registry/registry_set/registry_set_susp_runmru_space_character.yml","source_sha256":"de3c700829e635c360462b368541a81398df0a318f01dd4b78d1acca0fd0debd","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_susp_runmru_space_character.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious Space Characters in RunMRU Registry Path - ClickFix\nid: 7a1b4c5e-8f3d-4b9a-7c2e-1f4a5b8c6d9e\nrelated:\n    - id: 3ae9974a-eb09-4044-8e70-8980a50c12c8\n      type: similar\nstatus: experimental\ndescription: |\n    Detects the occurrence of numerous space characters in RunMRU registry paths, which may indicate execution via phishing lures using clickfix techniques to hide malicious commands in the Windows Run dialog box from naked eyes.\nreferences:\n    - https://expel.com/blog/cache-smuggling-when-a-picture-isnt-a-thousand-words/\n    - https://github.com/JohnHammond/recaptcha-phish\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\ndate: 2025-11-04\ntags:\n    - attack.execution\n    - attack.stealth\n    - attack.t1204.004\n    - attack.t1027.010\nlogsource:\n    category: registry_set\n    product: windows\ndetection:\n    selection_key:\n        TargetObject|contains: '\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU\\'\n        Details|contains: '#'\n    selection_space_variation:\n        Details|contains:\n            - '            ' # En Quad (U+2000)\n            - '            ' # Em Quad (U+2001)\n            - '            ' # En Space (U+2002)\n            - '            ' # Em Space (U+2003)\n            - '            ' # Three-Per-Em Space (U+2004)\n            - '            ' # Four-Per-Em Space (U+2005)\n            - '            ' # Six-Per-Em Space (U+2006)\n            - '            ' # Figure Space (U+2007)\n            - '            ' # Punctuation Space (U+2008)\n            - '            ' # Thin Space (U+2009)\n            - '            ' # Hair Space (U+200A)\n            - '            ' # No-Break Space (U+00A0)\n            - '            ' # Normal space\n    condition: all of selection_*\nfalsepositives:\n    - Unlikely\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1027.010","id":"T1027.010","name":"Command Obfuscation","page":"techniques/enterprise/T1027.010/"},{"key":"enterprise/T1204.004","id":"T1204.004","name":"Malicious Copy and Paste","page":"techniques/enterprise/T1204.004/"}],"data_path":"data/detection-rules/7a1b4c5e-8f3d-4b9a-7c2e-1f4a5b8c6d9e.json","kind":"sigma"}