{"id":"a7df0e9e-91a5-459a-a003-4cde67c2ff5d","title":"Potentially Suspicious Command Executed Via Run Dialog Box - Registry","description":"Detects execution of commands via the run dialog box on Windows by checking values of the \"RunMRU\" registry key.\nThis technique was seen being abused by threat actors to deceive users into pasting and executing malicious commands, often disguised as CAPTCHA verification steps.\n","author":"Ahmed Farouk, Nasreddine Bencherchali","status":"test","level":"high","date":"2024-11-01","modified":"","tags":["attack.execution","attack.t1059.001"],"technique_ids":["T1059.001"],"logsource":{"product":"windows","category":"registry_set"},"falsepositives":["Unknown"],"references":["https://medium.com/@ahmed.moh.farou2/fake-captcha-campaign-on-arabic-pirated-movie-sites-delivers-lumma-stealer-4f203f7adabf","https://medium.com/@shaherzakaria8/downloading-trojan-lumma-infostealer-through-capatcha-1f25255a0e71","https://www.forensafe.com/blogs/runmrukey.html","https://redcanary.com/blog/threat-intelligence/intelligence-insights-october-2024/"],"source_path":"rules/windows/registry/registry_set/registry_set_runmru_susp_command_execution.yml","source_sha256":"85ca8a21b64c476d081f2325518fea19b0aa45adefd7b02280b1d951d737d6ea","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_runmru_susp_command_execution.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potentially Suspicious Command Executed Via Run Dialog Box - Registry\nid: a7df0e9e-91a5-459a-a003-4cde67c2ff5d\nrelated:\n    - id: f9d091f6-f1c7-4873-a24f-050b4a02b4dd\n      type: derived\nstatus: test\ndescription: |\n    Detects execution of commands via the run dialog box on Windows by checking values of the \"RunMRU\" registry key.\n    This technique was seen being abused by threat actors to deceive users into pasting and executing malicious commands, often disguised as CAPTCHA verification steps.\nreferences:\n    - https://medium.com/@ahmed.moh.farou2/fake-captcha-campaign-on-arabic-pirated-movie-sites-delivers-lumma-stealer-4f203f7adabf\n    - https://medium.com/@shaherzakaria8/downloading-trojan-lumma-infostealer-through-capatcha-1f25255a0e71\n    - https://www.forensafe.com/blogs/runmrukey.html\n    - https://redcanary.com/blog/threat-intelligence/intelligence-insights-october-2024/\nauthor: Ahmed Farouk, Nasreddine Bencherchali\ndate: 2024-11-01\ntags:\n    - attack.execution\n    - attack.t1059.001\nlogsource:\n    product: windows\n    category: registry_set\ndetection:\n    selection_key:\n        TargetObject|contains: '\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU'\n    selection_powershell_command:\n        Details|contains:\n            - 'powershell'\n            - 'pwsh'\n    selection_powershell_susp_keywords:\n        Details|contains:\n            - ' -e '\n            - ' -ec '\n            - ' -en '\n            - ' -enc '\n            - ' -enco'\n            - 'ftp'\n            - 'Hidden'\n            - 'http'\n            - 'iex'\n            - 'Invoke-'\n    selection_wmic_command:\n        Details|contains: 'wmic'\n    selection_wmic_susp_keywords:\n        Details|contains:\n            - 'shadowcopy'\n            - 'process call create'\n    condition: selection_key and (all of selection_powershell_* or all of selection_wmic_*)\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059.001","id":"T1059.001","name":"PowerShell","page":"techniques/enterprise/T1059.001/"}],"data_path":"data/detection-rules/a7df0e9e-91a5-459a-a003-4cde67c2ff5d.json","kind":"sigma"}