Potentially Suspicious Command Executed Via Run Dialog Box - Registry

Title: Potentially Suspicious Command Executed Via Run Dialog Box - Registry
Status: test
Description:Detects execution of commands via the run dialog box on Windows by checking values of the "RunMRU" registry key. This technique was seen being abused by threat actors to deceive users into pasting and executing malicious commands, often disguised as CAPTCHA verification steps.
References:
  -https://medium.com/@ahmed.moh.farou2/fake-captcha-campaign-on-arabic-pirated-movie-sites-delivers-lumma-stealer-4f203f7adabf
  -https://medium.com/@shaherzakaria8/downloading-trojan-lumma-infostealer-through-capatcha-1f25255a0e71
  -https://www.forensafe.com/blogs/runmrukey.html
  -https://redcanary.com/blog/threat-intelligence/intelligence-insights-october-2024/
Author: Ahmed Farouk, Nasreddine Bencherchali
Date: 2024-11-01
modified:None
Tags:

• -'attack.execution'
• -'attack.t1059.001'

Logsource:

• product: windows
• category: registry_set

Detection:
  selection_key:
    TargetObject|contains: '\Microsoft\Windows\CurrentVersion\Explorer\RunMRU'
  selection_powershell_command:
    Details|contains:
      -'powershell'
      -'pwsh'

  selection_powershell_susp_keywords:
    Details|contains:
      -' -e '
      -' -ec '
      -' -en '
      -' -enc '
      -' -enco'
      -'ftp'
      -'Hidden'
      -'http'
      -'iex'
      -'Invoke-'

  selection_wmic_command:
    Details|contains: 'wmic'
  selection_wmic_susp_keywords:
    Details|contains:
      -'shadowcopy'
      -'process call create'

  condition:selection_key and (all of selection_powershell_* or all of selection_wmic_*)
Falsepositives:
  -Unknown
Level: high