KQL Search

# *RunMRU ClickFix Detection*

## Query Information

#### MITRE ATT&CK Technique(s)

| Technique ID | Title    | Link    |
| ---  | --- | --- |
| T1012 | Query Registry | https://attack.mitre.org/techniques/T1012/ |

#### Description
This rule detects modifications to the 'RunMRU' registry key, specifically looking for new or changed entries where the command string is unusually long (greater than 50 characters). This can indicate an attempt to persist or execute malicious code via the RunMRU list, which stores recently executed commands.

#### Author <Optional>
- **Name: Benjamin Zulliger**
- **Github: https://github.com/benscha/KQLAdvancedHunting**
- **LinkedIn: https://www.linkedin.com/in/benjamin-zulliger/**

#### References
- https://thehackernews.com/2026/02/microsoft-discloses-dns-based-clickfix.html


## Defender XDR
```KQL
// ClickFix: Discovery of RunMRU Command
DeviceRegistryEvents
| where Timestamp >= ago(7d)
| where ActionType == "RegistryValueSet"
| where RegistryKey has @"Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU"
| extend RunCommand = RegistryValueData
| extend RunCommandLength = strlen(RunCommand)
| where RunCommandLength > 50
// Exclusions
| where not(RunCommand has_any ( "SAMPLE1",  "SAMPLE2"))
```