RunMRU

RunMRU is the Windows Registry location that records commands entered into the Run dialog. It stores the exact pasted payload and the order of recent entries, making it one of the most valuable artifacts for reconstructing ClickFix activity and separating successful execution from unrelated noise.

Expanded Definition

RunMRU is a per-user Windows Registry artifact that captures the history of entries submitted through the Run dialog, preserving both the command text and the sequence in which it was used. For incident response, that makes it more than a convenience feature: it is a timeline source that can reveal whether a payload was typed, pasted, retried, or followed by subsequent execution attempts. In ClickFix investigations, RunMRU often helps distinguish a user who merely opened a dialog from one who actually executed a malicious command. It also assists analysts when related artifacts such as prefetch, shell history, or process creation logs are incomplete.

Its value depends on context. RunMRU does not prove maliciousness on its own, and it does not always reflect every execution path on a system. Definitions in the industry are stable, but operational usage varies because some teams overread it as execution evidence rather than command-entry evidence. NIST Cybersecurity Framework 2.0 helps frame this type of artifact as part of broader detection and response evidence handling, especially when correlating endpoint data across sources. The most common misapplication is treating RunMRU as proof of process execution, which occurs when analysts ignore whether the recorded string was actually launched or merely entered.

Examples and Use Cases

Using RunMRU rigorously often introduces triage overhead, requiring analysts to correlate registry evidence with process telemetry, user activity, and host artifacts before drawing conclusions.

• Confirming ClickFix activity by matching a copied command in RunMRU with a later PowerShell or cmd.exe launch.
• Identifying persistence or staging behavior when a user repeatedly enters the same encoded command over a short period.
• Separating harmless administrative shortcuts from suspicious payloads by comparing RunMRU entries with known change windows and ticket data.
• Reconstructing a user’s actions on a host where event logs were cleared, partially retained, or never fully collected.
• Supporting incident scoping by showing which commands were attempted before an alert fired, even if execution failed.

For deeper Windows attack-path context, analysts can pair RunMRU review with guidance from the NIST Cybersecurity Framework 2.0, especially where detection data must be validated against multiple evidence sources. The artifact is especially useful when the question is not just “what ran,” but “what did the user try to run, and in what order?”

Why It Matters for Security Teams

RunMRU matters because it sits at the intersection of user action, endpoint telemetry, and post-compromise reconstruction. Security teams that ignore it can miss the earliest visible sign of social engineering campaigns that rely on a user pasting a command into the Run dialog. It is also valuable in identity-adjacent investigations, because the artifact can show which account context was active when a suspicious command was entered, helping teams separate interactive misuse from automated activity. In NHI-adjacent environments, that distinction becomes important when an attacker chains a human session into broader access to services, scripts, or secrets.

Used properly, RunMRU strengthens detection validation, containment decisions, and root-cause analysis. Used badly, it can create false certainty, especially when teams assume that a command seen in the registry necessarily executed successfully. The operational lesson is straightforward: RunMRU should be treated as corroborating evidence, not as a stand-alone verdict. Organisations typically encounter its full significance only after a phishing or ClickFix event has already reached the endpoint, at which point RunMRU becomes operationally unavoidable to address.