RunMRU is the Windows Registry location that records commands entered into the Run dialog. It stores the exact pasted payload and the order of recent entries, making it one of the most valuable artifacts for reconstructing ClickFix activity and separating successful execution from unrelated noise.
What RunMRU Captures in Windows Forensics
RunMRU is more than a convenience artifact. It records the exact commands a user entered into the Run dialog, which makes it useful for separating a deliberate execution path from background noise, partial attempts, or commands pasted from elsewhere.
Because the value reflects what was typed or pasted, it can preserve shell launchers, script stagers, and one-line payloads that may not appear clearly in higher-level logs. That makes it a compact reconstruction source when investigating suspicious Windows activity.
Why RunMRU Matters in ClickFix Investigations
RunMRU is especially valuable when a lure persuades a user to paste and execute a command. In that pattern, the registry key can help show the exact payload the user executed, even when the original page, clipboard content, or browser history is incomplete. NHIMG’s ClickFix and Fake CAPTCHA Paste-and-Run Attacks Guide covers the lure pattern that commonly leads to this artifact.
The artifact is also useful for distinguishing successful execution from failed or aborted attempts. If the same host shows repeated Run dialog activity, the ordering of entries can help establish what happened first and whether the user retried the command after an error or prompt.
How Analysts Use the Artifact
Analysts usually treat RunMRU as one piece of timeline evidence, not as a standalone verdict. It becomes more meaningful when compared with process creation telemetry, PowerShell logging, browser artefacts, downloads, and other Windows registry evidence that can confirm whether a pasted command actually launched a child process.
The key limitation is that it only reflects Run dialog usage. Absence of a matching entry does not prove the Run dialog was not used, and presence alone does not explain intent. The value comes from correlating the stored command with the broader execution chain.
What Makes RunMRU Operationally Useful
RunMRU is useful because it captures the user's exact input, not a summary of the event. For incident responders, that precision can reveal the original launcher, encoded command, download-and-execute pattern, or administrative utility that was invoked during a suspicious session.
It is also a preservation problem. Registry artefacts are volatile in the sense that normal user behaviour can overwrite earlier entries over time, so investigators benefit from collecting them early and preserving them alongside other endpoint evidence before the trail is lost.
Risk and Threat Considerations
Run dialog abuse is a common way to turn social engineering into execution because it bypasses many of the cues users expect from a downloaded file or obvious attachment. The artifact matters because it can expose the exact payload that was run, which helps distinguish a harmless prompt from a command that launched malware, a script stager, or a living-off-the-land tool.
Failure mechanism: A lure convinces the user to paste a command into Run, then the command launches script or shell tooling that executes immediately and leaves only partial evidence in higher-level user activity logs.
Impact: Analysts may miss the real execution path, lose the original payload, or fail to connect the user action to follow-on compromise such as downloader execution, credential theft, or persistence.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1204.004 — User Execution: Malicious File | RunMRU often preserves the user-entered launcher used in social-engineering execution chains. |
| T1059 — Command and Scripting Interpreter | RunMRU frequently stores commands that invoke shells or scripts used for execution and staging. | |
| Recommendation — Map RunMRU entries to user-execution activity and hunt for the resulting process tree. Correlate RunMRU commands with command-shell activity and script execution telemetry. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | RunMRU is a forensic artifact that strengthens endpoint audit and investigation coverage. |
| Recommendation — Collect and centralize endpoint artifacts so registry evidence is available for investigation. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | RunMRU supports analysis of user activity and reconstruction of suspicious execution events. |
| CM-6 — Configuration Settings | Windows Run dialog and registry artefacts are part of the endpoint configuration surface investigators examine. | |
| Recommendation — Review endpoint audit evidence alongside registry artifacts to reconstruct suspicious execution. Harden endpoint configuration to reduce abuse of common execution paths. | ||
Practitioner Guidance
What to watch for: Treat RunMRU as a high-value corroborating artifact when the investigation involves paste-and-run activity, suspicious shell launchers, or unexplained script execution. The best read comes from pairing it with process, PowerShell, browser, and download evidence so the stored command can be placed in sequence rather than interpreted in isolation.
Practical note: Preserve the registry hive early in the case. Because the artifact records recent entries in order, late collection can overwrite or obscure the very commands that explain how the compromise began.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 31, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org