Potentially Suspicious Command Executed Via Run Dialog Box - Registry (a7df0e9e-91a5-459a-a003-4cde67c2ff5d)
Detects execution of commands via the run dialog box on Windows by checking values of the "RunMRU" registry key. This technique was seen being abused by threat actors to deceive users into pasting and executing malicious commands, often disguised as CAPTCHA verification steps.