redcanaryco / atomic-red-team

Small and highly portable detection tests based on MITRE's ATT&CK.
MIT License
9.79k stars 2.8k forks source link

RunMRU Atomic Test #2981

Closed MHaggis closed 2 days ago

MHaggis commented 4 days ago

New Atomic for RunMRU - related to Lumma Stealer. Tested against Win11 and Server 2022. Thanks to @nasbench for the help on this!

image

In the reg:

image

patel-bhavin commented 2 days ago

nice atomic: @nasbench and @MHaggis !