Windows Content Copied from Browser was Executed — Detection Rule
The following analytic correlates modifications to the Windows RunMRU registry key with clipboard content changes initiated by browsers. It aims to detect ClickFix scenarios in which commands copied from a browser are subsequently executed on the Windows system through the Run dialog box.