RunMRU

Location & availability

NTUSER.DAT: Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU

Depends on use of the Run dialog, policy and retained profile state.

Fields to examine

• Command strings in individual values.
• MRUList ordering.
• Key LastWrite, which is not a timestamp for every stored command.

What it can establish

• Support that the Run dialog retained a particular command string.

What it cannot prove

• Prove that the command succeeded or executed during a particular match.
• Represent PowerShell, terminal and service history as one complete record.

Use it in a screenshare

1. Acquire the user hive rather than opening the Run dialog and submitting commands during collection.
2. Record strings and MRU order without replacing variables or executing the recorded text.
3. Seek a corresponding process event, Prefetch record or resulting file change to test whether a command actually ran.

Worked example

RunMRU contains a command naming a utility. Preserve the string as an input/history observation. A parser must never execute it, and the record alone does not show a successful launch.

Cross-check the finding

• Security event 4688 →Support process creation recorded by the audited host.
• Prefetch →Support execution of an associated executable within the retained history.
• PSReadLine history →Support that particular command text was retained in the examined history file.

Sources

• RECmd — registry parser and batch definitions ↗