Detects suspicious commands written to the Windows Run dialog history (RunMRU) by explorer.exe, indicative of paste-and-run social engineering campaigns like ClickFix. The rule targets registry changes under RunMRU (excluding MRULIST), where registry.data.strings records the pasted command. It cases registry strings to lowercase and flags patterns indicative of command-and-scripting activity (PowerShell or pwsh usage with flags such as -e, -ec, -irem, IEX, Invoke-WebRequest/Invoke-Expression, and other LOtL patterns). It also flags commands that invoke system binaries (mshta, msiexec, rundll32, cmd) with HTTP/https fetches, base64 decoding, or common download and execution chains (curl, wget, certutil, bitsadmin, etc.). The alert correlates the RunMRU entry to a child process of explorer.exe and then inspects the child’s descendants, files created, and destinations touched to determine if payloads are retrieved, scripts written, or network connections established. It additionally considers user/host context to assess paste-and-run risk. The rule maps to MITRE techniques such as T1059 (Command and Scripting Interpreter - PowerShell and Windows Command Shell), T1218 (System Binary Proxy Execution - Mshta, Msiexec, Rundll32), T1105 (Ingress Tool Transfer), and T1204.004 (Malicious Copy and Paste) under Execution, Defense Evasion, and some C2 contexts. Severity is high with a risk_score of 73. Supported data sources include registry events, Windows process activity, and related network/file telemetry from Elastic Defend, Sysmon, M365 Defender, SentinelOne, and CrowdStrike. Triage should verify the exact RunMRU string, confirm the existence of a matching child, and trace subsequent actions (payload download, script creation, and destinations) before containment or remediation. Provisions for false positives include distinguishing legitimate admin or red-team exercises from real paste-and-run activity and requiring consistent RunMRU strings, user/host context, and child process fidelity across alerts.