Add ClickFix Run dialog command detection

[slapopotamus]

Summary

• Adds a Falcon CQL detection for suspicious commands entered through the Windows Run dialog and recorded in RunMRU.
• Requires both an interpreter or commonly abused system utility and an indicator associated with remote retrieval, encoded content, or hidden execution.
• Includes telemetry requirements, false-positive guidance, tuning advice, and detection limitations.

MITRE ATT&CK

• T1204
• T1189
• T1059.003

Validation

• Tested in a Falcon environment.
• YAML structure checked against the repository validation rules.
• Confirmed that the change contains one new query file.

Limitations

• A RunMRU match shows that a command was entered through the Run dialog; it does not prove successful execution.
• Variants that direct users to a terminal without using the Run dialog are not detected.
• Legitimate administrative one-liners may require environment-specific tuning.

[dweissbacher]

Thanks for contributing! 🙌