huntrule

Windows Registry Run Key Modification for ntkd Persistence

Flags Windows registry activity hitting the Run key path segment "\Run\ntkd" used for automatic startup persistence.

FreeReviewedSigma · Critical · v5
Product
windows
Category
registry_event
Author
Aidan Bracher (SigmaHQ), DRL 1.1
Published
2020-07-07
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Persistence → Priv Esc

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies Windows registry activity targeting the Run key entry containing 'ntkd' under the CurrentVersion\Run path. Attackers commonly use Run key modifications to establish persistence that launches automatically at user logon. The detection relies on registry event telemetry that includes the TargetObject field from Windows registry event logs.

Reporting behind it

Related detections9 linkedT1547.001 — drag to rearrange
Malicious Run Key Persistence Referencing DLL in User Documents
PlugX Persistence via Run Key Named AAM Updatevlm
Suspicious Autorun Registry Persistence via sausageLoop Run Key
Malicious BabyLockerKZ Run Key Persistence
Suspicious Run Key Persistence Pointing To User-Writable Path
Malicious Ctrlpanel Run Key Autostart Persistence (via registry_set)
Persistence Run Key Pointing to svchost.exe in AppData Roaming
URL Shortcut File Created in Startup Folder for Persistence
Suspicious Run Key Persistence via UpdateCheck Value in Operation TrueChaos
Windows Registry Run Key Modification for ntkd Persistence
Pivot detection · T1547.001 · 9 related

Changelog

v5
  1. v5
    Candidate ingested via manual entry.2026-07-31
  2. v4
    Candidate ingested via manual entry.2026-07-31
  3. v3
    Candidate ingested via manual entry.2026-07-31
  4. v2
    Candidate ingested via manual entry.2026-07-31
  5. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.