Windows Registry Key Activity for Run\ntkd Persistence Path

title: Windows Registry Key Activity for Run\ntkd Persistence Path
id: eada55de-2acc-47fb-b840-bd6ee31f6c7d
status: test
description: This rule alerts on registry events targeting the Run key path containing the specific value segment "\Software\Microsoft\Windows\CurrentVersion\Run\ntkd" on Windows. Monitoring this matters because Run-key persistence is a common technique used to launch code automatically during user logon. It relies on registry event telemetry that includes the targeted registry object/path (TargetObject) for matching this substring.
references:
  - https://www.elastic.co/blog/advanced-techniques-used-in-malaysian-focused-apt-campaign
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2020/TA/Leviathan/registry_event_apt_leviathan.yml
author: Aidan Bracher, Huntrule Team
date: 2020-07-07
modified: 2023-09-19
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1547.001
  - detection.emerging-threats
logsource:
  category: registry_event
  product: windows
detection:
  selection:
    TargetObject|contains: \Software\Microsoft\Windows\CurrentVersion\Run\ntkd
  condition: selection
level: critical
license: DRL-1.1
related:
  - id: 70d43542-cd2d-483c-8f30-f16b436fd7db
    type: derived