Windows Registry Run Key Modification for ntkd Persistence

ATT&CK techniques

Persistence → Priv Esc

Recon
Resource Dev
Initial Access
Execution
Persistence
- T1547.001Registry Run Keys / Startup Folder
Priv Esc
- T1547.001Registry Run Keys / Startup Folder
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies Windows registry activity targeting the Run key entry containing 'ntkd' under the CurrentVersion\Run path. Attackers commonly use Run key modifications to establish persistence that launches automatically at user logon. The detection relies on registry event telemetry that includes the TargetObject field from Windows registry event logs.

Reporting behind it

Related detections9 linkedT1547.001 — drag to rearrange

Malicious Run Key Persistence Referencing DLL in User Documents

PlugX Persistence via Run Key Named AAM Updatevlm

Suspicious Autorun Registry Persistence via sausageLoop Run Key

Malicious BabyLockerKZ Run Key Persistence

Suspicious Run Key Persistence Pointing To User-Writable Path

Malicious Ctrlpanel Run Key Autostart Persistence (via registry_set)

Persistence Run Key Pointing to svchost.exe in AppData Roaming

URL Shortcut File Created in Startup Folder for Persistence

Suspicious Run Key Persistence via UpdateCheck Value in Operation TrueChaos

Windows Registry Run Key Modification for ntkd Persistence

Pivot detection · T1547.001 · 9 related

Changelog

v5

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-registry-key-activity-for-run-ntkd-persistence-path-70d43542

title: Windows Registry Run Key Modification for ntkd Persistence
id: eada55de-2acc-47fb-b840-bd6ee31f6c7d
status: test
description: This rule identifies Windows registry activity targeting the Run key entry containing 'ntkd' under the CurrentVersion\Run path. Attackers commonly use Run key modifications to establish persistence that launches automatically at user logon. The detection relies on registry event telemetry that includes the TargetObject field from Windows registry event logs.
references:
  - https://www.elastic.co/blog/advanced-techniques-used-in-malaysian-focused-apt-campaign
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2020/TA/Leviathan/registry_event_apt_leviathan.yml
author: Aidan Bracher, Huntrule Team
date: 2020-07-07
modified: 2023-09-19
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1547.001
  - detection.emerging-threats
logsource:
  category: registry_event
  product: windows
detection:
  selection:
    TargetObject|contains: \Software\Microsoft\Windows\CurrentVersion\Run\ntkd
  condition: selection
level: critical
license: DRL-1.1
related:
  - id: 70d43542-cd2d-483c-8f30-f16b436fd7db
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL