Leviathan APT Registry Run Key Persistence

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•38

This rule detects the creation or modification of a specific registry run key used by the Leviathan APT group for persistence. The key path observed is '\Software\Microsoft\Windows\CurrentVersion\Run\ntkd'. This indicates that a program named 'ntkd' is configured to execute automatically when a user logs in, a common technique for maintaining access to a compromised system.