NtDeleteKey

Prototype

NTSTATUS NtDeleteKey(
  HANDLE KeyHandle
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 DC 00 00 00      mov eax, 0xDC
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

Single-argument syscall, but with a subtle semantic: the key is *marked* for deletion and is actually removed only when the handle is closed — concurrent readers retain access until they release their own handles. The key must be **leaf** (no subkeys) or the call returns `STATUS_CANNOT_DELETE`; defense-evasion tooling that wipes a tree must recurse depth-first, calling `NtEnumerateKey` and `NtDeleteKey` from the bottom up. SSN drifts substantially across builds (0xC5 on 1507 → 0xDC on 24H2), so dynamic resolution is mandatory.

Common malware usage

Pure **defense evasion (T1112 + T1070)**. Two recurring patterns. (1) **Persistence cleanup post-execution**: once an implant has staged its payload or no longer needs the autorun, it removes its own Run / RunOnce / Image File Execution Options / scheduled-task-cache registry footprint to break forensic reconstruction. Self-destruct stubs typically issue `NtDeleteKey` on `\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\Run\<implant>` and on the COM CLSID hijack key they planted earlier. (2) **Indirect Event Log tampering (T1070.001)**: while the canonical attack is `wevtutil cl` or service-stop on EventLog, several stealers (LummaC2 variants, Atomic Stealer's Win port) instead null the audit subscription keys under `\Registry\Machine\System\CurrentControlSet\Services\EventLog\Security\Channels\*` via NtDeleteKey, breaking subsequent logging without raising the audible Event-ID 1102 (audit log cleared).

Detection opportunities

Microsoft-Windows-Kernel-Registry ETW emits a registry-delete event with full path and PID. Sysmon Event ID 12 with type=DeleteKey is the direct catch. Critically, an EDR registering `CmRegisterCallbackEx` receives `RegNtPreDeleteKey` and `RegNtPostDeleteKey` notifications even when user-mode hooks are bypassed by a direct syscall — kernel callbacks see the operation post-dispatch. High-value hunts: deletion of any path under `\Microsoft\Windows\CurrentVersion\Run*`, `\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\*`, `\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\*`, or `\Services\EventLog\*`. Defender's tamper-protection list flags writes/deletes against AV-relevant registry trees; correlation with the original CreateKey/SetValue from the same SHA-256 image hash provides an end-to-end staging-then-cleanup graph.

Direct syscall examples

// Open the value's parent key with DELETE access, then NtDeleteKey on the leaf.
UNICODE_STRING name;
RtlInitUnicodeString(&name,
    L"\\Registry\\Machine\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Updater");

OBJECT_ATTRIBUTES oa;
InitializeObjectAttributes(&oa, &name, OBJ_CASE_INSENSITIVE, NULL, NULL);

HANDLE hKey = NULL;
if (NT_SUCCESS(NtOpenKey(&hKey, DELETE, &oa))) {
    NtDeleteKey(hKey);     // marks for deletion
    NtClose(hKey);          // actually deletes
}

; SSN drifts heavily; resolve dynamically before targeting multiple builds.
NtDeleteKey PROC
    mov  r10, rcx
    mov  eax, 0DCh         ; Win11 24H2
    syscall
    ret
NtDeleteKey ENDP

use ntapi::ntregapi::{NtDeleteKey, NtEnumerateKey, NtOpenKey, KEY_BASIC_INFORMATION};
use winapi::shared::ntdef::HANDLE;

pub unsafe fn delete_tree(h_root: HANDLE) {
    let mut buf = vec![0u8; 0x400];
    let mut len = 0u32;
    loop {
        let s = NtEnumerateKey(
            h_root, 0,
            0 /* KeyBasicInformation */,
            buf.as_mut_ptr() as *mut _, buf.len() as u32, &mut len);
        if s != 0 { break; }
        let bi = &*(buf.as_ptr() as *const KEY_BASIC_INFORMATION);
        // open subkey here, recurse, then delete the leaf
    }
    NtDeleteKey(h_root);
}

MITRE ATT&CK mappings

• T1112Modify Registrymitre ↗
• T1070.001Indicator Removal: Clear Windows Event Logsmitre ↗
• T1070.009Indicator Removal: Clear Persistencemitre ↗
• T1106Native APImitre ↗