NtDeleteValueKey

Prototype

NTSTATUS NtDeleteValueKey(
  HANDLE          KeyHandle,
  PUNICODE_STRING ValueName
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 DF 00 00 00      mov eax, 0xDF
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

Removes a single value cell from the parent key's value list. The kernel deletes the corresponding CM_KEY_VALUE and frees the value's data cell — there is no soft-delete or recycle. Returns STATUS_OBJECT_NAME_NOT_FOUND if no value with the name exists, which means probing for a value's presence by trying to delete it is *not* safe (it really deletes). The Win32 wrapper RegDeleteValueW is a thin shim.

Common malware usage

Anti-forensics and *selective* persistence cleanup. Where an operator's Run value sits next to ten legitimate Run values, deleting the whole `Run` key would be obvious; NtDeleteValueKey lets the implant remove only its own value during graceful uninstall or when an EDR detection has fired and the operator wants to limit the trail. Also used to revert configuration tampering — e.g. delete a persistence value just before the SOC analyst's triage script runs and re-create it afterwards from a memory-resident copy.

Detection opportunities

High-fidelity when the target is a *known persistence path*: Sysmon Event 12 (RegistryEvent DeleteValue) on `HKLM\Software\Microsoft\Windows\CurrentVersion\Run\*`, `RunOnce`, `Image File Execution Options`, or any `HKLM\SYSTEM\CurrentControlSet\Services\<X>\ImagePath` is anomalous outside of Group Policy / SCCM contexts. ETW Microsoft-Windows-Kernel-Registry emits DeleteValue with both the parent key path and the value name. EDRs hook CmRegisterCallbackEx → RegNtPreDeleteValueKey for cheap visibility. A delete-then-recreate pair (Event 12 followed by Event 13 with the same value name) within seconds is a near-canonical persistence-cleanup pattern.

Direct syscall examples

// Delete only our value, leaving the host's other Run entries untouched.
UNICODE_STRING valueName;
RtlInitUnicodeString(&valueName, L"OneDriveUpdate");
NTSTATUS st = NtDeleteValueKey(hRunKey, &valueName);
if (st == STATUS_OBJECT_NAME_NOT_FOUND) {
    // Already gone; nothing to clean.
}

NtDeleteValueKey PROC
    mov  r10, rcx
    mov  eax, 0DFh
    syscall
    ret
NtDeleteValueKey ENDP

// Cargo: ntapi = "0.4", widestring = "1"
fn cleanup_persistence(h_run_key: HANDLE) {
    for name in ["OneDriveUpdate", "WinStoreHelper"] {
        let w = U16CString::from_str(name).unwrap();
        let mut us = UNICODE_STRING {
            Length: (w.len() * 2) as u16,
            MaximumLength: ((w.len() + 1) * 2) as u16,
            Buffer: w.as_ptr() as _,
        };
        unsafe { NtDeleteValueKey(h_run_key, &mut us); }
    }
}

MITRE ATT&CK mappings

• T1112Modify Registrymitre ↗
• T1070.009Indicator Removal: Clear Persistencemitre ↗
• T1547.001Boot or Logon Autostart Execution: Registry Run Keys / Startup Foldermitre ↗