LabubaRAT Persistence via HKCU Run Key NVIDIA Container Runtime Monitor

Kaung Khant Ko@kaungkhantko

•updated Jul 15, 2026•1•0•1

This rule detects potential persistence mechanisms used by LabubaRAT by monitoring for the creation or modification of the 'NVIDIA Container Runtime Monitor' value within the HKEY_CURRENT_USER Run registry key. It specifically looks for Registry modifications that trigger the execution of 'nvidia-sysruntime.exe' with specific command-line arguments, suggesting an attempt to masquerade as legitimate NVIDIA software for persistence.