Windows has a lesser-known feature where an ntuser.man file can completely override a user's registry (ntuser.dat) without triggering standard security callbacks. This mandatory profile mechanism, originally designed for kiosks, can be exploited for persistence by attackers who have initial access to a system. The technique involves exporting the user's registry hive to plain text, adding malicious persistence entries (like auto-run keys), converting it back to binary format using tools like HiveSwarming, and placing it in the user profile directory. When the user logs back in, Windows loads the malicious registry instead of the legitimate one, executing the attacker's payload while bypassing EDR detection mechanisms that monitor registry API calls. The video demonstrates the complete attack chain using Sliver C2 framework and discusses detection strategies, noting that this technique has been known since at least 2010 but remains relatively obscure.
Sort: