Potential mandatory profile registry persistence
Identifies suspicious creation of the NTUSER.MAN file within user profile directories, a lesser-known persistence technique that abuses mandatory user profiles. By planting a crafted NTUSER.MAN, an attacker can force Windows to load attacker-controlled registry settings at every logon, achieving durable boot or logon persistence.
- Plataforma: Windows
- Severidad: High
- Táctica MITRE: Persistencia
- Técnicas MITRE: T1547, T1547.001