Potential mandatory profile registry persistence
Identifies suspicious creation of the NTUSER.MAN file within user profile directories, a lesser-known persistence technique that abuses mandatory user profiles. By planting a crafted NTUSER.MAN, an attacker can force Windows to load attacker-controlled registry settings at every logon, achieving durable boot or logon persistence.
- Platform: Windows
- Severity: High
- MITRE Tactic: Persistence
- MITRE Techniques: T1547, T1547.001