Potential mandatory profile registry persistence

Identifies suspicious creation of the NTUSER.MAN file within user profile directories, a lesser-known persistence technique that abuses mandatory user profiles. By planting a crafted NTUSER.MAN, an attacker can force Windows to load attacker-controlled registry settings at every logon, achieving durable boot or logon persistence.

Back to all rules