REGISTRY WRITES WITHOUT REGISTRY CALLBACKS

Summary from the TLDR InfoSec newsletter

Windows supports mandatory user profiles using an NTUSER.MAN hive file, which, when present in a user's profile, completely replaces the normal NTUSER.DAT hive for HKEY_CURRENT_USER during logon. By crafting and dropping a modified NTUSER.MAN that includes persistence keys, an attacker can ensure those keys are loaded into the user's registry hive without using standard registry APIs, thereby sidestepping EDR products that rely on CmRegisterCallbackEx telemetry. This technique only requires medium-integrity access, works well with roaming or AD-based mandatory profiles, and is primarily detectable through filesystem events and unusual .MAN files or profilePath changes rather than registry logs.