CORRUPTING THE HIVE MIND: PERSISTENCE THROUGH FORGOTTEN WINDOWS INTERNALS

Summary from the TLDR InfoSec newsletter

Swarmer is a low‑privilege tool that quietly edits Windows user registry hives without triggering common EDR hooks on standard registry APIs. Swarmer builds offline registry hives with Offreg.dll by abusing legacy mandatory user profiles and the NTUSER.MAN mechanism, enabling per‑user persistence that survives reboots while largely evading traditional monitoring. This post walks through the workflow, implementation quirks, operational caveats, and both defensive detection opportunities and attacker takeaways around this forgotten Windows feature set.