Mandatory User Profile Persistence

Summary

Threat actors can establish persistence on Windows endpoints by abusing Mandatory User Profiles. By creating or replacing an NTUSER.MAN file inside a user profile directory, malicious registry changes are loaded into the registry hive during logon without relying on standard registry APIs. This technique enables stealthy execution of commands or binaries whenever the user signs in.

Investigation

The report describes a proof-of-concept technique that manipulates the Windows registry hive to create a mandatory user profile. It shows how tools such as Swarmer and HiveSwarming can convert exported registry data into the .MAN format, allowing attackers to bypass EDR monitoring focused on registry API activity.

Mitigation

Organizations should monitor for creation or modification of NTUSER.MAN files within user profile directories, particularly where mandatory profiles are not normally used. Strong file system telemetry combined with correlation of Windows User Profile Service events can help detect this persistence technique.

Response

If an NTUSER.MAN file is created unexpectedly or suspicious Offreg.dll loading is observed, investigators should examine the associated user profile for unauthorized registry changes. Correlate Sysmon Event ID 11 for file creation with Windows User Profile Service Event IDs 5 and 67 to verify that a mandatory profile was loaded.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary intends to maintain persistence across user logons. Instead of modifying the current registry, which might be monitored by EDR, the attacker creates a “Mandatory Profile” by dropping an NTUSER.MAN file into the user’s profile directory. During the next login, Windows uses this file to construct the user’s registry hive. This method is stealthy because the “malicious” registry configuration is technically part of the profile initialization process rather than a standard registry modification event. The simulation will create a dummy NTUSER.MAN file in a subfolder of the user profile to trigger the endswith: 'NTUSER.MAN' and contains: 'Users' logic.

• Regression Test Script:

  # Simulation of NTUSER.MAN creation for persistence testing
  $targetDir = Join-Path $env:USERPROFILE "AppDataLocalTempSimulatedProfile"
  
  # Create directory if it doesn't exist
  if (!(Test-Path $targetDir)) {
      New-Item -Path $targetDir -ItemType Directory -Force
  }
  
  # Create the NTUSER.MAN file to trigger the detection rule
  $filePath = Join-Path $targetDir "NTUSER.MAN"
  Set-Content -Path $filePath -Value "Simulated Mandatory Profile Content"
  
  Write-Host "[+] Simulation complete. File created at: $filePath" -ForegroundColor Green

• Cleanup Commands:

  # Cleanup simulation artifacts
  $targetDir = Join-Path $env:USERPROFILE "AppDataLocalTempSimulatedProfile"
  if (Test-Path $targetDir) {
      Remove-Item -Path $targetDir -Recurse -Force
      Write-Host "[+] Cleanup successful. Artifacts removed." -ForegroundColor Yellow
  } else {
      Write-Host "[-] Cleanup failed: Directory not found." -ForegroundColor Red
  }