Listen to this Post
Introduction:
A novel persistence technique dubbed “Swarmer” challenges the core assumptions of modern Endpoint Detection and Response (EDR) solutions. By exploiting the legacy Windows Offline Registry API and mandatory user profiles, attackers can achieve stealthy, file-based persistence that bypasses the runtime API hooks and Event Tracing for Windows (ETW) telemetry that most security tools rely on. This method underscores a critical gap in behavioral monitoring, shifting the battlefield from live system interactions to offline registry hive manipulation.
Learning Objectives:
- Understand how Swarmer abuses mandatory user profiles and the Offreg.dll API to evade detection.
- Learn to identify forensic artifacts and behavioral anomalies indicative of this technique.
- Implement proactive hunting queries and security controls to mitigate the risk of offline registry attacks.
You Should Know:
- The Core Evasion: Offline Registry API vs. Live Monitoring
Step‑by‑step guide explaining what this does and how to use it.
Traditional persistence via registry Run keys uses standard Windows API calls likeRegSetValueEx. These calls are heavily instrumented by EDR through user-mode hooks and kernel callbacks. Swarmer bypasses this by using `Offreg.dll` (Microsoft’s Offline Registry Library) to directly modify the `NTUSER.DAT` hive file of a mandatory user profile (.MAN) while it is not loaded by the system.
How it Works:
- Locate Profile: Identify or create a mandatory user profile. These are read-only roaming profiles where the hive is named
NTUSER.MAN. - Offline Modification: Use `Offreg.dll` functions to load the hive file from disk as a foreign hive into the registry of the attacker’s current session.
In Practice (Attacker POV): This can be done programmatically via Swarmer’s tool or through PowerShell leveraging the `Microsoft.Win32.RegistryKey` class with the `LoadSubKey` method from a hive file.
Example PowerShell to load a hive (simulated action):
This illustrates the concept; actual Swarmer uses Offreg.dll directly. reg load HKU\TempHive C:\Users\TargetUser\NTUSER.MAN New-ItemProperty -Path "Registry::HKEY_USERS\TempHive\Software\Microsoft\Windows\CurrentVersion\Run" -Name "Backdoor" -Value "C:\malware.exe" -PropertyType String reg unload HKU\TempHive
3. Persistence Planting: Modify the offline hive’s `Run` or other auto-start extension point keys to point to the payload.
4. Activation: The persistence triggers when the user logs in, as Windows loads the modified `NTUSER.MAN` hive. The execution chain originates from a legitimately loaded user registry, bypassing alerts on registry write APIs.
2. Forensic Footprint: Hunting for NTUSER.MAN Anomalies
Step‑by‑step guide explaining what this does and how to use it.
While stealthy, the technique leaves file system and registry artifacts that defenders can hunt for.
Detection Steps:
- Identify Unexpected .MAN Files: Mandatory profiles are relatively rare. Hunt for `NTUSER.MAN` files outside of standard profile directories or in profiles that shouldn’t be mandatory.
Hunt Query (Splunk/Sentinel): `File creation events where FileName ends with “NTUSER.MAN” and FilePath not in (“\\Users\\Default\\”, “\\Windows\\ServiceProfiles\\”)`
2. Monitor for Offreg.dll Loads: The loading of `Offreg.dll` by processes other than system utilities (like `reg.exe` loaded in a specific context) is suspicious.
Sysmon Event (EventID 7 – Image loaded): Look for `ImageLoaded` containing `offreg.dll` where `Image` is not a known administrative tool.
PowerShell Command to list loaded modules (for spot checks):Get-Process | ForEach-Object { $proc=$_; $<em>.Modules | Where-Object {$</em>.ModuleName -like "offreg"} | Select-Object @{N='Process';E={$proc.Name}}, ModuleName, FileName } - Baselining Login Events: Correlate user login events (Windows Event ID 4624) with subsequent unexpected child process executions from registry run keys.
3. Exploitation Prerequisites: Gaining Access and Privileges
Step‑by‑step guide explaining what this does and how to use it.
Swarmer requires specific pre-conditions, highlighting the importance of basic hardening.
Attack Chain Analysis:
- Initial Foothold: Requires user-level code execution (e.g., phishing, exploited service).
- Profile Manipulation: The attacker needs write access to a user’s profile directory to modify or replace the
NTUSER.DAT/NTUSER.MANfile. This often means compromising that specific user or an account with appropriate privileges (like local admin) to change profile type. - Making a Profile Mandatory: An attacker may convert a profile to mandatory by renaming `NTUSER.DAT` to `NTUSER.MAN` and setting the `RefCount` and `State` values in the profile’s `SOFTWARE` and `SYSTEM` hives to ensure it’s loaded correctly. This requires deeper system access.
Mitigating Step (Defender): Restrict user permissions to profile directories. Implement User Account Control (UAC) strictly to prevent unauthorized profile type changes.
4. Blue Team Hardening: Mitigating the Technique
Step‑by‑step guide explaining what this does and how to use it.
Proactive defense can render this technique ineffective or easily detectable.
Hardening Steps:
- Restrict Offreg.dll Usage: Apply application control policies (AppLocker or Windows Defender Application Control) to deny the loading of `Offreg.dll` by non-authorized, unsigned applications.
- Audit Mandatory Profiles: Inventory and tightly control the use of mandatory profiles. Document their business purpose and location.
- Enable Advanced Auditing: Audit detailed file access on known mandatory profile directories.
Group Policy: `Computer Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Object Access` > “Audit File System” (Configure Success/Failure). - Implement FIM: File Integrity Monitoring (FIM) on `NTUSER.MAN` files can alert on unauthorized modifications.
5. Detection Engineering: Building Custom SIEM Rules
Step‑by‑step guide explaining what this does and how to use it.
Move beyond generic alerts to specific correlation rules.
Rule Development Logic:
- Rule Concept: “Suspicious Offline Registry Modification Leading to Persistence.”
- Data Sources: Sysmon (Module load, File create/modify), Windows Security Events (Logon, Process creation).
3. Pseudo-Correlation Rule:
WHEN (EventID=7 AND ImageLoaded CONTAINS "offreg.dll" AND ProcessImage NOT IN ("C:\Windows\\reg.exe", "...allowed_list"))
WITHIN 300 SECONDS OF
(EventID=11 OR 2 AND TargetFilename ENDS WITH "NTUSER.MAN")
FOLLOWED BY
(EventID=4624 AND LogonType IN (2,7,10) AND NewProcessName="cmd.exe" OR "powershell.exe" FROM Registry Run Key)
THEN Alert(Priority: High, "Potential Swarmer-like Persistence Activity")
What Undercode Say:
- EDR’s Blind Spot: This technique is a stark reminder that EDR is not infallible. Security tools that rely solely on intercepting live Windows API calls can be bypassed by operations performed directly on the underlying files and data structures. Defense must encompass file integrity, behavioral anomalies, and a deep understanding of OS internals.
- Persistence Evolution: Attackers are moving “lower and slower.” By operating at the file level and leveraging legacy, trusted system mechanisms, they extend dwell time. This mandates that blue teams expand their threat models to include offline data manipulation and focus on pre-execution forensic artifacts as much as runtime behavior.
Prediction:
The disclosure of Swarmer will catalyze a short-term surge in similar offensive research targeting other offline Windows structures, such as directly patching binary files on disk or manipulating hibernation/ page files. In response, leading EDR platforms will rapidly integrate lower-level drivers to monitor raw file system operations on critical system files and registry hives, moving closer to legacy File Integrity Monitoring (FIM) capabilities. This will accelerate the convergence of EDR and next-generation antivirus (NGAV) with traditional configuration and integrity management tools, creating a more holistic but complex defense platform. The arms race will increasingly shift to the integrity of the EDR agent itself, prompting a new focus on kernel-level self-protection and hardware-based root of trust for security software.
▶️ Related Video (82% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Mouhammad El – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
