Corrupting the Hive Mind: Persistence Through Forgotten Windows Internals

Dropping a link to our blog post about our tool Swarmer, a windows persistence tool for abusing mandatory user profiles. Essentially you copy the current user’s registry hive and modify it to add a new registry key to run on startup. Because the new hive isn’t loaded until the next time the user logs in, EDR never sees any actual registry writes.

submitted by /u/bouncyhat
[link] [comments]

January 28, 2026
Read More >>