Swarmer Tool Abuses Windows Registry to Evade Detection and Persist on Systems

Swarmer is an advanced tool engineered to manipulate Windows registry hives while evading detection by endpoint security systems.

This tool leverages legacy Windows infrastructure to sustain persistent access without alerting traditional Endpoint Detection and Response (EDR) systems, which typically flag direct registry modifications.

EDR solutions have improved defenses against conventional registry persistence methods. Techniques using HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run entries now prompt immediate alerts, as security tools monitor standard registry APIs, including RegCreateKey, RegSetValue, and RegSetValueEx. This presents challenges for adversaries aiming for stealthy registry-based persistence without direct API interaction.

Mandatory User Profiles as Attack Vector

The Swarmer technique exploits Windows' mandatory user profile functionality, a legacy feature for enforcing standardized user configurations. Administrators deploy these profiles using NTUSER.MAN files, which override standard NTUSER.DAT registry hives at login.

Feature Description

Registry Hive Export Accepts exported HKCU registry data in .reg text format

Offline Registry Modification Uses Offreg.dll to edit binary registry hives without standard API interaction

Startup Key Injection -startup-key parameter to inject startup entries directly into the registry

Startup Value Configuration -startup-value parameter specifies executable path for persistence payload

NTUSER.MAN Generation Converts modified registry data to binary NTUSER.MAN mandatory user profile

BOF Direct Integration -bof flag parses TrustedSec reg_query BOF output directly

Offline Processing Runs offline on operator machine before deployment

C# Implementation Built as a standalone executable or PowerShell module (.dll)

Windows API Interop P/Invoke integration with Windows registry APIs

Hive Validation Uses RegLoadAppKeyW to create a legitimate initial hive structure

Unprivileged users can place a crafted NTUSER.MAN file in their profile directory to trigger the override mechanism, replacing their entire HKCU registry hive without administrator privileges.

The tool utilizes the Offline Registry Library (Offreg.dll), a legacy Windows component for setup, backup, and forensic analysis. This library provides functions such as ORCreateHive, OROpenHive, ORCreateKey, ORSetValue, and ORSaveHive, enabling complete registry hive construction without EDR monitoring. Process Monitor and ETW logging remain unaffected, making the technique virtually undetectable by standard mechanisms.

The tool follows a three-step workflow: first, export the target user's HKCU registry using standard commands or TrustedSec's reg_query BOF; second, modify the exported registry data to inject persistence mechanisms; third, use Swarmer to convert the modified export into a binary hive file.

The command structure supports both standalone execution and C2 integration through BOF output parsing, enabling operators to avoid disk contact with registry exports during engagements.

Defenders should monitor for unexpected NTUSER.MAN file creation in user profile directories, especially when not originating from enterprise profile management systems. Behavioral analysis may flag Offreg.dll loading by processes lacking legitimate offline registry access requirements. However, once persistence executes at login, resulting malicious activity becomes visible through standard process monitoring.

Swarmer demonstrates how Windows' legacy functionality can be repurposed for offensive operations. Administrators should inventory mandatory profile implementations and enforce stringent controls over profile directory access.

Based on reporting by GBHackers.