NTUSER.MAN

Item: NTUSER.MAN
Rating: 4
Author: PostSingularity Institute

by John Hammond

Applied Sciences & Engineering Computing & Cybersecurity URComputer security URJComputer viruses, Trojans and worms

🎙 John Hammond 👥 2.2M 📅 January 15, 2026 ⏱ 29 min 👁 58K 📄 tutorial 🧭 2026-08-16

Available in: English (current) Français

Keywords

NTUSER.MANregistry persistenceWindowsred teamSliver C2

Summary

In this video, John Hammond demonstrates a Windows registry persistence technique using the NTUSER.MAN file. He explains that NTUSER.DAT stores user registry hives, but a mandatory profile file NTUSER.MAN can override it. By placing a malicious NTUSER.MAN in a user’s profile, an attacker can load their own registry hive, achieving persistence without triggering registry callbacks. The video shows a full attack chain: initial access via a Sliver C2 implant, exporting the user’s HKCU hive as a .reg file, adding a persistence key (e.g., Run key), converting it back to binary using HiveSwarming, and uploading it as NTUSER.MAN. The technique works at medium integrity and does not require admin privileges. The video also discusses the detection evasion aspect, as it only raises file system events, not registry events. The author references a blog post by DeceptIQ and mentions that the technique is already discussed on cybercrime forums. The video is a practical tutorial with a live demo, and it includes a sponsor segment for Flare.

164 words

Critical Evaluation

Value of the Information & Strength of the Argument

The video provides a clear and practical demonstration of a relatively obscure Windows persistence technique. The value lies in its hands-on approach, showing the entire process from initial access to persistence. The argumentation is solid, as the author explains the underlying mechanism (mandatory profiles) and why it evades detection. He also acknowledges limitations, such as the hive being locked while the user is logged in. The demonstration is convincing, with successful persistence achieved. The video is well-structured and educational for cybersecurity professionals.

Scientific Rigor, Source Quality, Title Accuracy

The video references a specific blog post by DeceptIQ, which is linked in the description. It also mentions tools like HiveSwarming and Sliver, with links provided. The author cites persistence-info.github.io for common persistence techniques. The title accurately reflects the content. The video is a tutorial, not a research paper, so the scientific rigor is appropriate for its purpose. The author is transparent about his initial lack of knowledge on the topic, which adds credibility. The sources are reputable within the cybersecurity community.

179 words

Title / Content Match

The title 'NTUSER.MAN' accurately reflects the core topic of the video, which is the NTUSER.MAN file and its use for registry persistence.

Quality & Reliability

8/10

The video is a practical demonstration of a known Windows registry persistence technique, referencing a specific blog post and tools. The author is a recognized cybersecurity educator. The technique is demonstrated in a controlled environment, and the video includes links to primary sources. However, the video is a tutorial and not a peer-reviewed study, and the author admits to not having known about the technique before, which may indicate a lack of deep expertise on this specific topic.

Key Moments

Markers derived by PSI from the transcript: the creator did not define chapters.

Cited Sources

DeceptIQ Blog: NTUSER.MAN Registry Persistence — Original blog post detailing the NTUSER.MAN technique.
Elastic Detection Rules - Persistence Registry Uncommon — Detection rule for uncommon registry persistence.
Microsoft Learn: Mandatory User Profile — Official documentation on mandatory user profiles.
HiveSwarming GitHub Repository — Tool used to convert .reg files to binary hive format.
Persistence Info — Reference for various Windows persistence techniques.

Concurring Sources

DeceptIQ Blog — The primary source for the technique.
Microsoft Learn: Mandatory User Profile — Confirms the existence and behavior of mandatory profiles.

External References

Contribution & Novelties

The video provides a practical, step-by-step demonstration of the NTUSER.MAN persistence technique, which is relatively obscure and not widely covered in mainstream cybersecurity content. It adds value by showing the entire attack chain, including the use of Sliver C2 and HiveSwarming, and by discussing detection evasion aspects. The author also highlights that the technique is already being discussed on cybercrime forums, indicating real-world relevance.

Pour aller plus loin :

Mandatory User Profiles - Microsoft — Official documentation on the feature that enables this attack.
Registry Persistence Techniques - MITRE ATT&CK — Overview of registry run keys persistence.
Sliver C2 Framework — Open-source C2 framework used in the demo.

108 words

Radar Profile

The radar profile shows high scores in quantity and quality of information, with a slightly lower technical level, indicating a well-balanced tutorial that is accessible yet detailed. The reliability is high due to the use of reputable sources and clear demonstration.

Reliability 8/10

💬 Très positif. Sur les 30 commentaires analysés, les spectateurs expriment une forte appréciation, saluant le retour de John Hammond et la qualité pédagogique de la vidéo, avec des commentaires comme 'glad you're back' et 'great video'.