Hiding Registry keys with PSReflect

This technical write-up demonstrates how Kovter/Poweliks-style fileless persistence can be implemented by placing mshta/javascript payloads in registry Run values whose names begin with a null character, which prevents standard Win32 tools (like Regedit) from enumerating them; the author provides a PowerShell PSReflect proof-of-concept that calls native ntdll functions (NtOpenKey/NtSetValueKey/NtClose) to create such hidden values and discusses detection and mitigation implications.