Swarmer Tool Evading EDR With a Stealthy Modification on Windows Registry for Persistence

Praetorian disclosed Swarmer, a Windows persistence tool that lets low-privilege users convert a reg export into an NTUSER.MAN hive and use Microsoft’s Offline Registry (Offreg.dll) APIs to modify HKCU without invoking standard Reg* APIs, enabling stealthy login-time persistence that bypasses many EDR hooks; the report covers usage patterns, commands, implementation notes, limitations (HKCU-only, one-shot, login activation), and detection opportunities such as unexpected NTUSER.MAN files and Offreg.dll loads.