PACT analysts found it particularly novel the way that DarkWatchman utilizes the registry: as a way to communicate between abstracted threads of operation, and as both persistent and temporary storage. It would appear that the authors of DarkWatchman identified and took advantage of the complexity and opacity of the Windows Registry to work underneath or around the detection threshold of security tools and analysts alike. In PACT’s analysis, this (along with DarkWatchman’s persistence and self-compilation mechanisms that make use of LOLbins) represents an important step in the evolution of threat actor TTPs on Windows systems