Registry values starting with a NULL character
Hiding Registry keys with PSReflect
Beware of non-null-terminated registry strings
Removing Kovter's Hidden Registry Values
Detecting the Undetectable: Windows Registry Attacks
A place to share links and articles that i have found helpful. This blog tends to be more offensive security minded. Basically it is a collection of notes that I will update periodically. None of this is set in stone, and I could very well be wrong on most of it. Just saying.