Offline registry hive manipulation means mounting or editing a Windows registry hive file outside the live registry, such as when the system is offline or the file is copied for analysis. Hives store configuration for the machine or a user profile, so working on them offline lets administrators repair corruption, inspect settings, or review evidence without changing the running system.
In cyber security, the same capability can be abused. Attackers may tamper with a user hive to change startup behavior, alter account-linked settings, or stage persistence before the hive is loaded again. Defenders look for suspicious hive load and unload activity, unusual access to hive files, and tools such as reg load or reg unload used outside normal maintenance. Because this technique can resemble legitimate administration, context and telemetry are important for spotting misuse.