Introduction: In the evolving landscape of cyber threats, attackers increasingly abuse legitimate Windows components to bypass security controls. One such technique involves hijacking the Microsoft Distributed Transaction Coordinator (MSDTC) service via a specific Oracle OCI registry key, enabling both persistence and privilege escalation to SYSTEM level. This article delves into this sophisticated attack vector, detailing how threat hunters can detect and mitigate it using Sysmon and digital signature validation.