The NtLoadKeyEx system call allows an unprivileged user to load registry hives outside of the RegistryA hidden attachment point which can be used to elevate privileges.