Image File Execution Options (IFEO) or SilentProcessExit Registry Modification
Detects modifications to the Image File Execution Options (IFEO) or SilentProcessExit registry keys, which can be abused for persistence, privilege escalation, or defense evasion. Adversaries may use these mechanisms to attach debuggers or monitor programs to legitimate executables, causing malicious code to run when the target application starts or exits. thx to Maurice Fielenbach for Sharing this Attack Path on Linkedin
Microsoft Sentinel (KQL)
