Image File Execution Options Debugger Key Modified
This rule detects attempts to modify the 'Image File Execution Options' (IFEO) registry key to set a debugger for an application. This technique is often used by adversaries for persistence, allowing them to execute their malicious code whenever the legitimate application starts. The rule specifically looks for network traffic (TCP, port 445, typically SMB) containing the strings 'Image File Execution Options' and 'Debugger' in a case-insensitive manner, indicating a potential attempt to manipulate this registry setting over the network.
Suricata
