Cortex causality view of vds.exe IFEO debugger redirection
This rule detects persistence attempts using Image File Execution Options (IFEO) debugger redirection for 'vds.exe'. Specifically, it looks for registry modifications where the 'debugger' value for 'vds.exe' points to an executable located within the 'Windows\Fonts' directory. This technique is often used by adversaries to maintain access or elevate privileges by hijacking legitimate application execution.
Cortex XDR
