Pay2Key IFEO Debugger Hijack of agntsvc.exe via Systray.exe
Detects modifications to the 'Debugger' registry value for the 'agntsvc.exe' executable under 'Image File Execution Options'. This technique, known as IFEO injection, is used by adversaries to gain persistence or privilege escalation by forcing a malicious binary to run whenever a specific process is launched.
Cortex XDR
