Pay2Key IFEO Debugger Hijack: agntsvc.exe Redirected to Systray.exe
This rule detects modifications to the Image File Execution Options (IFEO) registry key for the agent service 'agntsvc.exe'. It identifies when an adversary configures a 'Debugger' registry value or a specific systray-related value, which is a known behavior of the Pay2Key ransomware for persistence and potential privilege escalation or process interference.
Splunk (SPL)
