Pay2Key IFEO Hijack: agntsvc.exe Debugger Set to Systray.exe

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•0

Detects the creation or modification of a 'Debugger' registry value for the 'agntsvc.exe' process within 'Image File Execution Options'. This technique allows an attacker to automatically execute a specified binary (in this case, 'Systray.exe') whenever the target process is invoked, providing a mechanism for persistence or privilege escalation.