TrymeLocker IFEO Debugger Hijack of Accessibility Tools (T1546.012)

Ibrahim Saud@tektrix

•updated Jun 28, 2026•1•0•4

This rule detects potential privilege escalation or backdoor creation by monitoring for two primary indicators: 1) The modification of Windows Image File Execution Options (IFEO) registry keys for accessibility binaries (sethc.exe, osk.exe, utilman.exe, magnify.exe, narrator.exe, atbroker.exe) to point to unauthorized debuggers, and 2) The execution of common command interpreters or suspicious binaries spawned directly by these accessibility processes, which are commonly used in lock-screen bypass attacks.