Pay2Key IFEO Hijack: agntsvc.exe Debugger Set to Systray.exe

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•0

This rule detects the creation or modification of a 'Debugger' registry value under the 'Image File Execution Options' (IFEO) key for the process 'agntsvc.exe'. This technique is commonly used by adversaries to establish persistence or intercept process execution by forcing an arbitrary executable to run whenever the target process is started.