Pay2Key IFEO Hijack: agntsvc.exe Debugger Set to Systray.exe

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•3

Detects the modification of the 'Debugger' registry value for 'agntsvc.exe' under the Image File Execution Options (IFEO) registry key. This technique is often used by adversaries for persistence or to intercept and manipulate process execution by forcing a specified program (in this case, 'Systray.exe') to run when 'agntsvc.exe' starts.