TrymeLocker IFEO Debugger Hijack on Accessibility Tools (T1546.008)

Ibrahim Saud@tektrix

•updated Jun 28, 2026•1•1•7

Detects registry modifications to the 'Debugger' value for Windows accessibility binaries (e.g., sethc.exe, utilman.exe, osk.exe). This technique, known as IFEO (Image File Execution Options) hijacking, allows an adversary to redirect the execution of these binaries to a malicious payload. This is a common persistence mechanism used by malware, including TrymeLocker, to achieve unauthorized access or privilege escalation at the login screen.