TrymeLocker IFEO Debugger Hijack of Windows Accessibility Tools (T1546.012)

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•1

Detects the modification of Image File Execution Options (IFEO) registry keys for Windows accessibility binaries (e.g., sethc.exe, utilman.exe). Adversaries frequently use this technique to hijack these binaries to launch a command shell with SYSTEM privileges when triggered from the login screen.