TrymeLocker IFEO Hijacking of Accessibility Tools via win_guard_0.exe

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•1

This rule detects unauthorized modifications to the Windows Image File Execution Options (IFEO) registry keys for accessibility binaries (sethc.exe, utilman.exe, osk.exe, magnify.exe, narrator.exe). Adversaries often replace or redirect these binaries to execute arbitrary code (often a backdoor or persistent access tool) with high privileges, typically triggered at the Windows login screen. The rule specifically looks for a 'debugger' registry value containing 'win_guard_'.