Windows Image File Execution Options (IFEO) Hijack Registry Modification

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•0

Detects modifications to Windows Registry keys associated with Image File Execution Options (IFEO) or Silent Process Exit, which are techniques commonly abused by adversaries to hijack execution flow for persistence or privilege escalation. The rule monitors for the creation or modification of 'Debugger', 'GlobalFlag', 'MonitorProcess', or 'ReportingMode' values, excluding known legitimate debuggers.