IFEO Debugger Set for Security Tools to Block Execution (T1546.012)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•5•0•1

Detects the creation of Image File Execution Options (IFEO) registry entries that associate a debugger with common security-related or monitoring binaries (e.g., Sysmon, SetACL, Filebeat). Attackers use this technique to hijack the execution flow of these security tools, effectively disabling or impairing their functionality (a form of defense evasion).