IFEO Debugger Key or COM Object Hijacking via Registry Modification

Ibrahim Saud@tektrix

•updated Jun 30, 2026•3•0•8

This rule detects various Windows persistence and hijacking techniques by monitoring registry activity. Specifically, it identifies the manipulation of IFEO (Image File Execution Options) Debugger or GlobalFlag keys, HKCU COM class hijacking through InProcServer32 or LocalServer32, and the AppCertDlls registry value, which can be used to inject malicious code into processes.