WinDefCtl IFEO Offline-Hive Bypass Hijacking MsMpEng.exe Debugger Key
Detects the creation or modification of Registry keys and values associated with Image File Execution Options (IFEO). Adversaries commonly abuse IFEO for persistence, privilege escalation, or to hijack process execution by attaching malicious debuggers to legitimate system binaries, such as MsMpEng.exe, or by creating temp hive mounts.
Cortex XDR
