Windows Image File Execution Options (IFEO) Debugger Modification
Detects modifications or creations of Image File Execution Options (IFEO) registry keys where a 'Debugger' value is set. IFEO is a feature that allows a debugger to be attached to an executable, which is often abused by attackers for persistence, privilege escalation, or defense evasion by executing malicious code when the target application launches.
Microsoft Sentinel (KQL)
