Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
73 detections
Filters
Last updated
All Time
Detection languages
21
21
9
8
5
Contributors
30
9
6
4
4
Categories
43
26
25
20
18
Platforms
72
1
Products / Services
24
15
14
2
1
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
IDS Classtypes
1
IDS Protocols
1
The detection targets these behaviours:
- Attempts to take ownership of or replace explorer.exe and gpedit.msc.
- Changes to Microsoft Edge's Image File Execution Options (IFEO) debugger.
- Changes to HTTP, HTTPS, HTML, and Microsoft Edge protocol handlers.
- Disabling Explorer's Run command and changing keyboard scancode mappings.
- Creation of temporary VBScript files used for relaunching, elevation prompts, or deceptive messages
- Attempts to take ownership of or replace explorer.exe and gpedit.msc.
- Changes to Microsoft Edge's Image File Execution Options (IFEO) debugger.
- Changes to HTTP, HTTPS, HTML, and Microsoft Edge protocol handlers.
- Disabling Explorer's Run command and changing keyboard scancode mappings.
- Creation of temporary VBScript files used for relaunching, elevation prompts, or deceptive messages
Detects potential debugger detection evasion attempts via command line arguments associated with debugging checks or process execution of debugging utilities, as well as persistence configuration using Image File Execution Options (IFEO) or AeDebug registry keys targeting debuggers.
The following analytic identifies the creation or modification of Image File Execution Options (IFEO) registry keys, detected via EventCode 3000 in the Application channel. This detection leverages Windows Event Logs to monitor for process names added to IFEO under specific registry paths. This activity is significant as it can indicate attempts to set traps for process monitoring or debugging, often used by attackers for persistence or evasion. If confirmed malicious, this could allow an attacker to execute arbitrary code or manipulate process behavior, leading to potential system compromise.
The following analytic detects modifications to registry keys under "Image File Execution Options" that can be used for privilege escalation. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to registry paths and values like GlobalFlag and Debugger. This activity is significant because attackers can use these modifications to intercept executable calls and attach malicious binaries to legitimate system binaries. If confirmed malicious, this could allow attackers to execute arbitrary code with elevated privileges, leading to potential system compromise and persistent access.
Detects the modification of the Image File Execution Options (IFEO) registry key for 'smss.exe' to set a Debugger value. This technique is often used for persistence, whereby an adversary redirects the execution of a legitimate system process to a malicious executable (e.g., a renamed binary like svchost.exe located outside of System32).
Detects the creation or modification of Registry keys within 'Image File Execution Options' (IFEO) intended to associate a debugger with security-critical or monitoring binaries (e.g., Sysmon, Filebeat). This technique is used for defense evasion and persistence by intercepting or preventing the execution of security tools.
Detects the creation or modification of Registry values under 'Image File Execution Options' (IFEO) that register a debugger for common administrative or diagnostic tools (e.g., Task Manager, Registry Editor, PowerShell). This technique can be used by malicious actors like XHOPELESS to intercept, block, or hijack the execution of legitimate tools, often to maintain persistence or impair security analysis.
Generic rule content from file: IFEO Debugger Key Abuse on Accessibility Executables (Sticky-Keys Backdoor)
Detects modifications or creations of Image File Execution Options (IFEO) registry keys where a 'Debugger' value is set. IFEO is a feature that allows a debugger to be attached to an executable, which is often abused by attackers for persistence, privilege escalation, or defense evasion by executing malicious code when the target application launches.
This rule detects tampering with Microsoft Defender by monitoring registry modifications to Image File Execution Options (IFEO) used to attach debuggers to security processes. It also detects the dropping of the 'kvckiller.sys' kernel driver into System32\drivers, which is associated with disabling security software at the kernel level, and the execution of processes containing 'wsftprm' in the command line.
Detects the modification of the Image File Execution Options (IFEO) registry key for the Microsoft Defender service executable (MsMpEng.exe) by setting a 'Debugger' value. This technique is often used to impair security defenses by redirecting or preventing the execution of the Antivirus engine.
Detects the creation or modification of Registry keys and values associated with Image File Execution Options (IFEO). Adversaries commonly abuse IFEO for persistence, privilege escalation, or to hijack process execution by attaching malicious debuggers to legitimate system binaries, such as MsMpEng.exe, or by creating temp hive mounts.
Detects modifications to the Image File Execution Options (IFEO) registry keys for critical Windows accessibility binaries such as osk.exe, utilman.exe, sethc.exe, magnify.exe, and narrator.exe. This technique is commonly used by adversaries to establish persistence or facilitate unauthenticated privilege escalation by replacing these tools with malicious executables (e.g., cmd.exe) that execute when triggered from the Windows login screen.
This rule detects various Windows persistence and hijacking techniques by monitoring registry activity. Specifically, it identifies the manipulation of IFEO (Image File Execution Options) Debugger or GlobalFlag keys, HKCU COM class hijacking through InProcServer32 or LocalServer32, and the AppCertDlls registry value, which can be used to inject malicious code into processes.
This rule detects modifications to the Image File Execution Options (IFEO) registry key for the agent service 'agntsvc.exe'. It identifies when an adversary configures a 'Debugger' registry value or a specific systray-related value, which is a known behavior of the Pay2Key ransomware for persistence and potential privilege escalation or process interference.
This rule detects modifications to critical Windows registry keys associated with disabling security features (Microsoft Defender, WDigest credential storage) or establishing persistence via Image File Execution Options (IFEO). These modifications are often performed by adversaries to impair defensive monitoring, bypass credential protections, or execute malicious code when specific processes start.
Detects registry modifications to the 'Debugger' value for Windows accessibility binaries (e.g., sethc.exe, utilman.exe, osk.exe). This technique, known as IFEO (Image File Execution Options) hijacking, allows an adversary to redirect the execution of these binaries to a malicious payload. This is a common persistence mechanism used by malware, including TrymeLocker, to achieve unauthorized access or privilege escalation at the login screen.
This rule detects potential privilege escalation or backdoor creation by monitoring for two primary indicators: 1) The modification of Windows Image File Execution Options (IFEO) registry keys for accessibility binaries (sethc.exe, osk.exe, utilman.exe, magnify.exe, narrator.exe, atbroker.exe) to point to unauthorized debuggers, and 2) The execution of common command interpreters or suspicious binaries spawned directly by these accessibility processes, which are commonly used in lock-screen bypass attacks.
Detects the modification of Image File Execution Options (IFEO) registry keys to assign a debugger to critical Windows accessibility binaries (e.g., sethc.exe, utilman.exe, osk.exe). This technique is a common method for achieving persistence or privilege escalation by executing arbitrary code when these accessibility features are triggered, often at the Windows login screen.
Detects the modification of the 'Debugger' registry value for 'agntsvc.exe' under the Image File Execution Options (IFEO) registry key. This technique is often used by adversaries for persistence or to intercept and manipulate process execution by forcing a specified program (in this case, 'Systray.exe') to run when 'agntsvc.exe' starts.
Detects potential persistence attempts by TrymeLocker malware, specifically monitoring for malicious StubPath values written to Active Setup registry keys. The rule correlates this behavior with other indicators of compromise such as malicious Debugger values set within Image File Execution Options (IFEO) keys or suspicious service creation, effectively identifying high-confidence persistence activity.
Page 1 of 4