Debugger value written under an Image File Execution Options key

1title: Debugger value written under an Image File Execution Options key2id: 980a25ef-38ae-42e9-adaa-fbc0e7ed3c753status: experimental4description: |5  Matches the registry write that creates the IFEO injection primitive itself —6  a value named Debugger under an Image File Execution Options subkey — which is7  the first half of MITRE's AN1186. The gate is on the *value name*, not on the8  hijacked binary, which is what separates this from the accessibility-binary9  hijack under T1546.008: that rule fires on the target executable's name and10  ignores which value was written, this one fires on any target so long as a11  debugger was attached. Both predicates are tested on TargetObject because a12  single registry_set record carries the key path and the value name as one13  string; on a Sysmon EventID 13 feed that is native, and on the Security14  EventID 4657 feed named in the brief the pipeline must concatenate ObjectName15  and ObjectValueName or the endswith predicate never matches. 4657 also needs16  the Audit Registry subcategory enabled *and* a SACL placed on the IFEO key —17  neither is on in a default install or in the MS and CIS baselines, so an18  unprepared host returns zero rows for reasons that have nothing to do with19  adversary activity. The SilentProcessExit MonitorProcess half of the technique20  writes to a different key and is deliberately out of scope here.21  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0422, not hand-written and not tested by its author. Any lab result is on this rule's own page.22references:23  - https://attack.mitre.org/techniques/T1546/01224  - https://attack.mitre.org/detectionstrategies/DET042225author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)26date: 2026-08-1627tags:28  - attack.privilege-escalation29  - attack.persistence30  - attack.t1546.01231logsource:32  category: registry_set33  product: windows34detection:35  selection_ifeo:36    TargetObject|contains: '\Image File Execution Options\'37  selection_debugger:38    TargetObject|endswith: '\Debugger'39  condition: selection_ifeo and selection_debugger40falsepositives:41  - "A developer attaching a debugger to a process that cannot be launched under one directly, which is the supported use of this key. gflags -i app.exe +dbg and the Visual Studio child-process debugging option both write exactly this value, so engineering workstations and build agents produce these routinely while servers should not."42  - "An application-compatibility shim or vendor installer pointing an obsolete executable name at its replacement through Debugger, so that launching the old binary transparently starts the new one. The write is structurally identical to the attack and is best suppressed on the installing process rather than by narrowing the key match."43  - "An IT script neutralising an unwanted executable by setting its Debugger to a blocker or to a no-op binary, a common ad-hoc application-control measure. MITRE's TargetBinary knob, populated locally with the executables that actually matter in the environment, is where this gets narrowed if it is frequent."44level: high