Debugger value written under an Image File Execution Options key

Siemphony@siemphonyhighT1546.012unverified

Matches the registry write that creates the IFEO injection primitive itself — a value named Debugger under an Image File Execution Options subkey — which is the first half of MITRE's AN1186. The gate is on the *value name*, not on the hijacked binary, which is what separates this from the accessibility-binary hijack under T1546.008: that rule fires on the target executable's name and ignores which value was written, this one fires on any target so long as a debugger was attached. Both predicates are tested on TargetObject because a single registry_set record carries the key path and the value name as one string; on a Sysmon EventID 13 feed that is native, and on the Security EventID 4657 feed named in the brief the pipeline must concatenate ObjectName and ObjectValueName or the endswith predicate never matches. 4657 also needs the Audit Registry subcategory enabled *and* a SACL placed on the IFEO key — neither is on in a default install or in the MS and CIS baselines, so an unprepared host returns zero rows for reasons that have nothing to do with adversary activity. The SilentProcessExit MonitorProcess half of the technique writes to a different key and is deliberately out of scope here. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0422, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceRegistryEvents| where (RegistryKey contains "\\Image File Execution Options\\" and RegistryKey endswith "\\Debugger")

Splunk · SPL

Run this as a search.

index=* (TargetObject="*\\Image File Execution Options\\*" AND TargetObject="*\\Debugger")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(registry.path) LIKE "*\\\\image file execution options\\\\*" AND TO_LOWER(registry.path) LIKE "*\\\\debugger")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,registry_set,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="12">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="TargetObject" type="pcre2">(?i)\\Image File Execution Options\\</field>    <field name="TargetObject" type="pcre2">(?i)\\Debugger$</field>    <description>Debugger value written under an Image File Execution Options key</description>    <mitre>      <id>T1546.012</id>    </mitre>  </rule></group>

At a glance

Logsource: registry_set / windows
Level: high
Category: registry_persistence
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 980a25ef-38ae-42e9-adaa-fbc0e7ed3c75

ATT&CKT1546.012

T1546.012Image File Execution Options Injection

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonregistry persistence

registry persistenceAI draft — unreviewed

01 · What this rule detects

A registry value named Debugger written under an Image File Execution Options subkey. That one write is the IFEO injection primitive: Windows then prepends the named debugger to the target, so launching notepad.exe launches your binary — with the launcher's privileges, on every start.

02 · Telemetry you need

The rule is written in the Sysmon EventID 13 vocabulary, where
The brief's log source is Security 4657, a different shape: ObjectName
4657 also needs the Audit Registry subcategory and a SACL on the

03 · How the logic works

Why the gate is on the value name. Several values live under an image subkey — GlobalFlag, MitigationOptions, VerifierDlls — but only Debugger gives code execution on launch. Gating the value rather than the target binary means the rule fires on any hijacked executable, not just the famous ones. contains establishes the key; endswith pins the value to the tail. The collision the description claims to have solved, and has not. It says the value-name gate "is what separates this from the accessibility-binary hijack under T1546.008." It does not. Both rules live on registry_set/windows, both gate on \Image File Execution Options\, and the commonest real instance of the technique — …\Image File Execution Options\sethc.exe\Debugger — satisfies T1546.008's target-name selection and this rule's \Debugger. One write, two alerts, two technique IDs. Separation has to be encoded — a filter_accessibility block not-ed into the condition — to exist. When a description says two rules do not overlap, read both selection blocks. Check that your false positives are actually possible. The rule's first false positive cites gflags -i app.exe +dbg. That command does not write Debugger: GFlags's image switch is /i, and /i <image> +<flag> sets the GlobalFlag DWORD — a sibling value under the same subkey, which endswith '\Debugger' cannot match. The rule's leading benign match cannot trigger it. The Visual Studio child-process debugging option in the same entry is real, as are the GFlags GUI's Image File tab and a direct reg add … /v Debugger. A false positive is a claim about what the logic matches — as checkable as the logic itself.

04 · Common false positives

Developers attaching a debugger to a process that cannot be launched under
App-compat shims and installers pointing an obsolete executable name at its
IT scripts neutralising an unwanted executable by pointing its Debugger at a
The teardown of every one of those. Clearing Debugger to an empty string

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from MITRE ATT&CK DET0422 and never executed against a log line. level: high sits on the edge of the rule's own first false positive; high on servers, medium on developer endpoints is the defensible split, and either way it is a judgement rather than a rate.
tier_2: match the vocabulary to your feed, confirm the SACL on 4657, baseline debugger-using hosts.
tier_3: is AN1186 as written — this write correlated with the anomalous child process that follows inside a TimeWindow.

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

`TargetBinary` (MITRE's knob), populated locally with the executables that
The rule never reads Details, so it cannot see what the debugger points
Two adjacent primitives are uncovered: VerifierDlls (Application Verifier,

Declared by the author

A developer attaching a debugger to a process that cannot be launched under one directly, which is the supported use of this key. gflags -i app.exe +dbg and the Visual Studio child-process debugging option both write exactly this value, so engineering workstations and build agents produce these routinely while servers should not.
An application-compatibility shim or vendor installer pointing an obsolete executable name at its replacement through Debugger, so that launching the old binary transparently starts the new one. The write is structurally identical to the attack and is best suppressed on the installing process rather than by narrowing the key match.
An IT script neutralising an unwanted executable by setting its Debugger to a blocker or to a no-op binary, a common ad-hoc application-control measure. MITRE's TargetBinary knob, populated locally with the executables that actually matter in the environment, is where this gets narrowed if it is frequent.

Noise check0 of 6 fired

Fires on none of the 6 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 6 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1546.012, evaluated against their registry_set events.

Share this rule

/u/siemphony/980a25ef-38ae-42e9-adaa-fbc0e7ed3c75

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Debugger value written under an Image File Execution Options key

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it