huntrule

Windows Registry Image File Execution Options Debugger Backdoor (sethc.exe/utilman.exe/osk.exe)

Alerts on registry Debugger hijacks for Windows login/accessibility binaries using Image File Execution Options.

FreeReviewedSigma · Critical · v1
Product
windows
Category
registry_event
Author
Florian Roth (Nextron Systems), @twjackomo, Jonhnathan Ribeiro, oscd.community (SigmaHQ), DRL 1.1
Published
2018-03-15
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Persistence → Priv Esc

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags registry entries that set a Debugger value for built-in Windows executables via the Image File Execution Options mechanism. Attackers can abuse this to hijack execution of accessibility and login-screen tools such as sethc.exe, utilman.exe, and others. The detection relies on Windows registry event telemetry for writes or modifications to specific Debugger key paths under CurrentVersion\Image File Execution Options.

Reporting behind it

Related detections9 linkedT1546.008 — drag to rearrange
Malicious Sticky Key File Created from CMD Copy (via file_event)
Malicious Stickey Key Called CMD via Command Execution - Hash Detection (via process_creation)
Malicious Stickey Key IFEO Registry Changed - Reg via Sysmon (via registry_event)
Malicious Accessibility Feature Backdoor via Image File Execution Options Debugger (via registry_set)
Malicious Stickey Key Called CMD via Command Execution (via process_creation)
Malicious Sticky Key Sethc Command for Replacement by CMD (via process_creation)
Malicious Stickey Key IFEO - Reg via Command (via process_creation)
Malicious Accessibility Feature Debugger Hijack via IFEO (via registry_set)
Windows Privilege Escalation via mklink Symlink Between cmd.exe and osk.exe
Windows Registry Image File Execution Options Debugger Backdoor (sethc.exe/utilman.exe/osk.exe)
Pivot detection · T1546.008 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.