Windows Registry Persistence via Image File Execution Options GlobalFlag and SilentProcessExit
Flags registry changes to IFEO GlobalFlag and SilentProcessExit keys that can enable stealthy persistence or process redirection.
- Product
- windows
- Category
- registry_set
- Author
- Karneades, Jonhnathan Ribeiro, Florian Roth (SigmaHQ), DRL 1.1
- Published
- 2018-04-11
- Updated
- 2026-07-30
ATT&CK techniques
Persistence → Priv EscRecon
Resource Dev
Initial Access
Execution
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies Windows registry persistence attempts by matching Image File Execution Options subkeys containing GlobalFlag and SilentProcessExit-related configuration values. Such behavior can be used to alter how processes start or fail in a way that reduces visibility to defenders. The detection relies on registry set telemetry, specifically TargetObject strings containing the expected key paths and value names.
Reporting behind it
- oddvar.moehttps://oddvar.moe/2018/04/10/persistence-using-globalflags-in-image-file-execution-options-hidden-from-autoruns-exe/
- deepinstinct.comhttps://www.deepinstinct.com/2021/02/16/lsass-memory-dumps-are-stealthier-than-ever-before-part-2/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_persistence_globalflags.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Registry Persistence via Image File Execution Options GlobalFlag and SilentProcessExit
id: f54cddfd-2c40-4280-80b2-7992ba4605d2
related:
- id: c81fe886-cac0-4913-a511-2822d72ff505
type: obsolete
- id: 36803969-5421-41ec-b92f-8500f79c23b0
type: derived
status: test
description: This rule identifies Windows registry persistence attempts by matching Image File Execution Options subkeys containing GlobalFlag and SilentProcessExit-related configuration values. Such behavior can be used to alter how processes start or fail in a way that reduces visibility to defenders. The detection relies on registry set telemetry, specifically TargetObject strings containing the expected key paths and value names.
references:
- https://oddvar.moe/2018/04/10/persistence-using-globalflags-in-image-file-execution-options-hidden-from-autoruns-exe/
- https://www.deepinstinct.com/2021/02/16/lsass-memory-dumps-are-stealthier-than-ever-before-part-2/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_persistence_globalflags.yml
author: Karneades, Jonhnathan Ribeiro, Florian Roth, Huntrule Team
date: 2018-04-11
modified: 2023-06-05
tags:
- attack.privilege-escalation
- attack.persistence
- attack.t1546.012
- car.2013-01-002
logsource:
category: registry_set
product: windows
detection:
selection_global_flag:
TargetObject|contains|all:
- \Microsoft\Windows NT\CurrentVersion\
- \Image File Execution Options\
- \GlobalFlag
selection_silent_process:
TargetObject|contains|all:
- \Microsoft\Windows NT\CurrentVersion\
- \SilentProcessExit\
TargetObject|contains:
- \ReportingMode
- \MonitorProcess
condition: 1 of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1