huntrule

Windows Suspicious Debugger Registration via Image File Execution Options

Alerts on Windows attempts to set Image File Execution Options debuggers for logon screen binaries via command-line arguments.

FreeReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro (SigmaHQ), DRL 1.1
Published
2019-09-06
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Persistence → Priv Esc

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags process creation events whose command line includes the Image File Execution Options debugger registration path and targets common Windows logon screen binaries (e.g., sethc.exe, utilman.exe, osk.exe). Attackers use this technique to redirect the execution of trusted executables to a debugger-controlled program, enabling persistence and privilege escalation. The detection relies on process creation telemetry and string matching in the CommandLine field for both the registration path and the affected binaries.

Reporting behind it

Related detections9 linkedT1546.008 — drag to rearrange
Malicious Sticky Key File Created from CMD Copy (via file_event)
Malicious Stickey Key Called CMD via Command Execution - Hash Detection (via process_creation)
Malicious Stickey Key IFEO Registry Changed - Reg via Sysmon (via registry_event)
Malicious Accessibility Feature Backdoor via Image File Execution Options Debugger (via registry_set)
Malicious Stickey Key Called CMD via Command Execution (via process_creation)
Malicious Sticky Key Sethc Command for Replacement by CMD (via process_creation)
Malicious Stickey Key IFEO - Reg via Command (via process_creation)
Malicious Accessibility Feature Debugger Hijack via IFEO (via registry_set)
Windows Privilege Escalation via mklink Symlink Between cmd.exe and osk.exe
Windows Suspicious Debugger Registration via Image File Execution Options
Pivot detection · T1546.008 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.