ATT&CK coverage › Technique

Event Triggered Execution: Image File Execution Options Injection T1546.012

Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by Image File Execution Options (IFEO) debuggers. IFEOs enable a developer to attach a debugger to an application. When a process is created, a debugger present in an application’s IFEO will be prepended to the application’s name, effectively launching the new process under the debugger (e.g., <code>C:\dbg\ntsd.exe -g notepad.exe</code>).

Events covered

2 catalog events are tagged with this technique by at least one rule.

ProviderEvent IDTitle
Sysmon13RegistryEvent (Value Set)
ProcessExitMonitor3000The process 'param1' exited with exit code param2.

Authoring guide

Patterns shared across the 4 rules above: which fields they filter on, what specific values they look for, and what they exclude. Field names are normalized across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (5 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

FieldRulesHowSample values
Details2match 1, is_not_null 1.ps1, \Desktop\, iex
TargetObject2match 2, ends_with 1(Default), \SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths, Path, \ReportingMode, \GlobalFlag
registry_path1eq 1"*Microsoft\\Windows NT\\CurrentVersion\\Image File...
registry_value_name1eq 1Debugger, GlobalFlag
EventID1eq 13000

Top indicator values (31 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique.

FieldKindValueRules (here)Corpus reach
Detailsmatch.hta12
Detailsmatch%temp%13
TargetObjectmatch\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths1
Detailsmatchiex12
Detailsmatchcscript14
Detailsmatch.ps11
TargetObjectends_with(Default)12
Detailsmatchrundll3214
Detailsmatchwscript14
Detailsmatch\Users\Public1
Detailsmatchmshta14
Detailsmatch\AppData\Local\Temp\19
DetailsmatchInvoke-12
Detailsmatchregsvr3213
Detailsmatch\Downloads\12
Detailsmatch\Windows\Temp\14
Detailsmatch.bat12
Detailsmatch%tmp%14
TargetObjectends_withPath1
Detailsmatch\Desktop\13

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Sigma 2 rules

Splunk 2 rules