T1546

Event Triggered Execution

Privilege Escalation Persistence Last updated:

Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events. Various operating systems have means to monitor and subscribe to events such as logons or other user activity such as running specific applications/binaries. Adversaries abuse these mechanisms — including WMI event subscriptions, screensaver hijacking, PowerShell profile modification, AppInit DLLs, IFEO injection, COM hijacking, accessibility feature replacement, Unix shell configuration modification, and application shimming — to execute malicious code automatically when specific system events occur. Since the execution can be proxied by an account with higher permissions such as SYSTEM or service accounts, adversaries may escalate privileges through these triggered execution mechanisms.

What is T1546 Event Triggered Execution?

Event Triggered Execution (T1546) maps to the Privilege Escalation and Persistence tactics — the adversary is trying to gain higher-level permissions in MITRE ATT&CK.

This page provides production-ready detection logic for Event Triggered Execution, covering the data sources and telemetry it touches: Registry: Windows Registry Key Modification, Process: Process Creation, File: File Creation, File: File Modification, WMI: WMI Creation, Microsoft Defender for Endpoint. The queries below are rated high severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Privilege Escalation Persistence
Technique
T1546 Event Triggered Execution
Canonical reference
https://attack.mitre.org/techniques/T1546/
Microsoft Sentinel / Defender
kusto 
// T1546 — Event Triggered Execution: broad detection covering WMI subscriptions, registry-based triggers, and file-based persistence hooks
let WmiSubscriptionRegistryPaths = dynamic([
  "\\SOFTWARE\\Microsoft\\WBEM",
  "\\SYSTEM\\CurrentControlSet\\Services\\WbemAdap"
]);
let RegistryTriggerPaths = dynamic([
  // AppInit DLLs (T1546.010)
  "\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\AppInit_DLLs",
  "\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\AppInit_DLLs",
  // Image File Execution Options (T1546.012)
  "\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options",
  // Screensaver (T1546.002)
  "\\Control Panel\\Desktop\\SCRNSAVE.EXE",
  // AppCert DLLs (T1546.009)
  "\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\AppCertDlls",
  // Netsh Helper DLL (T1546.007)
  "\\SOFTWARE\\Microsoft\\NetSh",
  // COM Hijacking (T1546.015)
  "\\SOFTWARE\\Classes\\CLSID"
]);
let AccessibilityBinaries = dynamic([
  "sethc.exe", "utilman.exe", "osk.exe", "magnify.exe",
  "narrator.exe", "displayswitch.exe", "atbroker.exe", "wscript.exe"
]);
let SdbInstPaths = dynamic(["sdbinst.exe"]);
// Detection 1: Suspicious registry modifications to event-triggered persistence locations
let RegistryTriggers = DeviceRegistryEvents
| where Timestamp > ago(24h)
| where ActionType in ("RegistryValueSet", "RegistryKeyCreated")
| where RegistryKey has_any (RegistryTriggerPaths)
| where RegistryValueData != "" or ActionType == "RegistryKeyCreated"
// Exclude known-good IFEO entries (debugger set to legitimate tools)
| where not (RegistryKey contains "Image File Execution Options" and RegistryValueName == "Debugger" and
             (RegistryValueData has "vsjitdebugger.exe" or RegistryValueData has "windbg.exe" or RegistryValueData has "drwtsn32.exe"))
| extend DetectionType = case(
    RegistryKey contains "AppInit_DLLs", "AppInit_DLL_Persistence",
    RegistryKey contains "Image File Execution Options", "IFEO_Hijacking",
    RegistryKey contains "SCRNSAVE.EXE", "Screensaver_Persistence",
    RegistryKey contains "AppCertDlls", "AppCertDLL_Persistence",
    RegistryKey contains "NetSh", "Netsh_Helper_DLL",
    RegistryKey contains "CLSID", "COM_Hijacking",
    "Event_Triggered_Registry"
  )
| project Timestamp, DeviceName, AccountName, DetectionType, RegistryKey, RegistryValueName, RegistryValueData,
          InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName;
// Detection 2: WMI event subscription creation via process telemetry
let WmiSubscriptions = DeviceProcessEvents
| where Timestamp > ago(24h)
| where (FileName =~ "wmic.exe" and ProcessCommandLine has_any ("subscription", "ActiveScriptEventConsumer", "CommandLineEventConsumer", "EventFilter", "FilterToConsumerBinding"))
   or (FileName =~ "powershell.exe" and ProcessCommandLine has_any ("Set-WmiInstance", "New-CimInstance", "__EventFilter", "__EventConsumer", "__FilterToConsumerBinding", "ActiveScriptEventConsumer", "CommandLineEventConsumer"))
| extend DetectionType = "WMI_Subscription_Creation"
| project Timestamp, DeviceName, AccountName, DetectionType,
          RegistryKey = "", RegistryValueName = "", RegistryValueData = "",
          InitiatingProcessFileName, InitiatingProcessCommandLine = ProcessCommandLine,
          InitiatingProcessAccountName = AccountName;
// Detection 3: Application Shimming via sdbinst.exe
let AppShimming = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "sdbinst.exe"
| where ProcessCommandLine !has "/u" // /u is uninstall — less suspicious
| extend DetectionType = "App_Shimming_SDB_Install"
| project Timestamp, DeviceName, AccountName, DetectionType,
          RegistryKey = "", RegistryValueName = "", RegistryValueData = "",
          InitiatingProcessFileName, InitiatingProcessCommandLine = ProcessCommandLine,
          InitiatingProcessAccountName = AccountName;
// Detection 4: Accessibility feature binary replacement (T1546.008)
let AccessibilityHijack = DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ("FileCreated", "FileModified", "FileRenamed")
| where FileName has_any (AccessibilityBinaries)
| where FolderPath has_any ("\\Windows\\System32", "\\Windows\\SysWOW64")
// Exclude Windows Update and TrustedInstaller paths
| where InitiatingProcessFileName !in~ ("TiWorker.exe", "TrustedInstaller.exe", "wuauclt.exe", "svchost.exe")
| extend DetectionType = "Accessibility_Feature_Hijack"
| project Timestamp, DeviceName, AccountName, DetectionType,
          RegistryKey = "", RegistryValueName = FileName, RegistryValueData = FolderPath,
          InitiatingProcessFileName, InitiatingProcessCommandLine = InitiatingProcessCommandLine,
          InitiatingProcessAccountName = InitiatingProcessAccountName;
// Detection 5: PowerShell profile creation/modification (T1546.013)
let PsProfilePaths = dynamic([
  "\\WindowsPowerShell\\Microsoft.PowerShell_profile.ps1",
  "\\WindowsPowerShell\\profile.ps1",
  "\\PowerShell\\Microsoft.PowerShell_profile.ps1",
  "\\PowerShell\\profile.ps1"
]);
let PowerShellProfile = DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ("FileCreated", "FileModified")
| where FolderPath has_any (PsProfilePaths) or (FileName has "_profile.ps1" and FolderPath has "PowerShell")
| where InitiatingProcessFileName !in~ ("powershell.exe", "pwsh.exe", "code.exe", "notepad.exe", "devenv.exe")
| extend DetectionType = "PowerShell_Profile_Modification"
| project Timestamp, DeviceName, AccountName, DetectionType,
          RegistryKey = FolderPath, RegistryValueName = FileName, RegistryValueData = "",
          InitiatingProcessFileName, InitiatingProcessCommandLine = InitiatingProcessCommandLine,
          InitiatingProcessAccountName = InitiatingProcessAccountName;
// Union all detections
union RegistryTriggers, WmiSubscriptions, AppShimming, AccessibilityHijack, PowerShellProfile
| sort by Timestamp desc

Detects multiple T1546 Event Triggered Execution sub-techniques across Windows platforms using Microsoft Defender for Endpoint telemetry. Covers: (1) Registry modifications to AppInit_DLLs, IFEO, screensaver, AppCertDlls, Netsh Helper, and COM hijacking keys; (2) WMI event subscription creation via wmic.exe or PowerShell; (3) Application shimming via sdbinst.exe; (4) Accessibility feature binary replacement (utilman.exe, sethc.exe, etc.) targeting System32/SysWOW64; (5) PowerShell profile creation/modification from unexpected parent processes. Each detection arm is labeled with DetectionType for downstream triage and routing.

high severity medium confidence

Data Sources

Registry: Windows Registry Key Modification Process: Process Creation File: File Creation File: File Modification WMI: WMI Creation Microsoft Defender for Endpoint

Required Tables

DeviceRegistryEvents DeviceProcessEvents DeviceFileEvents

False Positives

  • Software installation routines legitimately modifying AppInit_DLLs or registering COM objects — especially third-party security tools (AV/EDR agents), accessibility software, or application frameworks
  • Developer tools (Visual Studio, WinDbg) setting IFEO Debugger values for debugging purposes
  • Administrative scripts creating WMI subscriptions for legitimate monitoring (SCCM, WMI-based health checks, vendor management tools)
  • sdbinst.exe invocations during application compatibility fixes from IT teams applying vendor-supplied shim databases
  • Group Policy or MDM pushing screensaver configuration changes to enforce screen lock policies
  • PowerShell profile creation by developers customizing their shell environment via VS Code or PowerShell ISE

Sigma rule & cross-platform mapping

The detection logic for Event Triggered Execution (T1546) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1546 Sigma rules on detection.fyi

Platform-specific guides for T1546

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-03-15 Research depth: deep
References (8)

Testing Methodology

Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1WMI Event Subscription Persistence via PowerShell

    Expected signal: Sysmon Event IDs 19 (WmiEventFilter created: df00tech-test-filter), 20 (WmiEventConsumer created: df00tech-test-consumer), 21 (WmiEventConsumerToFilter binding). WMI Activity Operational log Event ID 5861 (New subscription). Sysmon Event ID 1 for the spawned cmd.exe when the subscription fires (parent will be WmiPrvSE.exe). KQL: DeviceProcessEvents where InitiatingProcessFileName =~ 'WmiPrvSE.exe'.

  2. Test 2Image File Execution Options Injection on calc.exe

    Expected signal: Sysmon Event ID 13 (RegistryValueSet): TargetObject = HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\calc.exe\Debugger, Details = cmd.exe, Image = reg.exe. Security Event ID 4657 (if object access auditing enabled). When calc.exe is subsequently launched, Sysmon Event ID 1 will show cmd.exe spawning with ParentCommandLine referencing calc.exe.

  3. Test 3AppInit DLL Persistence Registration

    Expected signal: Sysmon Event ID 13 (RegistryValueSet): TargetObject = HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs, Details = C:\Users\Public\malicious.dll, Image = reg.exe. Second event for LoadAppInit_DLLs = 1. Security Event ID 4657 if audit policy covers this key.

  4. Test 4Screensaver Persistence via Registry

    Expected signal: Sysmon Event ID 13 (RegistryValueSet): TargetObject = HKCU\Control Panel\Desktop\SCRNSAVE.EXE, Details = C:\Windows\System32\calc.exe, Image = reg.exe. Note: HKCU modifications generate EventCode=13 with the current user's SID in the path. When screensaver activates, Sysmon Event ID 1 will show calc.exe spawning from winlogon.exe.

  5. Test 5Application Shimming via sdbinst.exe

    Expected signal: Sysmon Event ID 1 (Process Create): Image = C:\Windows\System32\sdbinst.exe, CommandLine = sdbinst.exe C:\Windows\Temp\test.sdb, ParentImage = python.exe or cmd.exe. Registry modification events (Sysmon Event ID 13) for HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB if the SDB installs successfully.

Response Playbook

Triage

  1. Identify the specific DetectionType triggered — WMI subscription creation and accessibility feature hijacking are high-fidelity signals (SuspicionScore 3-4) warranting immediate investigation; screensaver and COM hijacking alerts have higher false-positive rates and require additional context
  2. For registry-based triggers (AppInit_DLLs, IFEO, AppCertDlls): examine the value data — does it point to a file in a user-writable directory (AppData, Temp, Public), an unsigned binary, or a suspicious path? Legitimate values point to vendor DLLs in Program Files with valid signatures
  3. For WMI subscription alerts: query the live WMI repository to enumerate all active subscriptions — run: Get-WMIObject -Namespace root\subscription -Class __EventFilter; Get-WMIObject -Namespace root\subscription -Class __EventConsumer; Get-WMIObject -Namespace root\subscription -Class __FilterToConsumerBinding — and identify any subscriptions not matching known-good baselines
  4. For IFEO Hijacking: check the registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\<target.exe>\Debugger — if the debugger path points to cmd.exe, powershell.exe, or a non-vendor tool, this is malicious; a debugger set to 'C:\Windows\System32\taskmgr.exe' on sethc.exe is a classic accessibility feature bypass
  5. Check the initiating process for the registry or file modification — was it an interactive user session, a script interpreter (wscript.exe, cscript.exe), a scheduled task, or an unknown binary? Interactive user sessions during business hours with known parent processes are lower risk
  6. Validate file signatures on any DLLs referenced in AppInit_DLLs or AppCertDlls — run: Get-AuthenticodeSignature '<dll_path>' | Select-Object Status, SignerCertificate. Unsigned or invalid signatures from user-writable directories are strong indicators of malicious activity
  7. Review process creation history for the affected host in the 30 minutes before and after the event — look for suspicious downloads (curl, certutil, bitsadmin), script execution, or network connections that may indicate the delivery mechanism

Containment

  1. For confirmed WMI persistence: remove malicious subscriptions immediately using: Get-WMIObject -Namespace root\subscription -Class __EventFilter | Where-Object {$_.Name -eq '<malicious_filter>'} | Remove-WmiObject. Remove the corresponding consumer and binding objects as well. Document the subscription details before removal
  2. For AppInit_DLLs or IFEO registry persistence: delete the malicious registry value using regedit or reg.exe, then quarantine the referenced DLL or executable via EDR. Validate the key reverts to expected state (AppInit_DLLs should be empty or contain only vendor-signed DLLs)
  3. For accessibility feature binary replacement (sethc.exe, utilman.exe): immediately isolate the endpoint — an attacker with this persistence can access a SYSTEM command prompt at the login screen without credentials, making this a critical escalation path. Restore the original binaries from a known-good source or system image
  4. If lateral movement is suspected or credentials may be compromised: isolate the host from the network using EDR containment, disable the affected user account in Active Directory, and force password resets for any accounts that logged into the affected system
  5. For application shimming (sdbinst.exe): uninstall the malicious shim database using sdbinst.exe -u <path_to_sdb_file>. Enumerate installed shim databases at HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB and remove suspicious entries

Evidence Collection

  1. WMI repository snapshot: Export all active WMI subscriptions — Get-WMIObject -Namespace root\subscription -Class __EventFilter | Export-Csv; repeat for __EventConsumer and __FilterToConsumerBinding. The WMI repository files are located at C:\Windows\System32\wbem\Repository\
  2. Registry export of all affected persistence keys: reg export 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows' C:\evidence\appinit.reg; reg export 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options' C:\evidence\ifeo.reg; reg export 'HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls' C:\evidence\appcertdlls.reg
  3. File system artifacts: hash and copy any DLLs or executables referenced in persistence locations. Collect file metadata (creation time, modification time, owner, signature status) using: Get-Item '<path>' | Select-Object Name, CreationTimeUtc, LastWriteTimeUtc, @{N='Hash';E={(Get-FileHash $_.FullName).Hash}}
  4. Sysmon logs: Windows Event Log — Microsoft-Windows-Sysmon/Operational for Event IDs 1 (process), 11 (file), 12/13 (registry), 19/20/21 (WMI) covering the 24-hour window around the detection. Export via: wevtutil epl Microsoft-Windows-Sysmon/Operational C:\evidence\sysmon.evtx
  5. Prefetch and shimcache: C:\Windows\Prefetch\ for execution evidence of any suspicious binaries referenced in persistence locations. Application shimcache from HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache
  6. PowerShell profiles: collect all profile files from $PSHOME\profile.ps1, $PSHOME\Microsoft.PowerShell_profile.ps1, $HOME\Documents\WindowsPowerShell\profile.ps1, and $HOME\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1
  7. Memory acquisition: if an active WMI consumer or shimmed process is running, capture a memory image of the process — the payload may only reside in memory (scriptblock, injected shellcode). Use winpmem or EDR memory collection capability

Escalation Criteria

  • ! Accessibility feature binary (sethc.exe, utilman.exe) replaced or IFEO Debugger set on these binaries — attacker can spawn SYSTEM-level shell at the Windows login screen without authentication
  • ! WMI event subscription confirmed with ActiveScriptEventConsumer or CommandLineEventConsumer pointing to obfuscated scripts, base64-encoded content, or network-fetching commands — indicates established automated C2 or persistence mechanism
  • ! AppInit_DLL or AppCertDLL pointing to an unsigned DLL in a user-writable directory — this DLL will be injected into every process loading user32.dll (AppInit) or every process starting (AppCertDlls), giving widespread code execution
  • ! Evidence of the persistence trigger firing — process creation events showing the WMI consumer, IFEO debugger, or shimmed process spawning suspicious child processes (cmd.exe, powershell.exe, net.exe)
  • ! Multiple event-triggered persistence mechanisms found on the same host — indicates a sophisticated actor layering redundant persistence, common in long-term intrusions
  • ! Domain controller, Exchange server, or Tier-0 system affected — escalate immediately regardless of confidence level given the potential blast radius

Investigation Guide

Forensic Artifacts

  • > Registry: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs and LoadAppInit_DLLs — value must be non-empty and LoadAppInit_DLLs must be 1 for AppInit injection to activate
  • > Registry: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\<process.exe>\Debugger — any value here causes the specified debugger to launch instead of the target process
  • > Registry: HKCU\SOFTWARE\Classes\CLSID\ — user-level COM class registrations that override machine-level entries without admin rights (T1546.015)
  • > Registry: HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls — DLLs loaded into every process that calls CreateProcess
  • > File System: C:\Windows\System32\wbem\Repository\ — binary WMI repository files (OBJECTS.DATA, INDEX.BTR) containing all event subscriptions. Tools like python-cim or WMI Explorer can parse these
  • > File System: PowerShell profile locations — $PSHOME (C:\Windows\System32\WindowsPowerShell\v1.0\), $HOME\Documents\WindowsPowerShell\ for per-user profiles
  • > File System: C:\Windows\AppPatch\ — default location for system shim databases; custom SDB files should be elsewhere and are suspicious
  • > Event Log: Microsoft-Windows-WMI-Activity/Operational (Event IDs 5857, 5858, 5860, 5861) — WMI provider loading, query errors, and subscription notifications
  • > Event Log: Security Event ID 4657 (Registry value modified) — if object access auditing is enabled for the affected registry keys
  • > Amcache.hve and Shimcache — record execution of binaries referenced by persistence mechanisms even if logs were cleared

Tuning Guidance

T1546 covers a broad family of persistence techniques, so tuning should be done per sub-technique based on your environment's baseline. Start by enumerating existing legitimate persistence: export all AppInit_DLLs, AppCertDlls, IFEO Debugger entries, WMI subscriptions, and installed shim databases from a known-good baseline system and build an allowlist. For WMI subscriptions, create a reference list of legitimate subscription names deployed by your monitoring tools (SCCM, Tanium, CrowdStrike, etc.) and suppress those specific names. For COM hijacking alerts, suppress HKLM-level CLSID registrations from software installers running as SYSTEM, but always alert on HKCU-level CLSID registrations (these don't require admin rights). For IFEO, maintain a short explicit allowlist of known debugger entries (Visual Studio JIT at VSJITDebugger.exe) and alert on anything else. Accessibility feature file modification alerts should NOT be suppressed — there is no legitimate automated process that modifies sethc.exe or utilman.exe outside of Windows Update (TrustedInstaller.exe context), so this is near-zero false-positive territory. For application shimming, work with your application compatibility team to enumerate all approved SDB databases and create allowlist entries for their file hashes. Consider enabling Windows Event ID 5861 (WMI Activity - new subscription) via WMI-Activity/Operational log for additional signal independent of Sysmon.

Hunting Queries

Hunt for WMI event subscription creation across the environment. Aggregates by user and parent process to identify automated or scripted subscription creation patterns not correlated with known change windows. High counts or multiple devices from a single user/parent combination indicate automated persistence deployment.

Hunting — KQL
kql 
// Hunt for WMI subscription artifacts across the environment
DeviceProcessEvents
| where Timestamp > ago(7d)
| where (FileName =~ "wmic.exe" and ProcessCommandLine has_any ("subscription", "EventFilter", "EventConsumer", "FilterToConsumer", "ActiveScript", "CommandLine"))
   or (FileName in~ ("powershell.exe", "pwsh.exe") and ProcessCommandLine has_any ("__EventFilter", "__EventConsumer", "__FilterToConsumerBinding", "Set-WmiInstance", "New-CimInstance") and ProcessCommandLine has_any ("root/subscription", "root\\subscription"))
| summarize Count=count(), Devices=dcount(DeviceName), FirstSeen=min(Timestamp), LastSeen=max(Timestamp), CommandLines=make_set(ProcessCommandLine, 5) by AccountName, InitiatingProcessFileName
| sort by Count desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  ((Image="*\\wmic.exe" (CommandLine="*subscription*" OR CommandLine="*EventFilter*" OR CommandLine="*EventConsumer*" OR CommandLine="*FilterToConsumer*"))
  OR ((Image="*\\powershell.exe" OR Image="*\\pwsh.exe") (CommandLine="*__EventFilter*" OR CommandLine="*__EventConsumer*" OR CommandLine="*Set-WmiInstance*" OR CommandLine="*New-CimInstance*") (CommandLine="*subscription*")))
| stats count as Count, dc(host) as Devices, earliest(_time) as FirstSeen, latest(_time) as LastSeen, values(CommandLine) as CommandLines by User, ParentImage
| sort - Count

Hunt specifically for IFEO Debugger values targeting Windows accessibility binaries (sethc.exe, utilman.exe, etc.). This is the classic 'sticky keys' attack that enables SYSTEM-level command prompt access at the lock screen. Any match should be treated as critical — there is no legitimate reason to set an IFEO debugger on these OS accessibility binaries.

Hunting — KQL
kql 
// Hunt for IFEO entries targeting accessibility binaries (login screen bypass)
DeviceRegistryEvents
| where Timestamp > ago(7d)
| where RegistryKey has "Image File Execution Options"
| where RegistryKey has_any ("sethc", "utilman", "osk", "magnify", "narrator", "displayswitch", "atbroker")
| where RegistryValueName =~ "Debugger" or RegistryValueName =~ "MonitorProcess"
| project Timestamp, DeviceName, AccountName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName, InitiatingProcessCommandLine
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=12 OR EventCode=13)
  TargetObject="*Image File Execution Options*"
  (TargetObject="*sethc*" OR TargetObject="*utilman*" OR TargetObject="*osk.exe*" OR
   TargetObject="*magnify*" OR TargetObject="*narrator*" OR TargetObject="*displayswitch*" OR TargetObject="*atbroker*")
| table _time, host, User, EventCode, TargetObject, Details, Image, CommandLine
| sort - _time

Hunt for AppInit_DLLs registry values referencing DLLs outside standard Windows and Program Files directories. Legitimate AppInit_DLL usage (rare) typically points to signed DLLs in vendor installation directories under Program Files. DLLs in user-writable paths (AppData, Temp, Public, ProgramData) are almost always malicious.

Hunting — KQL
kql 
// Hunt for AppInit_DLLs referencing non-standard or unsigned DLLs
DeviceRegistryEvents
| where Timestamp > ago(7d)
| where RegistryKey has "AppInit_DLLs" and RegistryValueName =~ "AppInit_DLLs"
| where RegistryValueData != "" and RegistryValueData != " "
// Flag DLLs not in standard Windows directories
| where not (RegistryValueData has_all ("Program Files")) and not (RegistryValueData startswith "C:\\Windows")
| project Timestamp, DeviceName, AccountName, RegistryKey, RegistryValueData, InitiatingProcessFileName, InitiatingProcessCommandLine
| extend SuspiciousPath = RegistryValueData has_any ("AppData", "Temp", "Public", "ProgramData", "Users")
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=13
  TargetObject="*AppInit_DLLs"
  NOT (Details="" OR Details=" ")
  NOT (Details="C:\\Windows\\*" OR Details="C:\\Program Files\\*")
| eval SuspiciousPath=if(match(Details, "(AppData|Temp|Public|ProgramData|Users)"), 1, 0)
| table _time, host, User, TargetObject, Details, SuspiciousPath, Image, CommandLine
| sort - SuspiciousPath, - _time

Atomic Red Team Tests

Test 1 WMI Event Subscription Persistence via PowerShell
windows

Creates a WMI permanent event subscription that triggers a benign command (writing a timestamp to a temp file) 60 seconds after creation. This simulates the full T1546.003 persistence chain: EventFilter (what to watch), CommandLineEventConsumer (what to run), and FilterToConsumerBinding (link them together). The consumer executes cmd.exe, which is detectable via Sysmon Event IDs 19, 20, 21 and the WMI Activity operational log.

Command

powershell 
$FilterArgs = @{Name='df00tech-test-filter'; EventNameSpace='root\cimv2'; QueryLanguage='WQL'; Query="SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' AND TargetInstance.SystemUpTime >= 60"}; $Filter = Set-WmiInstance -Namespace root/subscription -Class __EventFilter -Arguments $FilterArgs; $ConsumerArgs = @{Name='df00tech-test-consumer'; CommandLineTemplate="cmd.exe /c echo %DATE% %TIME% >> C:\Windows\Temp\wmi_test.txt"}; $Consumer = Set-WmiInstance -Namespace root/subscription -Class CommandLineEventConsumer -Arguments $ConsumerArgs; $BindingArgs = @{Filter=$Filter; Consumer=$Consumer}; Set-WmiInstance -Namespace root/subscription -Class __FilterToConsumerBinding -Arguments $BindingArgs

Cleanup

powershell 
Get-WMIObject -Namespace root/subscription -Class __EventFilter | Where-Object {$_.Name -eq 'df00tech-test-filter'} | Remove-WmiObject; Get-WMIObject -Namespace root/subscription -Class CommandLineEventConsumer | Where-Object {$_.Name -eq 'df00tech-test-consumer'} | Remove-WmiObject; Get-WMIObject -Namespace root/subscription -Class __FilterToConsumerBinding | Where-Object {$_.Filter -like '*df00tech*'} | Remove-WmiObject; Remove-Item C:\Windows\Temp\wmi_test.txt -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event IDs 19 (WmiEventFilter created: df00tech-test-filter), 20 (WmiEventConsumer created: df00tech-test-consumer), 21 (WmiEventConsumerToFilter binding). WMI Activity Operational log Event ID 5861 (New subscription). Sysmon Event ID 1 for the spawned cmd.exe when the subscription fires (parent will be WmiPrvSE.exe). KQL: DeviceProcessEvents where InitiatingProcessFileName =~ 'WmiPrvSE.exe'.

Expected Detection

KQL WmiSubscriptions arm fires on 'Set-WmiInstance' and 'FilterToConsumerBinding' in PowerShell command line. SPL EventCode=19/20/21 all fire. SuspicionScore=4 for FilterToConsumerBinding event.

Test 2 Image File Execution Options Injection on calc.exe
windows

Sets an IFEO Debugger entry on calc.exe that redirects execution to cmd.exe. When any process tries to launch calc.exe, Windows launches cmd.exe instead. This simulates T1546.012 as used by malware like PLATINUM, Daserf, and RGDoor for process hijacking and persistence. Uses a benign target (calc.exe) and a benign replacement (cmd.exe) for safe testing.

Command

powershell 
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\calc.exe" /v Debugger /t REG_SZ /d "cmd.exe" /f

Cleanup

powershell 
reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\calc.exe" /v Debugger /f

Expected Telemetry

Sysmon Event ID 13 (RegistryValueSet): TargetObject = HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\calc.exe\Debugger, Details = cmd.exe, Image = reg.exe. Security Event ID 4657 (if object access auditing enabled). When calc.exe is subsequently launched, Sysmon Event ID 1 will show cmd.exe spawning with ParentCommandLine referencing calc.exe.

Expected Detection

KQL RegistryTriggers arm fires: DetectionType=IFEO_Hijacking, RegistryKey contains 'Image File Execution Options'. SPL EventCode=13 fires with TargetObject matching IFEO pattern, SuspicionScore=3.

Test 3 AppInit DLL Persistence Registration
windows

Registers a test DLL path in the AppInit_DLLs registry value and enables LoadAppInit_DLLs. In a real attack this DLL would be malicious and injected into every user32.dll-loading process. This test only sets the registry value (the referenced DLL path does not need to exist to test detection) and does not trigger actual DLL injection. Simulates T1546.010 as used by FinFisher and other commercial implants.

Command

powershell 
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" /v AppInit_DLLs /t REG_SZ /d "C:\Users\Public\malicious.dll" /f && reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" /v LoadAppInit_DLLs /t REG_DWORD /d 1 /f

Cleanup

powershell 
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" /v AppInit_DLLs /t REG_SZ /d "" /f && reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" /v LoadAppInit_DLLs /t REG_DWORD /d 0 /f

Expected Telemetry

Sysmon Event ID 13 (RegistryValueSet): TargetObject = HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs, Details = C:\Users\Public\malicious.dll, Image = reg.exe. Second event for LoadAppInit_DLLs = 1. Security Event ID 4657 if audit policy covers this key.

Expected Detection

KQL RegistryTriggers arm fires: DetectionType=AppInit_DLL_Persistence. Hunting query flags value pointing to Users (user-writable) directory, SuspiciousPath=true. SPL EventCode=13 fires with SuspicionScore=3.

Test 4 Screensaver Persistence via Registry
windows

Sets a malicious screensaver path in the current user's SCRNSAVE.EXE registry value. Windows will execute this binary after the screensaver timeout, running it in the user's context. Adversaries use this for persistence and, with a binary requiring elevated execution, sometimes privilege escalation. This test points to calc.exe for safety. Simulates T1546.002.

Command

powershell 
reg add "HKCU\Control Panel\Desktop" /v SCRNSAVE.EXE /t REG_SZ /d "C:\Windows\System32\calc.exe" /f && reg add "HKCU\Control Panel\Desktop" /v ScreenSaveActive /t REG_SZ /d "1" /f && reg add "HKCU\Control Panel\Desktop" /v ScreenSaverIsSecure /t REG_SZ /d "0" /f

Cleanup

powershell 
reg delete "HKCU\Control Panel\Desktop" /v SCRNSAVE.EXE /f && reg add "HKCU\Control Panel\Desktop" /v ScreenSaveActive /t REG_SZ /d "0" /f

Expected Telemetry

Sysmon Event ID 13 (RegistryValueSet): TargetObject = HKCU\Control Panel\Desktop\SCRNSAVE.EXE, Details = C:\Windows\System32\calc.exe, Image = reg.exe. Note: HKCU modifications generate EventCode=13 with the current user's SID in the path. When screensaver activates, Sysmon Event ID 1 will show calc.exe spawning from winlogon.exe.

Expected Detection

KQL RegistryTriggers arm fires: DetectionType=Screensaver_Persistence (RegistryKey contains SCRNSAVE.EXE). SPL EventCode=13 with TargetObject matching SCRNSAVE.EXE pattern, SuspicionScore=2.

Test 5 Application Shimming via sdbinst.exe
windows

Installs a minimal application compatibility shim database (SDB file) using sdbinst.exe. In real attacks, shim databases can be crafted to inject DLLs into target processes or redirect API calls without modifying the target binary. The Mandiant report on APT17 documents ShimRat using this technique. This test creates a minimal valid SDB file to trigger the sdbinst.exe invocation for detection validation.

Command

powershell 
# First create a minimal SDB file using Python (installed on most Windows systems)
python3 -c "import struct; f=open('C:\\Windows\\Temp\\test.sdb','wb'); f.write(b'\x73\x64\x62\x66' + b'\x00'*16); f.close()"
sdbinst.exe C:\Windows\Temp\test.sdb

Cleanup

powershell 
sdbinst.exe -u C:\Windows\Temp\test.sdb 2>nul; Remove-Item C:\Windows\Temp\test.sdb -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 1 (Process Create): Image = C:\Windows\System32\sdbinst.exe, CommandLine = sdbinst.exe C:\Windows\Temp\test.sdb, ParentImage = python.exe or cmd.exe. Registry modification events (Sysmon Event ID 13) for HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB if the SDB installs successfully.

Expected Detection

KQL AppShimming arm fires: DetectionType=App_Shimming_SDB_Install, FileName=sdbinst.exe, command line does not contain /u. SPL EventCode=1 fires with Image=sdbinst.exe, SuspicionScore=2.

Related Detections

Tactic Hubs

TA0004Privilege EscalationTA0003Persistence

Sub-techniques (18)

Related Techniques

T1546.003Windows Management Instrumentation Event SubscriptionT1546.008Accessibility FeaturesT1546.010AppInit DLLsT1546.012Image File Execution Options InjectionT1546.015Component Object Model HijackingT1546.013PowerShell ProfileT1546.011Application ShimmingT1546.007Netsh Helper DLLT1059.001PowerShellT1543Create or Modify System ProcessT1053.005Scheduled TaskT1574Hijack Execution FlowT1055Process Injection

Same Tactic: Privilege Escalation

Popular Detections