Detect Image File Execution Options Injection in IBM QRadar
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by Image File Execution Options (IFEO) debugger values. IFEO enables developers to attach debuggers to applications. Registry keys in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{binary}.exe can be set with a Debugger value that allows a debugger to be launched automatically when the specified binary is executed. Adversaries abuse this by setting the Debugger value to their malicious payload — whenever the target binary executes, Windows launches the adversary's payload instead (with the target binary name as an argument). This can be used to replace legitimate processes, persist on reboot, or escalate privileges.
MITRE ATT&CK
- Tactic
- Privilege Escalation Persistence
- Technique
- T1546 Event Triggered Execution
- Sub-technique
- T1546.012 Image File Execution Options Injection
- Canonical reference
- https://attack.mitre.org/techniques/T1546/012/
QRadar Detection Query
SELECT
DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
logsourcename(logsourceid) AS log_source,
username,
QIDNAME(qid) AS event_name,
"TargetObject",
"Details",
"Image",
"CommandLine",
sourceip,
CASE
WHEN LOWER("TargetObject") LIKE '%sethc.exe%' OR LOWER("TargetObject") LIKE '%utilman.exe%'
OR LOWER("TargetObject") LIKE '%osk.exe%' OR LOWER("TargetObject") LIKE '%magnify.exe%'
OR LOWER("TargetObject") LIKE '%narrator.exe%' OR LOWER("TargetObject") LIKE '%displayswitch.exe%'
OR LOWER("TargetObject") LIKE '%atbroker.exe%'
THEN 'IFEO_ACCESSIBILITY_BACKDOOR'
WHEN LOWER("TargetObject") LIKE '%taskmgr.exe%' OR LOWER("TargetObject") LIKE '%regedit.exe%'
OR LOWER("TargetObject") LIKE '%cmd.exe%' OR LOWER("TargetObject") LIKE '%powershell.exe%'
THEN 'IFEO_SYSBIN_HIJACK'
WHEN LOWER("TargetObject") LIKE '%globalflag%' AND "Details" = '512'
THEN 'IFEO_SILENT_EXIT'
WHEN LOWER("Details") LIKE '%powershell%' OR LOWER("Details") LIKE '%mshta%'
OR LOWER("Details") LIKE '%wscript%' OR LOWER("Details") LIKE '%rundll32%'
OR LOWER("Details") LIKE '%appdata%' OR LOWER("Details") LIKE '%temp%'
THEN 'IFEO_SUSPICIOUS_DEBUGGER'
ELSE 'IFEO_KEY_MODIFIED'
END AS detection_type
FROM events
WHERE
LOGSOURCETYPEID(logsourceid) IN (12, 115)
AND (QIDNAME(qid) LIKE '%Registry%' OR QIDNAME(qid) LIKE '%Sysmon%')
AND ("EventID" = '12' OR "EventID" = '13')
AND LOWER("TargetObject") LIKE '%image file execution options%'
AND (
LOWER("TargetObject") LIKE '%\\debugger'
OR LOWER("TargetObject") LIKE '%\\globalflag'
OR LOWER("TargetObject") LIKE '%\\mitigationoptions'
)
AND starttime > NOW() - 86400000
ORDER BY starttime DESCDetects IFEO injection via Sysmon registry events (EventID 12/13) in QRadar, identifying modifications to Debugger, GlobalFlag, and MitigationOptions values under the Image File Execution Options key. Categorizes detections by target binary risk and payload suspiciousness.
Data Sources
Required Tables
False Positives & Tuning
- Software developers using Visual Studio or WinDbg Just-In-Time debugging, which legitimately writes Debugger values to IFEO keys for crash analysis
- Enterprise application compatibility tooling (Microsoft Application Compatibility Toolkit) that sets IFEO keys to redirect or shim legacy executables
- Endpoint security products that configure GlobalFlag or MitigationOptions on processes to enforce exploit mitigation policies (e.g., EMET legacy configs, Windows Defender Application Guard)
Other platforms for T1546.012
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1IFEO Debugger Injection on cmd.exe
Expected signal: Sysmon Event ID 13: TargetObject=Image File Execution Options\cmd.exe\Debugger, Details=C:\Windows\System32\notepad.exe. Process creation for reg.exe. If cmd.exe is then launched, notepad.exe starts with cmd.exe as its argument.
- Test 2IFEO GlobalFlag for SilentProcessExit
Expected signal: Sysmon Event ID 13 records: GlobalFlag set to 512 in IFEO\notepad.exe, and MonitorProcess set in SilentProcessExit\notepad.exe. The combination of GlobalFlag=512 and MonitorProcess registration is the SilentProcessExit technique.
- Test 3Enumerate All IFEO Debugger Registrations
Expected signal: Process creation for reg.exe with query /s flags. Read-only enumeration. Output reveals all IFEO Debugger and GlobalFlag values across all registered binaries.
References (5)
- https://attack.mitre.org/techniques/T1546/012/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.012/T1546.012.md
- https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/enabling-postmortem-debugging
- https://blogs.msdn.microsoft.com/mithuns/2009/08/14/image-file-execution-options-ifeo/
- https://www.deepinstinct.com/blog/lolbas-part-3
Unlock Pro Content
Get the full detection package for T1546.012 including response playbook, investigation guide, and atomic red team tests.