Loading story…
Elastic outlined a stateful detection-engineering approach for detecting abuse of Windows Image File Execution Options (IFEO) Debugger registry values, a persistence method mapped to MITRE ATT&CK T1015. Attackers with local administrator privileges can configure an IFEO debugger for an accessibility executable such as osk.exe, causing Windows to launch an attacker-selected program—such as cmd.exe—when the legitimate accessibility application starts.
The recommended coverage spans the full technique lifecycle: registry telemetry to identify creation or modification of IFEO debugger values, process-lineage and command-line telemetry to catch malicious runtime execution, and registry-deletion and process-termination events to identify cleanup activity. Organizations can use Sysmon telemetry alongside endpoint detection tooling to correlate these states and detect both newly deployed and already-existing accessibility-feature backdoors.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Elastic described a stateful detection-engineering approach covering creation, runtime, and cleanup stages, using abuse of Windows IFEO Debugger registry values for accessibility-feature hijacking as an example. The guidance covers detecting suspicious IFEO registry changes, anomalous process lineage and command lines, and cleanup through registry-deletion and process-termination telemetry.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A Windows persistence technique using **Image File Execution Options** (IFEO) and related registry settings was documented as a way to hijack process execution and launch attacker-controlled payloads. The method modifies keys under `HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options` and `HKLM\Software\Microsoft\Windows NT\CurrentVersion\SilentProcessExit` so a chosen executable can trigger malicious code either when the target process starts or when it exits. One demonstrated scenario used `mspaint.exe` to launch a payload after a silent exit, while an alternate approach used the IFEO `Debugger` value to run the payload as soon as the target application was opened. The technique aligns with **MITRE ATT&CK `T1183`**, which covers execution flow hijacking through IFEO injection, and it remains relevant because it can provide stealthy persistence on Windows systems through native registry features. Reporting on the method noted prior use in real intrusions, including activity associated with **APT29** and **SUNBURST**, underscoring its value for defenders monitoring registry changes tied to IFEO, `SilentProcessExit`, and suspicious debugger redirection for common processes.
Aug 15, 2026
Multiple public research reports detailed how attackers can evade Windows security monitoring by abusing native APIs, loader behavior, and application logging. White Knight Labs and XPN documented techniques to suppress or bypass **Event Tracing for Windows (ETW)** visibility in .NET and Windows processes, while separate research showed that access-mask-based detections can be defeated with `DuplicateHandle` by first requesting only `PROCESS_DUP_HANDLE` and then cloning a more privileged handle to targets such as **LSASS** or **winlogon**. Microsoft documentation for `CreateProcessA` also appeared in the reference set because process creation remains central to many payload chains, including shellcode that ultimately launches command shells or follow-on tooling. Additional reports showed how attackers can blend execution into legitimate Windows behavior and trusted software. iPurple described **EntryPoint Hijacking**, in which a loaded DLL's entry point is overwritten so malicious code runs during normal thread creation or loader activity, reducing obvious injection signals and complicating EDR detection. NVISO separately analyzed Metasploit reverse-shell shellcode that walks the **PEB** and resolves APIs such as `LoadLibraryA`, networking functions, and `CreateProcessA`, while Hunt & Hackett showed that **ConnectWise Control/ScreenConnect** can be used for intrusion activity and that its own event logging can be disabled by patching `ScreenConnect.Core.dll`. Together, the reports underscore that defenders must validate loader integrity, monitor low-visibility handle requests and memory writes, and avoid relying on a single telemetry source such as ETW or application-generated event logs.
Aug 15, 2026
Elastic detailed enhanced Windows user-mode call-stack telemetry in **Elastic Defend** that attributes dual-use behavior to the code that initiated it. The telemetry enriches stack addresses with module exports and identifies the final user module’s path, SHA-256 hash, signature state, memory protections, and provenance, helping analysts identify direct syscalls, proxy execution, shellcode, ROP-like activity, unbacked RWX memory, and truncated or manipulated stacks. Dispatcher functions in captured stacks can also reveal early-thread execution, exception-handler abuse, APC-based execution, and GUI-thread hijacking. The approach addresses a longstanding control-flow defense problem: ordinary stack walking reconstructs return addresses but can be misled by tail calls, trampolines, and stack manipulation. Earlier hardware-assisted CFI research, including Endgame’s HA-CFI, used Intel PMU branch-misprediction traps and Last Branch Record data to validate indirect-call targets and reported detection of ROP and ROPless exploit techniques across tested exploit samples. Elastic’s telemetry-focused implementation makes suspicious control-flow context available in endpoint alerts by default; organizations can also enable it for routine events, balancing additional visibility against increased telemetry volume.
Sep 9, 2026