Skip to content

Latest commit

 

History

History
6 lines (6 loc) · 471 Bytes

Image File Execution Options Registry key injection by unsigned process.md

File metadata and controls

6 lines (6 loc) · 471 Bytes

Description

Attackers may use the Image File Execution Options Registry key to launch their executable whenever the user attempts to execute a different one.

Attacker's Goals

Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by Image File Execution Options debuggers.

Investigative Actions

Check whether the executing process is benign, and if this was a desired behavior as part of its normal execution flow.