T1546.012 — Image File Execution Options Injection

Tactics: Privilege Escalation, Persistence · Platforms: Windows

Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by Image File Execution Options (IFEO) debuggers. IFEOs enable a developer to attach a debugger to an application. When a process is created, a debugger present in an application’s IFEO will be…

Sub-technique of Event Triggered Execution (T1546).

Sigma detection rules (1)

T1546.012 Event Triggered Execution: Image File Execution Options Injection

title: "T1546.012 Event Triggered Execution: Image File Execution Options Injection"
id: cb2cd8b1-69a2-4248-b36e-e5eb4c43bcc3
description: 'Detection Strategy for IFEO Injection on Windows. (Retargeted from the original process_creation label to registry_set — this is the telemetry source that actually captures this technique''s behavior; see logsource below.) Tune using: TimeWindow, TargetBinary, ParentProcessAnomaly, TokenElevationContext.'
references:
  - https://attack.mitre.org/techniques/T1546/012
author: Shahrukh Khan
date: 2026-05-13
license: MIT
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1546.012

logsource:
  category: registry_set
  product: windows
  service: sysmon

detection:
  selection:
    TargetObject|contains: '\Image File Execution Options\'
    TargetObject|endswith: '\Debugger'

  condition: selection

falsepositives:
  - Legitimate debugger-attach configuration by developers; rare outside development workstations and worth reviewing on any production endpoint.

level: critical

Related sub-techniques

Explore