Image File Execution Options

A Debugger value here starts another program whenever the named program starts.

Use it to spot a program hijacked to start another, such as a SYSTEM prompt behind Sticky Keys at the logon screen.

SOFTWARE
Persistence

What It Is

Image File Execution Options is a Windows feature that lets developers attach a debugger to a program. Whenever the named program starts, Windows starts the debugger instead and hands it the program. Attackers reuse it in two ways. A Debugger value on an accessibility tool such as sethc.exe can give a command prompt as SYSTEM at the logon screen, and one on an everyday program starts another file each time that program runs. It sits in SOFTWARE with one subkey per program name.

What It Proves

Whoever set the Debugger value controls what runs when that program starts. On sethc.exe or utilman.exe it gives a SYSTEM command prompt at the logon screen.

What It Does Not Prove

Shows what is set now, not when it was used. Developers and some security tools set Debugger and GlobalFlag for good reasons.

Where It Lives

Image File Execution Options lives in the SOFTWARE hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\<program.exe>

C:\Windows\System32\config\SOFTWARE

What It Looks Like

These are three values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.

Values in Image File Execution Options, each with what it tells you
Registry Value	What It Tells You
`sethc.exe\Debugger` `REG_SZC:\Windows\System32\cmd.exe`	Pressing Shift five times at the logon screen opens cmd.exe as SYSTEM, with no password. This is a backdoor worth an incident on its own, so find who set it.
`notepad.exe\Debugger` `REG_SZC:\Users\Public\svc.exe`	C:\Users\Public\svc.exe starts every time anyone opens Notepad. An everyday program as the trigger hides the implant, so hash svc.exe and find it in Amcache.
`winword.exe\GlobalFlag` `REG_DWORD0x00000200 (512)`	GlobalFlag 0x200 turns on silent process exit monitoring for Word. Check SilentProcessExit\winword.exe for a MonitorProcess that runs as Word closes.

How to Read It

List the subkeys that hold a Debugger value, because most subkeys only hold tuning flags. Treat the accessibility tools (sethc.exe, utilman.exe, osk.exe) and common programs as high priority. Also check for GlobalFlag 0x200 with a MonitorProcess value under SilentProcessExit for the same program name.

When Windows Writes It: When a value is written, by an administrator, a debugger set-up or an attacker with admin rights.
Which Windows Versions: Windows XP to 11
Tools That Parse It: Autoruns, Registry Explorer, RECmd

Hunt It

The live tools that record Registry writes catch a Debugger value being set, and process creation records show the Debugger program running in place of the named one. A Debugger on an accessibility tool is worth an incident on its own.

Sees It DirectlyDeviceRegistryEvents

Defender records writes to these keys. A Debugger on an accessibility tool is worth an incident on its own.

KQLDefender XDR, Advanced hunting

// Debugger or GlobalFlag set under Image File Execution OptionsDeviceRegistryEvents| where Timestamp > ago(30d)| where DeviceName startswith "ws-042"| where RegistryKey contains @"\Image File Execution Options\"| where RegistryValueName in~ ("Debugger", "GlobalFlag")| project Timestamp, ActionType, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessCommandLine

Confirm It With

One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what Image File Execution Options shows.

AmcacheGives the Debugger program's SHA-1 and publisher, to tell a real debugger from a planted file.
Process Starts with an Unexpected Parent, Security Event 4688Not in the RegistryShows the Debugger program running in place of the named one, and when.

Sources

The facts on this page come from these public pages, which say more on each point.