Silent Process Exit

A monitor program started when a named program exits, paired with an IFEO flag.

Use it to find a program set to launch whenever another one closes, such as Word, and the IFEO flag that arms it.

SOFTWARE
Persistence

What It Is

Silent process exit monitoring, added in Windows 7, watches a named program for silent termination, meaning the program ends itself by calling ExitProcess or another process ends it with TerminateProcess. The SilentProcessExit key holds the settings for each monitored program, such as a MonitorProcess to launch, a ReportingMode, a LocalDumpFolder and a DumpType. It works together with a GlobalFlag set under the program's Image File Execution Options key. The GFlags debugging tool sets these entries, and the key lives in HKLM SOFTWARE under Microsoft\Windows NT\CurrentVersion.

What It Proves

A MonitorProcess value here, with the matching GlobalFlag set under Image File Execution Options, makes Windows launch the monitor program when the named program exits. That gives execution triggered by a normal program closing.

What It Does Not Prove

It needs both the SilentProcessExit entry and the IFEO GlobalFlag, so check the pair. It fires on exit, not on a schedule.

Where It Lives

Silent Process Exit lives in the SOFTWARE hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.

SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\<program.exe>

C:\Windows\System32\config\SOFTWARE

What It Looks Like

These are three values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.

Values in Silent Process Exit, each with what it tells you
Registry Value	What It Tells You
`winword.exe\MonitorProcess` `REG_SZC:\Users\Public\svc.exe`	Word's MonitorProcess is C:\Users\Public\svc.exe, the same file set as Notepad's IFEO Debugger. Hash it and find the process that wrote both keys.
`winword.exe\ReportingMode` `REG_DWORD0x00000001 (1)`	ReportingMode 1 tells Windows to launch svc.exe when Word exits. Each such exit writes a Process Exit Monitor entry in the Application log, which dates it.
`GlobalFlag (IFEO winword.exe)` `REG_DWORD0x00000200 (512)`	The matching IFEO GlobalFlag 0x200 arms silent exit monitoring for Word, the other half of the pair. Compare both keys' last write times to date the pair.

How to Read It

List the program subkeys under SilentProcessExit and read MonitorProcess and ReportingMode. Confirm GlobalFlag 0x200 is set for the same program under Image File Execution Options. A MonitorProcess pointing at an odd path is the payload.

When Windows Writes It: When the SilentProcessExit entry and the IFEO flag are written.
Which Windows Versions: Windows 7 to 11
Tools That Parse It: Autoruns, Registry Explorer, RECmd

Hunt It

Sees It DirectlyDeviceRegistryEvents

Defender records these writes within retention. A hit does not show the monitor ran, and it is armed only with the IFEO GlobalFlag on the same program.

KQLDefender XDR, Advanced hunting

// MonitorProcess set under SilentProcessExitDeviceRegistryEvents| where Timestamp > ago(30d)| where DeviceName startswith "ws-042"| where RegistryKey has "SilentProcessExit"| project Timestamp, ActionType, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessCommandLine

Confirm It With

One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what Silent Process Exit shows.

Image File Execution OptionsHolds the GlobalFlag this needs, so check the pair.
AmcacheGives the SHA-1 of the monitor program.
Monitor Process Starts, Security Event 4688Not in the RegistryShows the monitor program starting as the named program exits.

Sources

The facts on this page come from these public pages, which say more on each point.