LCRYX Ransomware IFEO cmd.exe Debugger Hijack and Run Key Persistence

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•1

This rule detects potential persistence mechanisms by monitoring modifications to specific Windows registry keys. It looks for the creation or modification of 'Image File Execution Options' (IFEO) debugger keys, which can be used to hijack process execution, and specific 'Run' keys that could be used for unauthorized startup execution. The rule focuses on these activities when initiated by script interpreters like wscript.exe or cscript.exe.