Image File Execution Options (IFEO) Injection

Rory Wagner@Sleuthifer

•updated Jul 9, 2025•2•1•87

Detects suspicious registry modifications for IFEO entries which can be used by attackers for persistence. This is based off of testing with Atomic Red Team tests - https://www.atomicredteam.io/atomic-red-team/atomics/T1546.012