1200KM / simulation
T1546.012 Image File Execution Options Injection — Attack Simulation
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by Image File Execution Options (IFEO) debuggers. IFEOs enable a developer to attach a debugger to an application. When a process is created, a debugger present in an application’s IFEO will be prepended to the application’s name, effectively launching the new process under the debugger (e.g., C:\dbg\ntsd.exe -g notepad.exe). IFEOs can be set…
Technique description
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by Image File Execution Options (IFEO) debuggers. IFEOs enable a developer to attach a debugger to an application. When a process is created, a debugger present in an application’s IFEO will be prepended to the application’s name, effectively launching the new process under the debugger (e.g., C:\dbg\ntsd.exe -g notepad.exe). IFEOs can be set…
At least one platform-compatible Atomic procedure is documented. Individual review, lab prerequisites, and validation remain required.
Official ATT&CK definition · Detection rules and anomaly models
Documented simulation candidates
- GlobalFlags in Image File Execution Options
Procedure 13117939-c9b2-4a43-999e-0a543df92f0d; elevation required; cleanup present, not reviewed. Not executed or individually validated.
- IFEO Global Flags
Procedure 46b1f278-c8ee-4aa5-acce-65e77b11f3c1; elevation required; cleanup present, not reviewed. Not executed or individually validated.
- IFEO Add Debugger
Procedure fdda2626-5234-4c90-b163-60849a24c0b8; elevation required; cleanup present, not reviewed. Not executed or individually validated.
Connected ecosystem references
Linked tags
Detection and collection
Attack tools
No reviewed association in this snapshot.
Existing research
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.