IFEO and Winlogon persistence

What it is

This page groups registry-based persistence that hijacks built-in Windows behaviour instead of adding an obvious autostart entry. All of it lives in the SOFTWARE hive (plus a per-user Winlogon key) and needs administrative rights to set up.

• Image File Execution Options (IFEO) is a debugging feature: a Debugger value under IFEO\<name>.exe makes Windows launch the "debugger" instead of the program, with the program's path as an argument. Pointing it at a payload hijacks every launch of that executable.
• Silent process exit monitoring (Windows 7 and later) launches a MonitorProcess when a monitored program exits.
• Accessibility backdoors replace or hijack sethc.exe, utilman.exe and similar binaries so that a key combination at the logon screen opens a SYSTEM shell.
• Winlogon values (Userinit, Shell, and on XP Notify) define what runs at each logon.
• AppInit_DLLs loads DLLs into every process that loads user32.dll.

Location

What it proves

• A hijack was configured: the executable targeted and the binary or command that replaces or follows it.
• Privilege: writing these keys (and replacing System32 binaries) requires administrator or SYSTEM rights, so a hit implies prior privileged access.
• Pre-logon access for accessibility backdoors: anyone reaching the logon screen, locally or over RDP without Network Level Authentication, gets a SYSTEM process.
• It does not prove the hijack fired. Look for execution of the payload and, for accessibility abuse, for sethc.exe/utilman.exe spawning cmd.exe.

Key fields

Timestamps

Retention and clearing

• Registry values stay until removed; old values can survive in hive transaction logs, volume shadow copies and unallocated hive space.
• A replaced accessibility binary may be restored by Windows File Protection or System File Checker, so a clean file today does not rule out past abuse; check the USN journal for renames and overwrites in System32.
• When a monitored process exits silently, the Application log records an entry from the Process Exit Monitor source.
• ReportingMode 0x2 with LocalDumpFolder is also abused to make Windows write a memory dump of lsass.exe; a SilentProcessExit\lsass.exe key is credential-theft evidence.

Collection

• KAPE target: RegistryHivesSystem (SOFTWARE) and RegistryHivesUser (per-user Winlogon). No dedicated target exists; the accessibility binaries are not collected by these targets, so hash them from the image or add a file collection for System32.
• Velociraptor (Windows.Triage.Targets): RegistryHivesSystem, RegistryHivesUser. Live: Windows.Persistence.Debug (IFEO Debugger) and Windows.Persistence.SilentProcessExit.
• Built-in:

reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" /s /v Debugger
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit" /s
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" /v AppInit_DLLs
certutil -hashfile C:\Windows\System32\sethc.exe SHA256

Parsing tools

• Registry Explorer / RECmd (Eric Zimmerman): review the keys and export them with community batch files.
• RegRipper: imagefile (IFEO Debugger, including WOW6432Node), winlogon_tln (alerts on non-default Userinit and Shell) and appinitdlls.
• Autoruns (Sysinternals, free): Image Hijacks, Winlogon and AppInit tabs, live or offline. Oddvar Moe showed in 2018 that GlobalFlag/SilentProcessExit persistence was not displayed by Autoruns at the time, so check those keys directly.
• Velociraptor: Windows.Persistence.Debug, Windows.Persistence.SilentProcessExit.
• Plaso: winlogon registry plugin.

Investigation tips

• List every IFEO subkey with a Debugger value; accessibility binaries and security tools are common targets. Process Explorer's "Replace Task Manager" option sets a legitimate Debugger on taskmgr.exe, so check the value's target.
• Check GlobalFlag values for bit 0x200 and match each one to a SilentProcessExit subkey.
• Hash sethc.exe, utilman.exe, osk.exe, Magnify.exe, Narrator.exe, DisplaySwitch.exe and AtBroker.exe: a hash equal to cmd.exe or explorer.exe, or a mismatched version resource, is a replaced binary.
• Look for Userinit with more than one entry and for Shell values other than explorer.exe, in both HKLM and every user's NTUSER.DAT.
• A LoadAppInit_DLLs of 1 on a Secure Boot machine is inert but still shows intent.
• Confirm execution with Prefetch of the payload, Security 4688 process creation (if audited), and WER or dump files for silent-exit abuse. Payloads are often LOLBins.