DFIRHub

Windows registry artifactImage File Execution Options Injection

See documentation in Batch File for further information

  • Threat Hunting
  • 2 keys
  • SOFTWARE

Registry keys

2 keys that RECmd reads for this artifact

  • SOFTWAREDebugger
    Microsoft\Windows NT\CurrentVersion\Image File Execution Options\*

    See documentation in Batch File for further information

  • SOFTWARE
    Microsoft\Windows NT\CurrentVersion\SilentProcessExit\*

    See documentation in Batch File for further information

References

1 link

Source: RECmd/BatchExamples/DFIRBatch.reb(opens in new tab) v2.22 by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)