ATT&CK technique
View on MITRE ATT&CK →
T1546.012
Image File Execution Options Injection
Privilege EscalationPersistence
8 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| splunk | Registry Keys Used For Privilege Escalation | production | 2026-10-09 |
| splunk | Windows Event Triggered Image File Execution Options Injection | production | 2026-10-09 |
| elastic | Image File Execution Options Injection | production | 2026-09-18 |
| elastic | Werfault ReflectDebugger Persistence | production | 2026-09-18 |
| elastic | Uncommon Registry Persistence Change | production | 2026-09-18 |
| elastic | Suspicious WerFault Child Process | production | 2026-09-18 |
| sigma | Potential Persistence Via App Paths Default Property | test | 2023-08-17 |
| sigma | Potential Persistence Via GlobalFlags | test | 2023-06-05 |