Windows Persistence via GlobalFlags and SilentProcessExit Registry Keys

This threat involves the exploitation of the Image File Execution Options (IFEO) registry configuration to gain persistence or facilitate stealthy process monitoring. By modifying the GlobalFlags value within an IFEO key, attackers can force a process to execute an arbitrary monitoring tool whenever it exits. This is frequently coupled with the SilentProcessExit registry key, which allows for advanced control over process termination behavior, such as launching a monitor process or capturing memory dumps. This technique is particularly dangerous because it can be used to achieve privilege escalation or hide malicious activity by hooking into legitimate system binaries, often bypassing standard autorun detection tools. Defenders should monitor registry modifications targeting these specific keys under the Windows NT CurrentVersion configuration tree.

Attack Chain

1. The attacker gains elevated administrative access to the target host.
2. The attacker identifies a target process frequently executed by the system or a user (e.g., explorer.exe).
3. The attacker creates or modifies the registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options[TargetProcess].
4. The attacker sets the GlobalFlag registry value to enable reporting or process monitoring (e.g., FLG_ENABLE_KDEBUG_SYMBOL_LOAD).
5. The attacker configures the SilentProcessExit key for the target process, specifying a malicious path in the MonitorProcess value.
6. The attacker configures the ReportingMode to ensure the monitor process is invoked upon the target process exit.
7. When the target process exits, the operating system automatically launches the binary specified in the MonitorProcess value with elevated privileges.
8. The monitor process executes arbitrary code, establishing persistent access or performing data exfiltration.

Impact

Successful exploitation allows for stealthy, high-privilege persistence that remains hidden from many standard persistence scanners. This mechanism can be used to gain unauthorized code execution every time a system process terminates or is restarted, potentially facilitating long-term access, lateral movement, and the silent collection of sensitive information or memory dumps from privileged processes like lsass.exe.

Recommendation

Deploy the provided Sigma rules to monitor for unauthorized modifications to the Windows registry. Prioritize alerts triggered by modifications to the Image File Execution Options and SilentProcessExit keys, as these are rarely changed by legitimate administrative activity in a steady-state environment.

• Enable Sysmon or Windows Registry auditing to capture Event ID 12 (Registry Create) and 13 (Registry Set Value).
• Use the provided Sigma rules to alert on modifications to the specific registry paths identified.
• Baseline existing IFEO configurations in your environment to distinguish between authorized debugging tools and malicious entries.