← Back to ATT&CK index
T1546.012sub-technique
Image File Execution Options Injection
View on attack.mitre.org →3 syscalls implement this technique
- NtCreateKey
Creates or opens a registry key — the kernel-level primitive behind every persistence beacon written to the registry.
- NtSetValueKey
Writes a named value into an open registry key — the workhorse for Run-key and IFEO persistence.
- NtEnumerateKey
Enumerates subkeys of a registry key — used to walk AutoRun, IFEO and Services for persistence discovery.