persist via Image File Execution Options registry key

rule:
  meta:
    name: persist via Image File Execution Options registry key
    namespace: persistence/registry
    authors:
      - j.j.vannielen@utwente.nl
    scopes:
      static: function
      dynamic: call
    att&ck:
      - Persistence::Event Triggered Execution::Image File Execution Options Injection [T1546.012]
    references:
      - https://www.malwarebytes.com/blog/101/2015/12/an-introduction-to-image-file-execution-options
      - https://oddvar.moe/2018/04/10/persistence-using-globalflags-in-image-file-execution-options-hidden-from-autoruns-exe/
  features:
    - and:
      - match: set registry value
      - string: /Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\/i
      - string: /Debugger/i