IFEO Offline Hive Paralyze

A technique to disable security tools by modifying the Image File Execution Options (IFEO) registry hive offline — bypassing real-time AV hooks that monitor live registry writes.

Method

1. Enable SeBackupPrivilege and SeRestorePrivilege.^[strings.txt:10255]
2. Save the live HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options hive to disk using RegSaveKeyExW.^[strings.txt:10261]
3. Load the saved hive into a temporary mount point via RegLoadKeyW.^[strings.txt:10262]
4. Modify the offline hive, setting the Debugger value for target executables (e.g. MpDefenderCoreService.exe, SecurityHealthService.exe) to point to a benign decoy (systray.exe).^[strings.txt:10258]
5. Restore the modified hive back to the live registry with RegRestoreKeyW.^[strings.txt:10265]
6. Result: Windows Defender and Security Health executables launch systray.exe instead of themselves, effectively neutering them.

Also Known As

• Permanent disable (IFEO + SYSTEM + Start=4) — combines registry IFEO manipulation with service startup-type modification to Disabled (Start=4).^[strings.txt:10276]

Detection Notes

• Monitor for RegSaveKeyExW, RegLoadKeyW, and RegRestoreKeyW calls in sequence.
• Anomalous Debugger values under Image File Execution Options for security products.
• Privilege requirements: Administrator + SeLoadDriverPrivilege or equivalent.^[strings.txt:10286]

Capabilities

• ifeo-offline-hive-paralyze
• service-start-type-disable