BIOC
Informational
✕
Manipulation of Application Verifier custom providers
The Application Verifier assists developers in quickly finding subtle programming errors that can be extremely difficult to identify with normal application testing. Using Application Verifier in Visual Studio makes it easier to create reliable applications by identifying errors caused by heap corruption, incorrect handle and critical section usage. Changing the providers could change handling. An attacker can use this ability to inject a custom verifier into any application. Once the custom verifier has been injected, the attacker now has full control over the application.
- Module:
- Platform Analytics
- Agent event type:
- Registry
- Category:
- Persistence
- Status:
- Enabled
ATT&CK tactics: Persistence (TA0003)
ATT&CK techniques: Event Triggered Execution: Image File Execution Options Injection (T1546.012)
Indicator:
Registry action type = all AND registry key name = *software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options* Host host os = windows
Preventable: yes