value: SDBbot has the ability to use image file execution options for persistence if it detects it is running with admin privileges on a Windows version newer than Windows 7. 
name: Event Triggered Execution: Image File Execution Options Injection