value:  SUNBURST created an Image File Execution Options (IFEO) Debugger registry value for the process dllhost.exe to trigger the installation of Cobalt Strike. 
name: Event Triggered Execution: Image File Execution Options Injection