Detection rules › Sigma
Unsigned Mfdetours.DLL Sideloading
Detects DLL sideloading of unsigned "mfdetours.dll". Executing "mftrace.exe" can be abused to attach to an arbitrary process and force load any DLL named "mfdetours.dll" from the current directory of execution.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | T1574.001 Hijack Execution Flow: DLL |
| Privilege Escalation | T1574.001 Hijack Execution Flow: DLL |
| Defense Evasion | T1574.001 Hijack Execution Flow: DLL |
Event coverage
| Provider | Event ID | Title |
|---|---|---|
| Sysmon | 7 | Image loaded |
Stages and Predicates
Stage 1: selection
ImageLoaded|endswith: '\mfdetours.dll'
Stage 2: not 1 of filter_main_legit_path
ImageLoaded|contains: ':\Program Files (x86)\Windows Kits\10\bin\'
SignatureStatus: Valid
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
ImageLoaded | ends_with |
|
ImageLoaded | match |
|
SignatureStatus | eq |
|