Detection rules › Sigma

Unsigned Mfdetours.DLL Sideloading

Severity
high
Author
Nasreddine Bencherchali (Nextron Systems)
Source
upstream

Detects DLL sideloading of unsigned "mfdetours.dll". Executing "mftrace.exe" can be abused to attach to an arbitrary process and force load any DLL named "mfdetours.dll" from the current directory of execution.

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1574.001 Hijack Execution Flow: DLL
Privilege EscalationT1574.001 Hijack Execution Flow: DLL
Defense EvasionT1574.001 Hijack Execution Flow: DLL

Event coverage

ProviderEvent IDTitle
Sysmon7Image loaded

Stages and Predicates

Stage 1: selection

ImageLoaded|endswith: '\mfdetours.dll'

Stage 2: not 1 of filter_main_legit_path

ImageLoaded|contains: ':\Program Files (x86)\Windows Kits\10\bin\'
SignatureStatus: Valid

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
ImageLoadedends_with
  • \mfdetours.dll corpus 2 (sigma 2)
ImageLoadedmatch
  • :\Program Files (x86)\Windows Kits\10\bin\ corpus 2 (sigma 2)
SignatureStatuseq
  • Valid corpus 4 (sigma 4)