Title:Unsigned Mfdetours.DLL Sideloading Status:test Description:Detects DLL sideloading of unsigned "mfdetours.dll". Executing "mftrace.exe" can be abused to attach to an arbitrary process and force load any DLL named "mfdetours.dll" from the current directory of execution. References: -Internal Research Author: Nasreddine Bencherchali (Nextron Systems) Date: 2023-08-11 modified:None Tags:
-'attack.persistence'
-'attack.privilege-escalation'
-'attack.execution'
-'attack.stealth'
-'attack.t1574.001'
Logsource:
category: image_load
product: windows
Detection: selection: ImageLoaded|endswith:
'\mfdetours.dll' filter_main_legit_path: ImageLoaded|contains:
':\Program Files (x86)\Windows Kits\10\bin\' SignatureStatus:
'Valid' condition:selection and not 1 of filter_main_* Falsepositives:
-Unlikely Level:high
