Title:Potential Mftrace.EXE Abuse Status:test Description:Detects child processes of the "Trace log generation tool for Media Foundation Tools" (Mftrace.exe) which can abused to execute arbitrary binaries. References: -https://lolbas-project.github.io/lolbas/OtherMSBinaries/Mftrace/ Author: Nasreddine Bencherchali (Nextron Systems) Date: 2022-06-09 modified:2023-08-03 Tags:
-'attack.execution'
-'attack.stealth'
-'attack.t1127'
Logsource:
category: process_creation
product: windows
Detection: selection: ParentImage|endswith:
'\mftrace.exe' condition:selection Falsepositives:
-Legitimate use for tracing purposes Level:medium
