Potential Mfdetours.DLL Sideloading

 1title: Potential Mfdetours.DLL Sideloading
 2id: d2605a99-2218-4894-8fd3-2afb7946514d
 3status: test
 4description: Detects potential DLL sideloading of "mfdetours.dll". While using "mftrace.exe" it can be abused to attach to an arbitrary process and force load any DLL named "mfdetours.dll" from the current directory of execution.
 5references:
 6    - Internal Research
 7author: Nasreddine Bencherchali (Nextron Systems)
 8date: 2023-08-03
 9tags:
10    - attack.defense-evasion
11    - attack.privilege-escalation
12    - attack.t1574.001
13    - attack.t1574.002
14logsource:
15    category: image_load
16    product: windows
17detection:
18    selection:
19        ImageLoaded|endswith: '\mfdetours.dll'
20    filter_main_legit_path:
21        ImageLoaded|contains: ':\Program Files (x86)\Windows Kits\10\bin\'
22    condition: selection and not 1 of filter_main_*
23falsepositives:
24    - Unlikely
25level: medium