Potential Mfdetours.DLL Sideloading

calendar Apr 28, 2026 · attack.persistence attack.privilege-escalation attack.execution attack.stealth attack.t1574.001  ·
Share on: linkedin copy

Detects potential DLL sideloading of "mfdetours.dll". While using "mftrace.exe" it can be abused to attach to an arbitrary process and force load any DLL named "mfdetours.dll" from the current directory of execution.

Sigma rule (View on GitHub)

 1title: Potential Mfdetours.DLL Sideloading
 2id: d2605a99-2218-4894-8fd3-2afb7946514d
 3status: test
 4description: Detects potential DLL sideloading of "mfdetours.dll". While using "mftrace.exe" it can be abused to attach to an arbitrary process and force load any DLL named "mfdetours.dll" from the current directory of execution.
 5references:
 6    - Internal Research
 7author: Nasreddine Bencherchali (Nextron Systems)
 8date: 2023-08-03
 9tags:
10    - attack.persistence
11    - attack.privilege-escalation
12    - attack.execution
13    - attack.stealth
14    - attack.t1574.001
15logsource:
16    category: image_load
17    product: windows
18detection:
19    selection:
20        ImageLoaded|endswith: '\mfdetours.dll'
21    filter_main_legit_path:
22        ImageLoaded|contains: ':\Program Files (x86)\Windows Kits\10\bin\'
23    condition: selection and not 1 of filter_main_*
24falsepositives:
25    - Unlikely
26level: medium

References

Related rules

to-top