Unsigned Mfdetours.DLL Sideloading

calendar Apr 28, 2026 · attack.persistence attack.privilege-escalation attack.execution attack.stealth attack.t1574.001  ·
Share on: linkedin copy

Detects DLL sideloading of unsigned "mfdetours.dll". Executing "mftrace.exe" can be abused to attach to an arbitrary process and force load any DLL named "mfdetours.dll" from the current directory of execution.

Sigma rule (View on GitHub)

 1title: Unsigned Mfdetours.DLL Sideloading
 2id: 948a0953-f287-4806-bbcb-3b2e396df89f
 3related:
 4    - id: d2605a99-2218-4894-8fd3-2afb7946514d
 5      type: similar
 6status: test
 7description: Detects DLL sideloading of unsigned "mfdetours.dll". Executing "mftrace.exe" can be abused to attach to an arbitrary process and force load any DLL named "mfdetours.dll" from the current directory of execution.
 8references:
 9    - Internal Research
10author: Nasreddine Bencherchali (Nextron Systems)
11date: 2023-08-11
12tags:
13    - attack.persistence
14    - attack.privilege-escalation
15    - attack.execution
16    - attack.stealth
17    - attack.t1574.001
18logsource:
19    category: image_load
20    product: windows
21detection:
22    selection:
23        ImageLoaded|endswith: '\mfdetours.dll'
24    filter_main_legit_path:
25        ImageLoaded|contains: ':\Program Files (x86)\Windows Kits\10\bin\'
26        SignatureStatus: 'Valid'
27    condition: selection and not 1 of filter_main_*
28falsepositives:
29    - Unlikely
30level: high

References

Related rules

to-top