Potential Mftrace.EXE Abuse

calendar Aug 12, 2024 · attack.defense-evasion attack.t1127  ·
Share on: linkedin copy

Detects child processes of the "Trace log generation tool for Media Foundation Tools" (Mftrace.exe) which can abused to execute arbitrary binaries.

Sigma rule (View on GitHub)

 1title: Potential Mftrace.EXE Abuse
 2id: 3d48c9d3-1aa6-418d-98d3-8fd3c01a564e
 3status: test
 4description: Detects child processes of the "Trace log generation tool for Media Foundation Tools" (Mftrace.exe) which can abused to execute arbitrary binaries.
 5references:
 6    - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Mftrace/
 7author: Nasreddine Bencherchali (Nextron Systems)
 8date: 2022-06-09
 9modified: 2023-08-03
10tags:
11    - attack.defense-evasion
12    - attack.t1127
13logsource:
14    category: process_creation
15    product: windows
16detection:
17    selection:
18        ParentImage|endswith: '\mftrace.exe'
19    condition: selection
20falsepositives:
21    - Legitimate use for tracing purposes
22level: medium

References

  • Mftrace on LOLBAS

    Mftrace.exe is a living-of-the-land file containing unexpected functionality that can be abused by attackers; this page lists all its use cases.


    Read More

Related rules

to-top