Potential Mftrace.EXE Abuse

calendar Aug 3, 2023 · attack.defense_evasion attack.t1127  ·
Share on: linkedin copy

Detects child processes of the "Trace log generation tool for Media Foundation Tools" (Mftrace.exe) which can abused to execute arbitrary binaries.

Sigma rule (View on GitHub)

 1title: Potential Mftrace.EXE Abuse
 2id: 3d48c9d3-1aa6-418d-98d3-8fd3c01a564e
 3status: experimental
 4description: Detects child processes of the "Trace log generation tool for Media Foundation Tools" (Mftrace.exe) which can abused to execute arbitrary binaries.
 5references:
 6    - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Mftrace/
 7author: Nasreddine Bencherchali (Nextron Systems)
 8date: 2022/06/09
 9modified: 2023/08/03
10tags:
11    - attack.defense_evasion
12    - attack.t1127
13logsource:
14    category: process_creation
15    product: windows
16detection:
17    selection:
18        ParentImage|endswith: '\mftrace.exe'
19    condition: selection
20falsepositives:
21    - Legitimate use for tracing purposes
22level: medium

References

  • Mftrace | LOLBAS

    Launch cmd.exe as a subprocess of Mftrace.exe. Mftrace.exe powershell.exe Use caseLocal execution of powershell.exe as a subprocess of Mftrace.exe. Privileges requiredUser Operating systemsWindows ...


    Read More

Related rules

to-top