Possible Mfdetours.DLL Sideloading (via image_load)

title: Possible Mfdetours.DLL Sideloading (via image_load)
id: 63ac02df-810d-5571-be86-ef70c45723d3
status: stable
description: This rule detects potential DLL sideloading of "mfdetours.dll". While using "mftrace.exe" it can be misused to attach to an arbitrary process and force load any DLL named "mfdetours.dll" from the current directory of execution.
references:
    - https://attack.mitre.org/techniques/T1574/001/
    - Internal Research
author: Huntrule Team
date: 2026-02-04
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.execution
    - attack.stealth
    - attack.t1574.001
logsource:
    category: image_load
    product: windows
detection:
    selection:
        ImageLoaded|endswith: '\mfdetours.dll'
    filter_main_legit_path:
        ImageLoaded|contains: ':\Program Files (x86)\Windows Kits\10\bin\'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: medium