huntrule

Windows DLL Sideloading via mfdetours.dll loaded from Current Directory

Alerts on mfdetours.dll loads that may indicate DLL sideloading outside the expected Windows Kits location.

FreeUnreviewedSigmamediumv1
title: Windows DLL Sideloading via mfdetours.dll loaded from Current Directory
id: cac88179-d22e-4308-bea4-f4ae25464b8b
status: test
description: This rule flags Windows systems where a DLL named mfdetours.dll is loaded from a path other than a known Windows Kits 10 bin location. DLL sideloading matters because attackers can place a malicious mfdetours.dll so an executed helper process loads it from the current directory. The detection relies on image load telemetry (ImageLoaded paths ending in \mfdetours.dll) and filters out a specific legitimate bin path pattern.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_mfdetours.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-08-03
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|endswith: \mfdetours.dll
  filter_main_legit_path:
    ImageLoaded|contains: :\Program Files (x86)\Windows Kits\10\bin\
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unlikely
level: medium
license: DRL-1.1
related:
  - id: d2605a99-2218-4894-8fd3-2afb7946514d
    type: derived

What it detects

This rule flags Windows systems where a DLL named mfdetours.dll is loaded from a path other than a known Windows Kits 10 bin location. DLL sideloading matters because attackers can place a malicious mfdetours.dll so an executed helper process loads it from the current directory. The detection relies on image load telemetry (ImageLoaded paths ending in \mfdetours.dll) and filters out a specific legitimate bin path pattern.

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.