Windows mftrace.exe DLL sideloading of unsigned mfdetours.dll

Alerts on loading unsigned \mfdetours.dll, consistent with DLL sideloading abuse via mftrace.exe.

FreeUnreviewedSigmahighv1

windows-mftrace-exe-dll-sideloading-of-unsigned-mfdetours-dll-948a0953

title: Windows mftrace.exe DLL sideloading of unsigned mfdetours.dll
id: 46cd69d5-ded5-4467-8e2a-d35f51468733
related:
  - id: d2605a99-2218-4894-8fd3-2afb7946514d
    type: similar
  - id: 948a0953-f287-4806-bbcb-3b2e396df89f
    type: derived
status: test
description: This rule flags Windows image loads where an mfdetours.dll file is loaded from the current execution context and is unsigned. DLL sideloading can be used to run attacker-controlled code without modifying an executable, increasing stealth and enabling persistence or privilege escalation. The detection relies on Windows image-load telemetry for ImageLoaded events, specifically the loaded path ending with \mfdetours.dll and the SignatureStatus field to exclude known valid entries.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_mfdetours_unsigned.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-08-11
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|endswith: \mfdetours.dll
  filter_main_legit_path:
    ImageLoaded|contains: :\Program Files (x86)\Windows Kits\10\bin\
    SignatureStatus: Valid
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1

What it detects

This rule flags Windows image loads where an mfdetours.dll file is loaded from the current execution context and is unsigned. DLL sideloading can be used to run attacker-controlled code without modifying an executable, increasing stealth and enabling persistence or privilege escalation. The detection relies on Windows image-load telemetry for ImageLoaded events, specifically the loaded path ending with \mfdetours.dll and the SignatureStatus field to exclude known valid entries.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.