huntrule

Windows Process Creation: Mftrace.exe Child Process Execution

Alerts on child processes spawned by Mftrace.exe, which can be abused to execute arbitrary binaries on Windows.

FreeUnreviewedSigmamediumv1
title: "Windows Process Creation: Mftrace.exe Child Process Execution"
id: 2b223f32-0c4e-4503-8684-290def6574c4
status: test
description: This rule flags when Mftrace.exe (the “Trace log generation tool for Media Foundation Tools”) spawns a child process. Attackers may abuse Mftrace.exe to run arbitrary binaries indirectly through a trusted tool, helping execution blend into normal activity. It relies on Windows process creation telemetry, specifically the parent process image name ending with \mftrace.exe.
references:
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Mftrace/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_mftrace_child_process.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-06-09
modified: 2023-08-03
tags:
  - attack.execution
  - attack.stealth
  - attack.t1127
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \mftrace.exe
  condition: selection
falsepositives:
  - Legitimate use for tracing purposes
level: medium
license: DRL-1.1
related:
  - id: 3d48c9d3-1aa6-418d-98d3-8fd3c01a564e
    type: derived

What it detects

This rule flags when Mftrace.exe (the “Trace log generation tool for Media Foundation Tools”) spawns a child process. Attackers may abuse Mftrace.exe to run arbitrary binaries indirectly through a trusted tool, helping execution blend into normal activity. It relies on Windows process creation telemetry, specifically the parent process image name ending with \mftrace.exe.

Known false positives

  • Legitimate use for tracing purposes

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.