Skip to content

Hide Navigation Hide TOC

Unsigned Mfdetours.DLL Sideloading (948a0953-f287-4806-bbcb-3b2e396df89f)

Detects DLL sideloading of unsigned "mfdetours.dll". Executing "mftrace.exe" can be abused to attach to an arbitrary process and force load any DLL named "mfdetours.dll" from the current directory of execution.

Cluster A Galaxy A Cluster B Galaxy B Level
Unsigned Mfdetours.DLL Sideloading (948a0953-f287-4806-bbcb-3b2e396df89f) Sigma-Rules DLL - T1574.001 (2fee9321-3e71-4cf4-af24-d4d40d355b34) Attack Pattern 1
Hijack Execution Flow - T1574 (aedfca76-3b30-4866-b2aa-0f1d7fd1e4b6) Attack Pattern DLL - T1574.001 (2fee9321-3e71-4cf4-af24-d4d40d355b34) Attack Pattern 2