Skip to content

Hide Navigation Hide TOC

Unsigned Mfdetours.DLL Sideloading (948a0953-f287-4806-bbcb-3b2e396df89f)

Detects DLL sideloading of unsigned "mfdetours.dll". Executing "mftrace.exe" can be abused to attach to an arbitrary process and force load any DLL named "mfdetours.dll" from the current directory of execution.

Cluster A Galaxy A Cluster B Galaxy B Level
DLL - T1574.001 (2fee9321-3e71-4cf4-af24-d4d40d355b34) Attack Pattern Unsigned Mfdetours.DLL Sideloading (948a0953-f287-4806-bbcb-3b2e396df89f) Sigma-Rules 1
DLL - T1574.001 (2fee9321-3e71-4cf4-af24-d4d40d355b34) Attack Pattern Hijack Execution Flow - T1574 (aedfca76-3b30-4866-b2aa-0f1d7fd1e4b6) Attack Pattern 2