Skip to content

Hide Navigation Hide TOC

Unsigned Mfdetours.DLL Sideloading (948a0953-f287-4806-bbcb-3b2e396df89f)

Detects DLL sideloading of unsigned "mfdetours.dll". Executing "mftrace.exe" can be abused to attach to an arbitrary process and force load any DLL named "mfdetours.dll" from the current directory of execution.

Cluster A Galaxy A Cluster B Galaxy B Level
Unsigned Mfdetours.DLL Sideloading (948a0953-f287-4806-bbcb-3b2e396df89f) Sigma-Rules DLL Side-Loading - T1574.002 (e64c62cf-9cd7-4a14-94ec-cdaac43ab44b) Attack Pattern 1
Unsigned Mfdetours.DLL Sideloading (948a0953-f287-4806-bbcb-3b2e396df89f) Sigma-Rules DLL Search Order Hijacking - T1574.001 (2fee9321-3e71-4cf4-af24-d4d40d355b34) Attack Pattern 1
DLL Side-Loading - T1574.002 (e64c62cf-9cd7-4a14-94ec-cdaac43ab44b) Attack Pattern Hijack Execution Flow - T1574 (aedfca76-3b30-4866-b2aa-0f1d7fd1e4b6) Attack Pattern 2
Hijack Execution Flow - T1574 (aedfca76-3b30-4866-b2aa-0f1d7fd1e4b6) Attack Pattern DLL Search Order Hijacking - T1574.001 (2fee9321-3e71-4cf4-af24-d4d40d355b34) Attack Pattern 2