Unsigned Mfdetours.DLL Sideloading

Status: test
Severity: high
Log source: category image_load, product windows
Author: Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects DLL sideloading of unsigned "mfdetours.dll". Executing "mftrace.exe" can be abused to attach to an arbitrary process and force load any DLL named "mfdetours.dll" from the current directory of execution.

Known false positives

Unlikely

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1574.001` Hijack Execution Flow: DLL
Stealth	`T1574.001` Hijack Execution Flow: DLL

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 7: Image loaded

Rule body

title: Unsigned Mfdetours.DLL Sideloading
id: 948a0953-f287-4806-bbcb-3b2e396df89f
related:
    - id: d2605a99-2218-4894-8fd3-2afb7946514d
      type: similar
status: test
description: Detects DLL sideloading of unsigned "mfdetours.dll". Executing "mftrace.exe" can be abused to attach to an arbitrary process and force load any DLL named "mfdetours.dll" from the current directory of execution.
references:
    - Internal Research
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-08-11
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.execution
    - attack.stealth
    - attack.t1574.001
logsource:
    category: image_load
    product: windows
detection:
    selection:
        ImageLoaded|endswith: '\mfdetours.dll'
    filter_main_legit_path:
        ImageLoaded|contains: ':\Program Files (x86)\Windows Kits\10\bin\'
        SignatureStatus: 'Valid'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unlikely
level: high

Stages and Predicates

Stage 0: `condition`

selection and not 1 of filter_main_*

Stage 1: `selection`

selection:
    ImageLoaded|endswith: '\mfdetours.dll'

Stage 2: `not filter_main_legit_path`

filter_main_legit_path:
    ImageLoaded|contains: ':\Program Files (x86)\Windows Kits\10\bin\'
    SignatureStatus: 'Valid'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`ImageLoaded`	match	`:\Program Files (x86)\Windows Kits\10\bin\`	`excludes:ImageLoaded` `field:"ImageLoaded" value:":\Program Files (x86)\Windows Kits\10\bin\"`
`SignatureStatus`	eq	`Valid`	`excludes:SignatureStatus` `field:"SignatureStatus" value:"Valid"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ImageLoaded`	ends_with	`\mfdetours.dll` corpus 2 (sigma 2)	`field:"ImageLoaded" kind:ends_with value:"\mfdetours.dll"`