Potential Mftrace.EXE Abuse

Hunt Hypothesis

Detects child processes of the “Trace log generation tool for Media Foundation Tools” (Mftrace.exe) which can abused to execute arbitrary binaries.

Detection Rule

Sigma (Original)

title: Potential Mftrace.EXE Abuse
id: 3d48c9d3-1aa6-418d-98d3-8fd3c01a564e
status: test
description: Detects child processes of the "Trace log generation tool for Media Foundation Tools" (Mftrace.exe) which can abused to execute arbitrary binaries.
references:
    - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Mftrace/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-06-09
modified: 2023-08-03
tags:
    - attack.execution
    - attack.stealth
    - attack.t1127
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\mftrace.exe'
    condition: selection
falsepositives:
    - Legitimate use for tracing purposes
level: medium

KQL (Azure Sentinel)

imProcessCreate
| where ParentProcessName endswith "\\mftrace.exe" or ActingProcessName endswith "\\mftrace.exe"

Required Data Sources

False Positive Guidance

• Legitimate use for tracing purposes

MITRE ATT&CK Context

• Tactic: Execution
• Technique: T1127 — T1127

References

• https://lolbas-project.github.io/lolbas/OtherMSBinaries/Mftrace/
• SigmaHQ Rule