Potential Mftrace.exe Abuse for Proxy Execution
This rule detects the creation of child processes by 'Mftrace.exe', which is a legitimate Windows utility (Trace log generation tool for Media Foundation Tools). Adversaries can abuse 'Mftrace.exe' to execute arbitrary binaries, effectively bypassing application whitelisting or other security controls by proxying execution through a trusted process. The rule specifically looks for any process that has 'mftrace.exe' as its direct parent.
Sigma
