All Detections

Unsigned Mfdetours.DLL Sideloading

Yamato Security Hayabusa@YamatoSecurityHayabusa
updated Jun 24, 202504

Detects DLL sideloading of unsigned "mfdetours.dll". Executing "mftrace.exe" can be abused to attach to an arbitrary process and force load any DLL named "mfdetours.dll" from the current directory of execution.

Sigma