Potential Mfdetours.DLL Sideloading

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•14

Detects potential DLL sideloading of "mfdetours.dll" when loaded by a process other than the legitimate "mftrace.exe" from its expected path. This technique can be abused to force load a malicious DLL named "mfdetours.dll" from the current directory of execution, allowing for persistence, privilege escalation, or defense evasion.