LOL · OtherMSBinary

Mftrace.exe

1 techniqueWindowsLOLBASGPL-3.0

Execute

ExecutionWindows

Launch specified executable as a subprocess of Mftrace.exe.

Use Local execution of cmd.exe as a subprocess of Mftrace.exe.

Mftrace.exe {PATH:.exe}

Evidence: Upstream reference
Environment: Local host
Context: user
Native: Execute
MITRE: T1127
Detection: Sigma: github.com/SigmaHQ/sigma/blob/19396788dbedc57249a46efed2bb1927abc376d4/rules/windows/process_creation/proc_creation_win_lolbin_mftrace.yml
Refs: twitter.com/0rbz_/status/988911181422186496
lolbas-project.github.io/lolbas/OtherMSBinaries/Mftrace/