.. / Mftrace.exe
Star

Trace log generation tool for Media Foundation Tools.


Paths:


Resources:
https://twitter.com/0rbz_/status/988911181422186496

Acknowledgement:
fabrizio - @0rbz_


Detection:



Execute

Launch cmd.exe as a subprocess of Mftrace.exe.
Mftrace.exe cmd.exe
Usecase:Local execution of cmd.exe as a subprocess of Mftrace.exe.
Privileges required:User
OS:Windows
Mitre:T1218



Launch cmd.exe as a subprocess of Mftrace.exe.
Mftrace.exe powershell.exe
Usecase:Local execution of powershell.exe as a subprocess of Mftrace.exe.
Privileges required:User
OS:Windows
Mitre:T1218