windows enabled community high v1.0.0

mftrace

Trace log generation tool for Media Foundation Tools. Located at: C:\Program Files (x86)\Windows Kits\10\bin\10.0.16299.0\x86\mftrace.exe; C:\Program Files (x86)\Windows Kits\10\bin\10.0.16299.0\x64\mftrace.exe; C:\Program Files (x86)\Windows Kits\10\bin\x86\mftrace.exe.

📋 Live Preview 
mftrace
mftrace

Sandbox: execFile · Timeout: 30s

Capabilities

security.execution.command

Contract

Outputs

process.output

Command execution output

Side effects: process_spawn

Workflow Edges

Produces

process.output

Resource Profile

ResourceValue
CPUlow
Memory16 MB
Networklow
Disk I/Olow

Examples

Launch specified executable as a subprocess of Mftrace.exe. (Local execution of cmd.exe as a subprocess of Mftrace.exe.)

Mftrace.exe {PATH:.exe}

Detection

TypeRule / Indicator
sigma https://github.com/SigmaHQ/sigma/blob/19396788dbedc57249a46efed2bb1927abc376d4/rules/windows/process_creation/proc_creation_win_lolbin_mftrace.yml

Documentation

mftrace

mftrace is a Windows LOLBin. Trace log generation tool for Media Foundation Tools. Located at: C:\Program Files (x86)\Windows Kits\10\bin\10.0.16299.0\x86\mftrace.exe; C:\Program Files (x86)\Windows Kits\10\bin\10.0.16299.0\x64\mftrace.exe; C:\Program Files (x86)\Windows Kits\10\bin\x86\mftrace.exe.

References