LOLBAS/yml/OtherMSBinaries/Mftrace.yml

---
Name: Mftrace.exe
Description: Trace log generation tool for Media Foundation Tools.
Author: 'Oddvar Moe'
Created: 2018-05-25
Commands:
  - Command: Mftrace.exe cmd.exe
    Description: Launch cmd.exe as a subprocess of Mftrace.exe.
    Usecase: Local execution of cmd.exe as a subprocess of Mftrace.exe.
    Category: Execute
    Privileges: User
    MitreID: T1127
    OperatingSystem: Windows
  - Command: Mftrace.exe powershell.exe
    Description: Launch cmd.exe as a subprocess of Mftrace.exe.
    Usecase: Local execution of powershell.exe as a subprocess of Mftrace.exe.
    Category: Execute
    Privileges: User
    MitreID: T1127
    OperatingSystem: Windows
Full_Path:
  - Path: C:\Program Files (x86)\Windows Kits\10\bin\10.0.16299.0\x86
  - Path: C:\Program Files (x86)\Windows Kits\10\bin\10.0.16299.0\x64
  - Path: C:\Program Files (x86)\Windows Kits\10\bin\x86
  - Path: C:\Program Files (x86)\Windows Kits\10\bin\x64
Code_Sample:
  - Code:
Detection:
  - Sigma: https://github.com/SigmaHQ/sigma/blob/19396788dbedc57249a46efed2bb1927abc376d4/rules/windows/process_creation/proc_creation_win_lolbin_mftrace.yml
Resources:
  - Link: https://twitter.com/0rbz_/status/988911181422186496
Acknowledgement:
  - Person: fabrizio
    Handle: '@0rbz_'
Initial commit - LOLBAS V2.0 2018-06-09 00:15:06 +02:00			`---`
			`Name: Mftrace.exe`
Completed template update of OterMSBinaries 2018-09-22 04:58:00 +02:00			`Description: Trace log generation tool for Media Foundation Tools.`
			`Author: 'Oddvar Moe'`
Standardise date formats (see https://yaml.org/type/timestamp.html) 2021-01-10 16:04:52 +01:00			`Created: 2018-05-25`
Initial commit - LOLBAS V2.0 2018-06-09 00:15:06 +02:00			`Commands:`
			`- Command: Mftrace.exe cmd.exe`
			`Description: Launch cmd.exe as a subprocess of Mftrace.exe.`
Completed template update of OterMSBinaries 2018-09-22 04:58:00 +02:00			`Usecase: Local execution of cmd.exe as a subprocess of Mftrace.exe.`
Update scripts with new template. Fixed mgmt script for webportal. Adjustments to existing yml files 2018-09-26 11:41:58 +02:00			`Category: Execute`
Completed template update of OterMSBinaries 2018-09-22 04:58:00 +02:00			`Privileges: User`
More changes (mainly changing generic T1218 to dev-specific T1127) 2021-11-05 21:06:57 +01:00			`MitreID: T1127`
Completed template update of OterMSBinaries 2018-09-22 04:58:00 +02:00			`OperatingSystem: Windows`
Initial commit - LOLBAS V2.0 2018-06-09 00:15:06 +02:00			`- Command: Mftrace.exe powershell.exe`
			`Description: Launch cmd.exe as a subprocess of Mftrace.exe.`
Completed template update of OterMSBinaries 2018-09-22 04:58:00 +02:00			`Usecase: Local execution of powershell.exe as a subprocess of Mftrace.exe.`
Update scripts with new template. Fixed mgmt script for webportal. Adjustments to existing yml files 2018-09-26 11:41:58 +02:00			`Category: Execute`
Completed template update of OterMSBinaries 2018-09-22 04:58:00 +02:00			`Privileges: User`
More changes (mainly changing generic T1218 to dev-specific T1127) 2021-11-05 21:06:57 +01:00			`MitreID: T1127`
Completed template update of OterMSBinaries 2018-09-22 04:58:00 +02:00			`OperatingSystem: Windows`
Major changes to Web portal - Small fixes to source files to adjust 2018-12-10 14:28:12 +01:00			`Full_Path:`
Update scripts with new template. Fixed mgmt script for webportal. Adjustments to existing yml files 2018-09-26 11:41:58 +02:00			`- Path: C:\Program Files (x86)\Windows Kits\10\bin\10.0.16299.0\x86`
			`- Path: C:\Program Files (x86)\Windows Kits\10\bin\10.0.16299.0\x64`
			`- Path: C:\Program Files (x86)\Windows Kits\10\bin\x86`
			`- Path: C:\Program Files (x86)\Windows Kits\10\bin\x64`
Major changes to Web portal - Small fixes to source files to adjust 2018-12-10 14:28:12 +01:00			`Code_Sample:`
Update scripts with new template. Fixed mgmt script for webportal. Adjustments to existing yml files 2018-09-26 11:41:58 +02:00			`- Code:`
			`Detection:`
$frack113$ Add sigma ref Detection (#272) * Add sigma ref * Add missing sigma ref * Fix sigma link * Remove by Defender * Remove by Defender 2022-12-29 15:51:15 +01:00			`- Sigma: https://github.com/SigmaHQ/sigma/blob/19396788dbedc57249a46efed2bb1927abc376d4/rules/windows/process_creation/proc_creation_win_lolbin_mftrace.yml`
Initial commit - LOLBAS V2.0 2018-06-09 00:15:06 +02:00			`Resources:`
Update scripts with new template. Fixed mgmt script for webportal. Adjustments to existing yml files 2018-09-26 11:41:58 +02:00			`- Link: https://twitter.com/0rbz_/status/988911181422186496`
Completed template update of OterMSBinaries 2018-09-22 04:58:00 +02:00			`Acknowledgement:`
			`- Person: fabrizio`
			`Handle: '@0rbz_'`