mftrace.exe

Media Foundation Tracing Application file version info (xCyclopedia)

LOLBAS Execute 6 Sigma rules name it 1 ATT&CK technique 1 documented command 4 known copies with hashes

How mftrace.exe is abused

documented by LOLBAS

Execute T1127 Trusted Developer Utilities Proxy Execution

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for mftrace.exe.

1 documented command

from LOLBAS, each read by the identifier

Execute T1127 Trusted Developer Utilities Proxy Execution User privileges

Launch specified executable as a subprocess of Mftrace.exe.

Mftrace.exe {PATH:.exe}

Identify

The command the identifier reads trips no Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for mftrace.exe, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for mftrace.exe. The identifier reads it with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

highSuspicious Shells Spawn by Java Utility KeytoolAndreas Hunkeler (@Karneades)

highSuspicious Child Process Of Manage Engine ServiceDeskFlorian Roth (Nextron Systems)

highSuspicious Processes Spawned by Java.EXEAndreas Hunkeler (@Karneades), Florian Roth

highSuspicious Microsoft OneNote Child ProcessTim Rauch (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Elastic (idea)

highSuspicious Outlook Child ProcessMichael Haag, Florian Roth (Nextron Systems), Markus Neis, Elastic, FPT.EagleEye Team

highSuspicious Microsoft Office Child ProcessFlorian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io

T1127Trusted Developer Utilities Proxy Execution

Is it the real mftrace.exe?

file version info and known copies

Installed inC:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm64\
C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm\
C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64\

Signed byMicrosoft Windows Kits Publisher

ProductMedia Foundation Tracing Application, Microsoft

DescriptionMedia Foundation Tracing Application

4 known copies

1.1.0.1 · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm\mftrace.exe · signed by Microsoft Windows Kits Publisher

4508dfeafd3d70c7bc5de59775a67936f993d55fafdfe81647fdfe061984f7aa

1.1.0.1 · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64\mftrace.exe · signed by Microsoft Corporation

737b3264a2c58fc6721acbab1eb33a905928b59524bc6b96f29da7527e7fa2ce

1.1.0.1 · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm64\mftrace.exe · signed by Microsoft Windows Kits Publisher

89bf81932290cb2dd2b0b4e3e027902b9a17349ae4cb36a086bf5ca02945d233

1.1.0.1 · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x86\mftrace.exe · signed by Microsoft Corporation

c8450299dba10daf152b3568517c6df5935def941fab4067ae39e829152ff3b1

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.