Trace log generation tool for Media Foundation Tools.
Mftrace.exe cmd.exe
Launch cmd.exe as a subprocess of Mftrace.exe.
Local execution of cmd.exe as a subprocess of Mftrace.exe.
C:\Program Files (x86)\Windows Kits\10\bin\10.0.16299.0\x86, C:\Program Files (x86)\Windows Kits\10\bin\10.0.16299.0\x64, C:\Program Files (x86)\Windows Kits\10\bin\x86, C:\Program Files (x86)\Windows Kits\10\bin\x64
Sigma: https://github.com/SigmaHQ/sigma/blob/19396788dbedc57249a46efed2bb1927abc376d4/rules/windows/process_creation/proc_creation_win_lolbin_mftrace.yml
fabrizio (@0rbz_)