huntrule

Windows Filter Driver Unload Triggered by fltMC.exe Process Execution

Flags fltMC.exe executions that include "unload" to indicate potential filter driver unloading for defense impairment.

FreeUnreviewedSigmamediumv1
title: Windows Filter Driver Unload Triggered by fltMC.exe Process Execution
id: 81d81735-46a9-4f88-9c77-789e93562be2
related:
  - id: 4d7cda18-1b12-4e52-b45c-d28653210df8
    type: derived
  - id: 4931188c-178e-4ee7-a348-39e8a7a56821
    type: derived
status: test
description: This rule detects execution of fltMC.exe with a command line containing the keyword "unload", indicating an attempt to unload a Windows filter driver. Unloading drivers can be used to impair defensive components or disrupt endpoint filtering behavior. The detection relies on Windows process creation telemetry, matching the process image name (fltMC.exe) and the unload-related command line content, with exclusions for specific installer/agent parent processes.
references:
  - https://www.darkoperator.com/blog/2018/10/5/operating-offensively-against-sysmon
  - https://www.cybereason.com/blog/threat-analysis-report-lockbit-2.0-all-paths-lead-to-ransom
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_fltmc_unload_driver.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-02-13
modified: 2025-10-07
tags:
  - attack.stealth
  - attack.defense-impairment
  - attack.t1070
  - attack.t1685
  - attack.t1685.001
logsource:
  product: windows
  category: process_creation
detection:
  selection_img:
    - Image|endswith: \fltMC.exe
    - OriginalFileName: fltMC.exe
  selection_cli:
    CommandLine|contains: unload
  filter_optional_avira:
    ParentImage|contains:
      - \AppData\Local\Temp\
      - :\Windows\Temp\
    ParentImage|endswith: \endpoint-protection-installer-x64.tmp
    CommandLine|endswith:
      - unload rtp_filesystem_filter
      - unload rtp_filter
  filter_optional_manageengine:
    ParentImage: C:\Program Files (x86)\ManageEngine\uems_agent\bin\dcfaservice64.exe
    CommandLine|endswith: unload DFMFilter
  condition: all of selection_* and not 1 of filter_optional_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1

What it detects

This rule detects execution of fltMC.exe with a command line containing the keyword "unload", indicating an attempt to unload a Windows filter driver. Unloading drivers can be used to impair defensive components or disrupt endpoint filtering behavior. The detection relies on Windows process creation telemetry, matching the process image name (fltMC.exe) and the unload-related command line content, with exclusions for specific installer/agent parent processes.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.