Windows: Filter Driver Unload via fltMC.exe
Flags fltMC.exe executions that include "unload" to indicate potential filter driver unloading for defense impairment.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-02-13
- Updated
- 2026-07-31
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process executions where fltMC.exe is used with an unload command, indicating an attempt to unload a filter driver. Attackers may use this to impair endpoint monitoring or disrupt security components tied to filesystem filtering. It relies on Windows process creation telemetry, matching the process image/original filename and command-line text for "unload". Optional exclusions reduce noise from specific installer or agent-related unload activity.
Reporting behind it
- darkoperator.comhttps://www.darkoperator.com/blog/2018/10/5/operating-offensively-against-sysmon
- cybereason.comhttps://www.cybereason.com/blog/threat-analysis-report-lockbit-2.0-all-paths-lead-to-ransom
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_fltmc_unload_driver.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Filter Driver Unload via fltMC.exe"
id: 81d81735-46a9-4f88-9c77-789e93562be2
related:
- id: 4d7cda18-1b12-4e52-b45c-d28653210df8
type: derived
- id: 4931188c-178e-4ee7-a348-39e8a7a56821
type: derived
status: test
description: This rule flags process executions where fltMC.exe is used with an unload command, indicating an attempt to unload a filter driver. Attackers may use this to impair endpoint monitoring or disrupt security components tied to filesystem filtering. It relies on Windows process creation telemetry, matching the process image/original filename and command-line text for "unload". Optional exclusions reduce noise from specific installer or agent-related unload activity.
references:
- https://www.darkoperator.com/blog/2018/10/5/operating-offensively-against-sysmon
- https://www.cybereason.com/blog/threat-analysis-report-lockbit-2.0-all-paths-lead-to-ransom
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_fltmc_unload_driver.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-02-13
modified: 2025-10-07
tags:
- attack.stealth
- attack.defense-impairment
- attack.t1070
- attack.t1685
- attack.t1685.001
logsource:
product: windows
category: process_creation
detection:
selection_img:
- Image|endswith: \fltMC.exe
- OriginalFileName: fltMC.exe
selection_cli:
CommandLine|contains: unload
filter_optional_avira:
ParentImage|contains:
- \AppData\Local\Temp\
- :\Windows\Temp\
ParentImage|endswith: \endpoint-protection-installer-x64.tmp
CommandLine|endswith:
- unload rtp_filesystem_filter
- unload rtp_filter
filter_optional_manageengine:
ParentImage: C:\Program Files (x86)\ManageEngine\uems_agent\bin\dcfaservice64.exe
CommandLine|endswith: unload DFMFilter
condition: all of selection_* and not 1 of filter_optional_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1