Windows Sysmon Filter Driver Unloaded Using fltMC.exe

title: Windows Sysmon Filter Driver Unloaded Using fltMC.exe
id: 1567156c-ed87-4e84-9873-7e2df3e6bece
related:
  - id: 4931188c-178e-4ee7-a348-39e8a7a56821
    type: similar
  - id: 4d7cda18-1b12-4e52-b45c-d28653210df8
    type: derived
status: test
description: This rule flags process executions of fltMC.exe where the command line includes both “unload” and “sysmon”, indicating an attempt to unload the Sysmon filter driver. Attackers may use driver unloading to impair or evade security monitoring by disrupting Sysmon’s ability to collect events. It relies on Windows process creation telemetry, matching the image/original file name and required command-line substrings.
references:
  - https://www.darkoperator.com/blog/2018/10/5/operating-offensively-against-sysmon
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_fltmc_unload_driver_sysmon.yml
author: Kirill Kiryanov, oscd.community, Huntrule Team
date: 2019-10-23
modified: 2023-02-13
tags:
  - attack.stealth
  - attack.defense-impairment
  - attack.t1070
  - attack.t1685
  - attack.t1685.001
logsource:
  product: windows
  category: process_creation
detection:
  selection_img:
    - Image|endswith: \fltMC.exe
    - OriginalFileName: fltMC.exe
  selection_cli:
    CommandLine|contains|all:
      - unload
      - sysmon
  condition: all of selection_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1