windows enabled community high v1.0.0

fltmc

Filter Manager Control Program used by Windows Located at: C:\Windows\System32\fltMC.exe.

📋 Live Preview 
fltmc
fltmc

Sandbox: execFile · Timeout: 30s

Capabilities

security.defense-evasion.tamper

Contract

Outputs

process.output

Command execution output

Side effects: filesystem_write

Workflow Edges

Produces

process.output

Resource Profile

ResourceValue
CPUlow
Memory16 MB
Networklow
Disk I/Olow

Examples

Unloads a driver used by security agents (Defense evasion)

fltMC.exe unload SysmonDrv

Detection

TypeRule / Indicator
sigma https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_fltmc_unload_driver_sysmon.yml
elastic https://github.com/elastic/detection-rules/blob/61afb1c1c0c3f50637b1bb194f3e6fb09f476e50/rules/windows/defense_evasion_via_filter_manager.toml
splunk https://github.com/splunk/security_content/blob/18f63553a9dc1a34122fa123deae2b2f9b9ea391/detections/endpoint/unload_sysmon_filter_driver.yml
ioc 4688 events with fltMC.exe

Documentation

fltmc

fltmc is a Windows LOLBin. Filter Manager Control Program used by Windows Located at: C:\Windows\System32\fltMC.exe.

References