Skip to content

LIVING OFF THE LAND / OS BINARIES

fltMC.exe

Filter Manager Control Program used by Windows

01COMMAND EXAMPLES

01ATT&CK TECHNIQUES

03DETECTION RESOURCES

01CAPABILITIES

01 / TRADECRAFT

Command reference

1 examples

Tamper1

EXAMPLE 01T1562.001

Unloads a driver used by security agents

COMMAND

fltMC.exe unload SysmonDrv

USE CASE: Defense evasion
PRIVILEGES: Admin
OPERATING SYSTEM: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

02 / ON DISK

Known paths

C:\Windows\System32\fltMC.exe

03 / DEFENSIVE INTELLIGENCE

Detection & indicators

3 resources

Indicators & detection notes

IOC
4688 events with fltMC.exe

FURTHER READING

Research & resources

READoperating offensively against sysmonwww.darkoperator.com

COMMUNITY RESEARCH

Acknowledgements

Carlos Perez@Carlos_Perez