.. /fltMC.exe
Star

Tamper

Filter Manager Control Program used by Windows

Paths:

Resources:

Acknowledgements:

Detections:

Tamper

  1. Unloads a driver used by security agents

    fltMC.exe unload SysmonDrv
    Use case
    Defense evasion
    Privileges required
    Admin
    Operating systems
    Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
    ATT&CK® technique
    T1562.001