Indicator Blocking - Driver Unloaded

Hypothesis and description

Adversaries may attempt to evade system defenses by unloading minifilter drivers used by host-based sensors such as Sysmon through the use of the fltmc command-line utility. Accordingly, this analytic looks for command-line invocations of this utility when used to unload minifilter drivers.

Platforms: Windows
Domain: Host
Subtypes: Process
Submitted: 2020-09-10
Contributors: Olaf Hartong

ATT&CK coverage

Technique	Tactics	Coverage
T1562 Impair DefensesT1562.006	Stealth (formerly Defense Evasion)	Low

1 technique, 2 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.

T1562Impair Defenses
.006 Indicator Blocking

D3FEND techniques MITRE maps to this analytic

D3-PSA Process Spawn Analysis

Data model references

Fields from the CAR data model (object/action/field) the analytic reads.

Pseudocode and implementations

PseudocodePseudocode - fltmc invocationData model: CAR native

This is a pseudocode representation of the below splunk search.

processes = search Process:Create
fltmc_processes = filter processes where (
  exe = "fltmc.exe" AND command_line = "*unload*")
output fltmc_processes

SplunkSplunk search - fltmc invocationData model: Sysmon native

This Splunk search looks for process create events for the fltmc.exe utility and the specific command line used to unload minifilter drivers.

index=client EventCode=1 CommandLine="*unload*" (Image="C:\\Windows\\SysWOW64\\fltMC.exe" OR Image="C:\\Windows\\System32\\fltMC.exe")

LogPointLogPoint search - fltmc invocationData model: LogPoint native

This LogPoint search looks for process create events for the fltmc.exe utility and the specific command line used to unload minifilter drivers.

norm_id=WindowsSysmon command="*unload*" (image="C:\Windows\SysWOW64\fltMC.exe" OR image="C:\Windows\System32\fltMC.exe")

Across MITRE's defensive frameworks

Linked through the 1 ATT&CK technique above.

Counter with D3FEND

Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.

26 more in the full list

View CAR-2020-09-003 on car.mitre.org

Technique

Tactics

Coverage

T1562 Impair DefensesT1562.006

Stealth (formerly Defense Evasion)

Low