CAR-2020-09-003.yaml

---
title: Indicator Blocking - Driver Unloaded
submission_date: 2020/09/10
information_domain: 'Host'
platforms:
  - Windows
subtypes: 
  - Process
analytic_types:
  - TTP
contributors:
  - Olaf Hartong
id: CAR-2020-09-003
description: |-
  Adversaries may attempt to evade system defenses by unloading minifilter drivers used by host-based sensors such as Sysmon through the use of the fltmc command-line utility. Accordingly, this analytic looks for command-line invocations of this utility when used to unload minifilter drivers.
coverage:
  - technique: T1562 
    coverage: Low
    subtechniques: 
      - T1562.006
    tactics: 
      - TA0005
implementations:
- name: Pseudocode - fltmc invocation
  description: This is a pseudocode representation of the below splunk search.
  code: |- 
    processes = search Process:Create
    fltmc_processes = filter processes where (
      exe = "fltmc.exe" AND command_line = "*unload*")
    output fltmc_processes
  data_model: CAR native
  type: Pseudocode
- name: Splunk search - fltmc invocation
  description: This Splunk search looks for process create events for the fltmc.exe utility and the specific command line used to unload minifilter drivers.
  code: |- 
    index=client EventCode=1 CommandLine="*unload*" (Image="C:\\Windows\\SysWOW64\\fltMC.exe" OR Image="C:\\Windows\\System32\\fltMC.exe") 
  data_model: Sysmon native
  type: Splunk
- name: LogPoint search - fltmc invocation
  description: This LogPoint search looks for process create events for the fltmc.exe utility and the specific command line used to unload minifilter drivers.
  code: |- 
    norm_id=WindowsSysmon command="*unload*" (image="C:\Windows\SysWOW64\fltMC.exe" OR image="C:\Windows\System32\fltMC.exe") 
  data_model: LogPoint native
  type: LogPoint
data_model_references:
  - process/create/exe
  - process/create/command_line
d3fend_mappings:
  - iri: d3f:ProcessSpawnAnalysis
    id: D3-PSA
    label: Process Spawn Analysis