Elastic Defend high stable eql

Potential Defense Evasion via Filter Manager Control Program

Identifies attempt to unload a security driver via the Filter Manager Control Program.

View Source

Detection Logic

process where event.action == "start" and
 process.pe.original_file_name == "fltMC.exe" and
 process.args : "unload" and process.command_line : ("*security*", "*sysmon*", "*esensor*", "*Elastic*")

Field Validations

Loading…

Comments (0)

Loading comments...