Identifier / Programs / Windows

fltmc.exe

Filter Manager Control Program file version info (xCyclopedia)

LOLBAS Tamper 3 Sigma rules name it 3 ATT&CK techniques 1 documented command 14 known copies with hashes

How fltmc.exe is abused

documented by LOLBAS

Tamper T1562.001

unload sysmondrv

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for fltmc.exe.

1 documented command

from LOLBAS, each read by the identifier

Tamper T1562.001 Admin privileges

Unloads a driver used by security agents

fltMC.exe unload SysmonDrv

Identify

Trips 2 Sigma rules: highSysmon Driver Unloaded Via Fltmc.EXE by Kirill Kiryanov, oscd.community; mediumFilter Driver Unloaded Via Fltmc.EXE by Nasreddine Bencherchali (Nextron Systems)

The command the identifier reads trips a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for fltmc.exe, by John Lambert, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for fltmc.exe. The identifier reads it with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

highSysmon Driver Unloaded Via Fltmc.EXEKirill Kiryanov, oscd.community

mediumFilter Driver Unloaded Via Fltmc.EXENasreddine Bencherchali (Nextron Systems)

highExecution via stordiag.exeAustin Songer (@austinsonger)

T1070Indicator Removal

T1685Disable or Modify Tools

T1685.001Disable or Modify Tools: Disable or Modify Windows Event Log

Is it the real fltmc.exe?

file version info and known copies

Installed inC:\Windows\system32\
C:\Windows\SysWOW64\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionFilter Manager Control Program

14 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\fltMC.exe · signed by Microsoft Windows

75b49f556dc136901327bb307b7c58ce98e8771ac3ac759fbc7c1f774e2931d8

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\fltMC.exe · signed by Microsoft Windows

9abaf5823e20b0ca3cb22e6dc484bff3db59868930706b8a2bfb12f44b9c64a0

10.0.19041.546 (WinBuild.160101.0800) · C:\Windows\SysWOW64\fltMC.exe · signed by Microsoft Windows

7e2a2a6d4ed446503a677a98edb90cf12838b5764ce863afddafb45f3b631597

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\fltMC.exe · signed by Microsoft Windows

074a471560cdc15ad2d982cadce9d3a081f70e11ac69e6b73111af2c02c6375e

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\fltMC.exe · signed by Microsoft Windows

d127cc48c864a84df91c3132314ec9698855dfbb6e9aff97ab13023e9eaff8b4

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\fltMC.exe · signed by Microsoft Windows

ed93a19342f39822378f3dec9cd3f6bf48ef44b1a26fbea41d6932a79ce4002e

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\fltMC.exe · signed by Microsoft Windows

340322093c8e2ad6f8bb41723fa9b04b5844e133624395dd0c17013d3b58dfd8

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\fltMC.exe · signed by Microsoft Windows

fa85855b3cc7e02b4874304bdcebe7ece715dd03802970eedd1c4a88e5b814d4

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\fltMC.exe · signed by Microsoft Windows

7c0b13d17fab5ea169b9c637c604b71503f86728c03d27c1ab81a18f8caae391

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\fltMC.exe · signed by Microsoft Windows

e353c7945308c1220319cbb69e2a2370334d7849304eb3bb7b1d2fd811c4324e

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\fltMC.exe · signed by Microsoft Windows

aecb882985f84a7531a27cf401bf86dbec9191fdf6993c1317f35beb1e32ea94

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\fltMC.exe · signed by Microsoft Windows

d6b6f7b65ef86113db37c551d8b569bad3d0278f77f908fd53759a8a99cc1769

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\fltMC.exe · not signed

44d21763d35630c2ce68a2a64d4eb047b83847bcefe4ae3911545b8faa22ef8b

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\fltMC.exe · not signed

8b1e84ec34d16036b66114838ef98352443f27d2f355d982c903f7afe572166a

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.