MalCommands — fltmc

#					tactics	techniques	os

detail

Command Line

fltmc.exe | findstr "385201"

Description

Abuse fltmc and findstr to discover if sysmon is running on the target system using the default altitude register.

Risk

High

Risk Reason

Use of fltmc in this manner is directly suspicious.

Fidelity

High

Fidelity Reason

Use of fltmc is typically rare in most organizations.

Operating Systems

Windows

Killchain Phases

Actions on Objectives

References

https://lolbas-project.github.io/lolbas/Binaries/FltMC/

TOOL DATA

Tool Name: fltmc

Tool URL: https://learn.microsoft.com/en-us/windows-hardware/drivers/ifs/development-and-testing-tools#fltmcexe-command

Tool Description: fltmc is a Microsoft utility used for minifilter driver management operations.

Common Tool Locations

C:\Windows\System32\fltMC.exe

Common Tool Arguments

load - Loads a given driver by name
unload - Unloads a given driver by name

MITRE ATT&CK TECHNIQUES

Technique: T1007 - System Service Discovery

URL: https://attack.mitre.org/techniques/T1007

Description: Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as sc query, tasklist /svc, systemctl --type=service, and net start. Adversaries may use the information from [System Service Discovery](https://attack.mitre.org/techniques/T1007) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Tactics:

Discovery