title: Sysmon Driver Unload
author: Kirill Kiryanov, oscd.community
date: 2019/10/23
description: Detect possible Sysmon driver unload
detection:
  SELECTION_1:
    EventID: 1
  SELECTION_2:
    Image: '*\fltmc.exe'
  SELECTION_3:
    CommandLine: '*unload*'
  SELECTION_4:
    CommandLine: '*sys*'
  condition: (SELECTION_1 and SELECTION_2 and SELECTION_3 and SELECTION_4)
falsepositives:
- Unknown
fields:
- CommandLine
- Details
id: 4d7cda18-1b12-4e52-b45c-d28653210df8
level: high
logsource:
  category: process_creation
  product: windows
modified: 2021/09/27
references:
- https://www.darkoperator.com/blog/2018/10/5/operating-offensively-against-sysmon
status: experimental
tags:
- attack.defense_evasion
- attack.t1070
- attack.t1562
- attack.t1562.002
ruletype: SIGMA