Filter Driver Unloaded Via Fltmc.EXE — Detection Rule

Detect filter driver unloading activity via fltmc.exe

Read the full analysis on IntelFusions