Sysmon Driver Unloaded Via Fltmc.EXE — Detection Rule

Detects possible Sysmon filter driver unloaded via fltmc.exe

Read the full analysis on IntelFusions