From 6f2135e17352ee29f888080e25eb930880474805 Mon Sep 17 00:00:00 2001
From: Wietze <wietze@users.noreply.github.com>
Date: Tue, 4 Oct 2022 15:37:56 +0100
Subject: [PATCH] Updating category of fltMC to tamper

---
 yml/OSBinaries/FltMC.yml | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/yml/OSBinaries/FltMC.yml b/yml/OSBinaries/FltMC.yml
index bcc8caf..a863223 100644
--- a/yml/OSBinaries/FltMC.yml
+++ b/yml/OSBinaries/FltMC.yml
@@ -1,20 +1,18 @@
 ---
 Name: fltMC.exe
 Description: Filter Manager Control Program used by Windows
-Author: 'John Lambert'
-Created: '2021-09-18'
+Author: John Lambert
+Created: 2021-09-18
 Commands:
   - Command: fltMC.exe unload SysmonDrv
     Description: Unloads a driver used by security agents
     Usecase: Defense evasion
-    Category: ADS
+    Category: Tamper
     Privileges: Admin
     MitreID: T1562.001
     OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
 Full_Path:
   - Path: C:\Windows\System32\fltMC.exe
-Code_Sample:
-  - Code:
 Detection:
   - Sigma: https://github.com/SigmaHQ/sigma/blob/c27084dd0c432335fa4369e5002a61dfe0ab9c65/rules/windows/process_creation/win_sysmon_driver_unload.yml
   - Elastic: https://github.com/elastic/detection-rules/blob/61afb1c1c0c3f50637b1bb194f3e6fb09f476e50/rules/windows/defense_evasion_via_filter_manager.toml