Sysmon Driver Unloaded Via Fltmc.EXE
Detects attempts to unload the Sysmon filter driver using 'fltmc.exe'. This activity is often indicative of an adversary trying to impair defenses and remove forensic evidence by disabling Sysmon's monitoring capabilities.
Sigma
