All Products: How To Check Filter Level Drivers and Elevation

[#1]

Environment

• Microsoft Windows: All Supported Versions

Objective

Check to see what drivers are installed and their elevations to determine if one security software is detecting an event before another

Resolution

1. Run CMD as Administrator
2. FLTMC filters
   • Each filter level driver will be listed with its elevation
   • Lower elevations will see an event before higher elevations
   • If a file is deleted by a lower level elevation driver then a higher elevation driver may not see that file

Related Content

FLTMC - Windows CMD - SS64.com
CB Defense: Why Do Other AV Vendors Alert On Potential Malware That Carbon Black Does Not?