JFMBackdoor Persistence Directory Creation

Kaung Khant Ko@kaungkhantko

•updated May 26, 2026•2•0•156

Identifies the creation or modification of the hardcoded persistence and staging directory used by the JFMBackdoor malware, specifically 'C:\Users\Public\jfm'. This rule detects file system events within this specific path, indicating potential JFMBackdoor activity.