Red Lamassu JFMBackdoor Screen Capture: fltMC Sideload + ROG File in ProgramData

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule detects two potentially malicious activities: the execution of 'fltMC.exe' from a 'Temp' directory, which is a known masquerading technique for the legitimate Windows filter manager utility, and the creation of an executable file within the 'C:\ProgramData\Windows Multimedia\ROG\' directory, which is a common path used by threat actors to stage malicious binaries.