JFMBackdoor Network and Process Enumeration from fltMC.exe Side-Load Context

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects the execution of network discovery utilities (netstat, tasklist, net) or specific network-related command-line arguments (e.g., session enumeration, netstat flags) when initiated by suspicious parent processes such as fltMC.exe (Filter Manager), or script interpreters like wscript.exe or cscript.exe. This activity is indicative of post-exploitation discovery efforts.