Red Lamassu JFMBackdoor Screen Capture - Periodic Image File Creation with External Network

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule detects processes frequently creating image files (bmp, png, jpg, jpeg) in temporary directories and subsequently initiating external network connections. The logic identifies suspicious patterns where a non-whitelisted process generates files at consistent, short intervals and performs network activity, which is a common indicator of automated screen capture and exfiltration.