Red Lamassu JFMBackdoor Recon Trifecta: proc+net enum then C2 egress (T1057/T1049)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule detects a multi-stage malicious activity pattern where a process performs system reconnaissance (process enumeration followed by network configuration enumeration) followed by an outbound network connection to a non-internal IP address. The rule uses transaction correlation on the ProcessGuid/ParentProcessGuid to link these distinct events into a single chain within a 2-minute time window.