Red Lamassu Batch Dropper: PowerShell Downloads JFMBackdoor Components to TEMP
Detects malicious dropper behavior involving batch files spawning hidden PowerShell processes to download components (flt.bin, FLTLIB.dll, scr.mui, fltMC.exe) to temporary directories. The rule further tracks the execution of the dropped fltMC.exe and the creation of the associated DLL/binary files, which is indicative of JFMBackdoor DLL side-loading.
SentinelOne
