Red Lamassu JFMBackdoor Process Discovery via fltMC.exe Parent

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects process enumeration activities (tasklist, wmic, or command line process listing) performed by fltMC.exe. This pattern is characteristic of JFMBackdoor, which utilizes DLL side-loading through fltMC.exe to maintain persistence and perform situational awareness.