JFMBackdoor Registry CRUD Enumeration via fltMC DLL Side-Load
Detects anomalous registry activity associated with the JFMBackdoor, specifically when the legitimate Windows utility fltMC.exe is used for registry modification or enumeration. This rule looks for high-frequency registry operations performed by fltMC.exe, particularly targeting common persistence locations or other registry paths, indicating potential malicious use following DLL side-loading.
SentinelOne
