Red Lamassu JFMBackdoor Service Persistence via sc.exe binpath to Temp or AppData

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects the creation or modification of Windows services using sc.exe or PowerShell New-Service where the binary path points to suspicious user-writable directories such as Temp or AppData, a technique observed in the Red Lamassu JFMBackdoor infection chain.