Red Lamassu JFMBackdoor DLL Sideload via fltMC.exe from TEMP

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

Detects the execution of a potentially malicious fltMC.exe from the user's TEMP directory, a technique utilized by the Red Lamassu actor to sideload the JFMBackdoor. This rule monitors for known malicious file hashes or the execution of fltMC.exe from suspicious locations where the legitimate System32 binary should not reside.