JFMBackdoor Process and Network Enumeration via fltMC.exe Sideloading

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

Detects JFMBackdoor malware performing process enumeration and network connection discovery. The rule triggers when fltMC.exe exhibits suspicious behavior, specifically invoking API functions such as CreateToolhelp32Snapshot, Process32First/Next (process enumeration) or GetExtendedTcpTable/UdpTable (network discovery), which is indicative of sideloading malicious DLLs (FLTLIB.dll) into the legitimate fltMC.exe process context.