Red Lamassu PlugX DLL Sideload Co-Deployed with JFMBackdoor from TEMP
Detects the co-occurrence of JFMBackdoor DLL sideloading via fltMC.exe and an additional PlugX DLL sideloading event originating from a temporary directory on the same host. This pattern is indicative of the Red Lamassu actor group deploying shared tooling for lateral movement and persistence.
YARA-L
