JFMBackdoor Process and Service Enumeration via fltMC.exe Sideload

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects JFMBackdoor activity where a sideloaded fltMC.exe executable located in a temporary directory initiates process enumeration using tasklist.exe or performs service lifecycle management operations (delete, start, stop, create, or query) using the sc.exe utility.