Red Lamassu JFMBackdoor: fltMC.exe Outbound Connection or cmd.exe Spawn
Detects fltMC.exe initiating outbound network connections, which is anomalous behavior indicative of potential JFMBackdoor activity (associated with Red Lamassu/Calypso) utilizing DLL sideloading or reverse shell execution.
YARA-L
