Red Lamassu JFMBackdoor DLL Sideload via fltMC.exe from TEMP
Detects the execution of fltMC.exe from temporary directories (%TEMP% or %TMP%). This behavior is associated with the Red Lamassu JFMBackdoor campaign, where fltMC.exe is used to facilitate DLL sideloading by staging required files (fltMC.exe, FLTLIB.dll, flt.bin, and scr.mui) in the temporary folder.
YARA-L
