JFMBackdoor/Showboat Timestomping via fltMC.exe File Modification in TEMP or ProgramData
Detects file creation or renaming events associated with JFMBackdoor, including unauthorized file manipulation in common system locations and the presence of known backdoor component filenames. It also monitors for suspicious file attribute manipulation performed by processes running from temporary directories.
Cortex XDR
