JFMBackdoor Registry Recon and Manipulation via fltMC.exe (T1012/T1112)
Detects registry modifications (get, set, delete, rename) performed by the Filter Manager utility (fltMC.exe) targeting common Windows software and class registry keys. While fltMC is a legitimate Windows utility for managing filter drivers, its interaction with these specific registry hives is highly suspicious and may indicate unauthorized persistence or configuration tampering.
Cortex XDR
