JFMBackdoor Service Execution via fltMC.exe Spawning sc.exe or cmd sc start

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects the use of fltMC.exe to spawn service control commands (sc.exe) or command processor (cmd.exe) with arguments for starting, stopping, creating, deleting, or configuring Windows services. This activity may indicate an attempt to manipulate drivers or services to impair system defenses or achieve persistence.