JFMBackdoor Process Enumeration via tasklist or ps Execution

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

Detects process enumeration activities (tasklist.exe or ps.exe) when executed by or on behalf of fltMC.exe, which is known to be associated with JFMBackdoor sideloading techniques. The rule monitors both direct child processes and descendants of the suspicious process.