JFMBackdoor and PowerShell File Timestamp Manipulation (Timestomping)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•2•0•1

Detects potential timestomping activity using PowerShell Set-ItemProperty, as well as specific file metadata manipulation and file operations associated with the JFMBackdoor utilizing fltMC.exe.