JFMBackdoor Post-Compromise Discovery Tools Launched from fltMC.exe

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects execution of common discovery binaries (tasklist, netstat, ipconfig, net, whoami, query) when spawned by the filter manager utility (fltMC.exe) or its children, a behavior observed in the Red Lamassu JFMBackdoor post-compromise activity.