fltMC.exe Reflective DLL Injection or Process Hollowing (Red Lamassu)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•6

This rule detects the legitimate Windows filter manager utility, fltMC.exe, performing suspicious activities when launched from temporary directories. It specifically flags cases where fltMC.exe loads modules without a corresponding file path (indicative of reflective DLL injection) or initiates sensitive memory allocation APIs (such as VirtualAllocEx or CreateRemoteThread) that are commonly associated with process hollowing or code injection.