Red Lamassu JFMBackdoor Activity via fltMC.exe DLL Side-Loading

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects the execution of fltMC.exe originating from a temporary folder, which is indicative of potential malicious activity. The rule monitors for suspicious child processes spawned by this binary, outbound network connections, and file system operations (creation, modification, renaming) associated with this execution context.