Red Lamassu JFMBackdoor DLL Side-Loading via fltMC.exe from TEMP
Detects execution of the legitimate Windows filter manager utility 'fltMC.exe' from temporary directories combined with the loading of a 'FLTLIB.dll' file from a similarly suspicious location. This pattern is indicative of DLL side-loading, often associated with the JFMBackdoor malware (Red Lamassu).
Microsoft Sentinel (KQL)
