Red Lamassu Batch Script Downloading JFMBackdoor Components to %TEMP%

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects the use of common Windows command-line utilities (powershell.exe, cmd.exe, bitsadmin.exe, curl.exe) executing files from common temporary directories (%TEMP%, %tmp%). The rule flags execution involving hidden windows, specific file names (flt.bin, FLTLIB.dll, etc.), or known C2 IP addresses.