Luke H
@darkbunnyCompletionist
0 followers1 download31 copies0 likes1,899 views
4 detections
Filters
Last updated
All Time
Detection languages
4
Categories
3
3
3
3
3
Platforms
4
3
Products / Services
4
MITRE Techniques
4
3
3
3
3
IDS Classtypes
1
This rule set detects various stages of the JFMBackdoor and Showboat malware, including DLL sideloading of FLTLIB.dll by fltMC.exe from non-standard directories, network connections to known C2 and staging infrastructure (namefuture.site or 23.27.201.160), command-line activity referencing a specific Pastebin URL used by Showboat for process-hiding code, and the creation of JFMBackdoor payload artifacts (flt.bin, scr.mui).
This rule set detects various stages of the JFMBackdoor and Showboat malware, including DLL sideloading of FLTLIB.dll by fltMC.exe from non-standard directories, network connections to known C2 and staging infrastructure (namefuture.site or 23.27.201.160), command-line activity referencing a specific Pastebin URL used by Showboat for process-hiding code, and the creation of JFMBackdoor payload artifacts (flt.bin, scr.mui).
This rule set detects various stages of the JFMBackdoor and Showboat malware, including DLL sideloading of FLTLIB.dll by fltMC.exe from non-standard directories, network connections to known C2 and staging infrastructure (namefuture.site or 23.27.201.160), command-line activity referencing a specific Pastebin URL used by Showboat for process-hiding code, and the creation of JFMBackdoor payload artifacts (flt.bin, scr.mui).
Detects the execution of the Windows Bluetooth File Transfer Wizard (fsquirt.exe), which may be abused for data exfiltration or payload delivery over Bluetooth. The rule identifies execution of fsquirt.exe and flags potentially suspicious indicators like specific transfer arguments or execution from non-standard paths.