JFMBackdoor Network Enumeration via fltMC.exe Loaded from TEMP
Detects instances of the legitimate Windows system utility fltMC.exe running from a temporary directory (Temp or tmp) that initiates network connections. This behavior is indicative of the JFMBackdoor malware masquerading as a system tool to perform network enumeration by leveraging APIs like GetExtendedTcpTable or GetExtendedUdpTable.
YARA-L
