{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/dropper/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["high"],"_cs_tags":["winnti","dropper","windows","file-event"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThis brief identifies specific file artifacts documented in the RedMimicry Winnti playbook that are indicative of dropper activity. The activity relates to the deployment of DLLs and batch files in specific directory paths commonly associated with the Winnti group.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the provided Sigma rule to your SIEM to monitor for the creation of identified dropper artifacts.\u003c/li\u003e\n\u003cli\u003eReview historical file creation events in Windows Temp directories and other suspicious locations for the listed filenames.\u003c/li\u003e\n\u003cli\u003eInvestigate the source process associated with any file creation event matching these filenames to determine the initial infection vector.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-10T02:46:05Z","date_published":"2026-11-10T02:46:05Z","id":"https://feed.craftedsignal.io/briefs/2026-11-winnti-dropper/","summary":"Detection logic for files associated with Winnti group activity, specifically identified in the RedMimicry analysis of Winnti dropper behavior.","title":"Potential Winnti malware dropper activity","url":"https://feed.craftedsignal.io/briefs/2026-11-winnti-dropper/"}],"language":"en","title":"CraftedSignal Threat Feed - Dropper","version":"https://jsonfeed.org/version/1.1"}