Dropper - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/dropper/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 10 Nov 2026 02:46:05 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgPotential Winnti malware dropper activityhttps://feed.craftedsignal.io/briefs/2026-11-winnti-dropper/Tue, 10 Nov 2026 02:46:05 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-winnti-dropper/Detection logic for files associated with Winnti group activity, specifically identified in the RedMimicry analysis of Winnti dropper behavior.This brief identifies specific file artifacts documented in the RedMimicry Winnti playbook that are indicative of dropper activity. The activity relates to the deployment of DLLs and batch files in specific directory paths commonly associated with the Winnti group.

Recommendation

  • Deploy the provided Sigma rule to your SIEM to monitor for the creation of identified dropper artifacts.
  • Review historical file creation events in Windows Temp directories and other suspicious locations for the listed filenames.
  • Investigate the source process associated with any file creation event matching these filenames to determine the initial infection vector.
]]>highadvisorywinntidropperwindowsfile-event