{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/malware-loader/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["medium"],"_cs_tags":["command-and-control","malware-loader","sysmon"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThreat actors commonly leverage URL shortening services, such as tinyurl.com, to hide the final destination of malicious payloads or command-and-control (C2) infrastructure from security appliances and defenders. By obfuscating the URL, attackers increase the difficulty of detecting phishing sites or malware distribution staging areas. While tinyurl.com is a legitimate service used for marketing and convenience, its interaction with non-browser processes - particularly script interpreters like PowerShell or command-line utilities executing from suspicious paths like AppData or Temp - is a high-fidelity indicator of potential malicious activity. This detection is designed to monitor for anomalous DNS resolution patterns that suggest a process is retrieving an obfuscated redirect, which is often a precursor to secondary stage downloads or C2 registration in malware families such as the Braodo Stealer.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe use of obfuscated links via URL shorteners facilitates the delivery of various malware, including infostealers and loaders, to enterprise environments. Successful exploitation allows for the covert download of second-stage payloads, credential harvesting, and the establishment of persistent C2 channels. Organizations targeted by campaigns employing these techniques are at risk of data exfiltration and unauthorized system access.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the provided Sigma rule to identify non-browser processes initiating DNS queries to URL shorteners.\u003c/li\u003e\n\u003cli\u003eEnable Sysmon Event ID 22 (DNS Query) across all endpoints to ensure visibility into DNS request patterns.\u003c/li\u003e\n\u003cli\u003eInvestigate the execution context of processes identified by the detection, focusing on the parent process and any subsequent outbound network connections.\u003c/li\u003e\n\u003cli\u003eTune the detection by adding process filters for legitimate business applications that may interface with URL shorteners via APIs, such as messaging clients or internal automation tools.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-19T02:51:56Z","date_published":"2026-10-19T02:51:56Z","id":"https://feed.craftedsignal.io/briefs/2026-10-tinyurl-dns-queries/","summary":"Threat actors frequently utilize URL shortening services like TinyURL to obfuscate malicious URLs used in phishing campaigns, malware staging, or command-and-control (C2) communication.","title":"Suspicious DNS Queries to URL Shortening Services","url":"https://feed.craftedsignal.io/briefs/2026-10-tinyurl-dns-queries/"}],"language":"en","title":"CraftedSignal Threat Feed - Malware-Loader","version":"https://jsonfeed.org/version/1.1"}