Windows Process DNS Query to TinyUrl from Suspicious Location

This analytic detects processes making DNS queries to tinyurl.com from suspicious file paths. URL shorteners like tinyurl.com are often used by adversaries to hide malicious destinations for phishing, malware distribution, or command and control (C2). While tinyurl.com is a legitimate service, its use by non-browser processes or scripts, especially from locations like AppData, Temp, or ProgramData, is highly suspicious. Further investigation into the process, its execution context, and the resolved domain is recommended to assess intent and risk.