TriBack Loader Encrypted Companion Payload Drop in Startup Folder
Detects creation of an encrypted companion payload file with a .dat extension inside the Windows Startup folder, consistent with the TriBack Loader triad (signed binary + sideloaded DLL + encrypted .dat companion) being staged for persistence. Intended as a correlation input paired with detection of the signed host binary drop in the same folder.
Cortex XDR
