Torg Grabber Infostealer C2 and Delivery Indicators
This detection rule identifies network activity associated with the Torg Grabber infostealer. It specifically looks for connections to known command and control (C2) domains and specific URL paths used by the malware for authentication, data upload, or core functionality. The rule leverages network proxy, firewall, or Zeek HTTP logs to extract and analyze URLs. A match indicates a strong reason to investigate the affected host and user, check for expected access, and review nearby activity for further compromise.
Splunk (SPL)
