Torg Grabber Infostealer C2 and Delivery Indicators

Daniel Jeremiah@daniyyell

•updated Mar 31, 2026•0•48

This rule detects network communication indicators associated with the Torg Grabber infostealer. It specifically looks for connections to known command and control (C2) domains or specific URL paths used by the malware for authentication and data exfiltration. The detection logic combines a regular expression for a list of suspicious domains and a check for specific API paths within URLs. A match indicates potential Torg Grabber activity, warranting further investigation into the affected host and user, and review of surrounding network and system activity.