Grandoreiro Screen Capture and Keylogging Targeting Banking Sessions (T1113/T1056.001)
Detects activity consistent with the Grandoreiro banking trojan, including DLL sideloading, screen capturing, keystroke hooking, unauthorized network connections to known banking infrastructure, and suspicious data exfiltration bursts.
Splunk (SPL)
