Grandoreiro Fake Adobe PDF Lure: Child Spawn, File Drop, and Banking Overlay Injection
This rule monitors for patterns associated with the Grandoreiro banking trojan, specifically looking for malicious lure behaviors originating from Adobe Reader processes, VBScript-based droppers, payload drops, file creation of known update names, potential banking browser-kiosk overlays, and specific DLL sideloading techniques.
Splunk (SPL)
