Grandoreiro VBS Geofenced Dropper: wscript/cscript to ip-api.com Geolocation Lookup
This rule detects the execution of VBScript files using wscript.exe or cscript.exe that are closely followed by network connections to known public IP geolocation services (ip-api.com, ipinfo.io, api.country.is). It further enhances the detection by checking if a secondary process is spawned from the same host, which may indicate a payload retrieval or execution phase typical of malware staging.
Splunk (SPL)
