Grandoreiro VBS Geofenced Dropper Execution from User-Writable Directory
Detects the execution of VBScript files via wscript.exe or cscript.exe from user-writable directories (Temp, Downloads, AppData, etc.) when the process is spawned by common application vectors like web browsers, email clients, or document viewers. This behavior is indicative of the Grandoreiro banking trojan's dropper mechanism, which uses obfuscated VBS scripts for geofencing and locale checks prior to downloading secondary payloads.
Sigma
