Grandoreiro Banking Overlay: Kiosk Browser Spawn and caixaGeralDepositos_sms Reference
Detects execution patterns associated with the Grandoreiro banking trojan, specifically its overlay attack technique. The rule monitors for browsers launched in kiosk mode by unauthorized parent processes, the presence of Grandoreiro-specific banking identifier strings in process command lines, execution of unsigned binaries from AppData/Local that spawn browsers in kiosk mode, and the execution of specific known loader binaries spawned by script interpreters.
SentinelOne
