Grandoreiro VBS WMI AntiVirus Geofencing via WbemScripting.SWbemLocator
Detects the execution of VBScript processes (wscript.exe/cscript.exe) that interact with WMI to enumerate installed antivirus products or perform external IP geolocation lookups via services like ip-api.com. This behavior is indicative of the Grandoreiro banking trojan performing environment reconnaissance and victim-targeted execution.
Cortex XDR
