Grandoreiro Screen Capture and WebRTC/STUN C2 Beaconing with Kiosk Browser Overlay

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•2

This rule detects processes that are not common browsers (chrome, msedge, firefox, etc.) initiating a network connection over the STUN protocol (UDP port 3478) while simultaneously running with a command-line argument containing '--kiosk'. This pattern often indicates potential command-and-control (C2) communication or unauthorized network traversal disguised as normal traffic from kiosk-mode applications.