Grandoreiro VBS Loader — Obfuscated wscript/cscript From User-Writable Path

Luís Marques@remotecodeexecution

•updated Jul 24, 2026•4•0•11

Detects the Grandoreiro Campaign 2 obfuscated VBS loader executed via wscript.exe / cscript.exe from a user-writable directory. The rule has been expanded to also detect additional Grandoreiro behaviors, including the spawning of Delphi payloads from AppData, WMI queries for AntiVirusProduct, browser kiosk mode execution, and potential DLL side-loading of abused legitimate executables (FastStone, MinGW, FreeMat, AbiWord).