Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
35 detections
Filters
Last updated
All Time
Detection languages
11
11
3
3
3
Contributors
25
10
Categories
24
16
11
7
5
Platforms
35
1
Products / Services
22
5
4
4
3
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
Detects suspected Grandoreiro banking trojan command-and-control (C2) activity. The rule monitors for STUN/TURN traffic over non-browser/non-conferencing processes on port 3478, outbound MQTT connections to common cloud broker domains, and DNS lookups for specific C2-related infrastructure including geolocation checks via icanhazip.com.
Latin American banking trojan using DLL side-loading and overlay attacks
Detects various pre-execution and environment fingerprinting behaviors indicative of the Grandoreiro banking trojan. This includes WMI-based security product enumeration, execution of unsigned payloads from suspicious AppData paths, detection of security analysis/debugging tools, virtualization environment checks, and C2 communication attempts via geolocation services.
Detects the execution of wmic.exe with commands querying Windows Management Instrumentation (WMI) classes (AntiVirusProduct, SecurityCenter2, Win32_Product) often used by the Grandoreiro banking trojan to identify installed security software and sandbox environments. The rule specifically monitors for suspicious parent-child relationships, such as wscript.exe, cscript.exe, or mshta.exe spawning wmic.exe, especially when the originating script or binary is unsigned or originating from non-standard paths like AppData.
Detects network activity associated with the Grandoreiro banking trojan, specifically identifying C2 communication tunneled over WebRTC/STUN (port 3478) or MQTT (Azure/Google Cloud services) originating from processes executing out of the AppData\Local directory. This behavior aligns with Grandoreiro's known DLL side-loading mechanism where legitimate but vulnerable binaries are used to load malicious libraries.
Latin American banking trojan using DLL side-loading and overlay attacks
Detects the execution of VBScript processes (wscript.exe/cscript.exe) that interact with WMI to enumerate installed antivirus products or perform external IP geolocation lookups via services like ip-api.com. This behavior is indicative of the Grandoreiro banking trojan performing environment reconnaissance and victim-targeted execution.
Detects behavior patterns associated with the Grandoreiro banking trojan, specifically focusing on DLL side-loading from user-writable directories (AppData, Temp, Downloads) and the execution of randomized executables spawned by wscript.exe, which is characteristic of its VBS dropper mechanism.
Detects DLL side-loading behaviors associated with the Grandoreiro banking trojan. The rule identifies malicious DLLs compiled with Delphi/Embarcadero, utilizing sgcWebSockets for C2 communication via WebRTC, and including specific anti-analysis and banking-related strings, often executed via legitimate software binaries.
Detects suspicious network activity using the STUN/TURN protocol on port 3478 initiated by non-browser and non-conferencing processes. The rule specifically targets unsigned processes or those located in user-writable directories (such as Temp or AppData), which are common indicators of Grandoreiro malware sideloading and establishing C2 communication tunnels.
Latin American banking trojan using DLL side-loading and overlay attacks
Latin American banking trojan using DLL side-loading and overlay attacks
Latin American banking trojan using DLL side-loading and overlay attacks
Latin American banking trojan using DLL side-loading and overlay attacks
Latin American banking trojan using DLL side-loading and overlay attacks
Detects the execution of suspicious binaries spawned by the Windows script hosts (wscript.exe, cscript.exe) from the AppData directory. This pattern is indicative of the Grandoreiro banking trojan, which masquerades as an Adobe Reader update prompt and drops its payload into temporary folders to execute.
Detects suspicious network activity using the STUN/TURN protocol on port 3478 initiated by non-browser and non-conferencing processes. The rule specifically targets unsigned processes or those located in user-writable directories (such as Temp or AppData), which are common indicators of Grandoreiro malware sideloading and establishing C2 communication tunnels.
Detects the execution of VBScript files via wscript.exe or cscript.exe from user-writable directories (Temp, Downloads, AppData, etc.) when the process is spawned by common application vectors like web browsers, email clients, or document viewers. This behavior is indicative of the Grandoreiro banking trojan's dropper mechanism, which uses obfuscated VBS scripts for geofencing and locale checks prior to downloading secondary payloads.
Detects Grandoreiro banking trojan activity by identifying the loading of specific DLLs (e.g., mingwm10.dll, libwebp.dll, libffi-6.dll) from non-standard or user-writable directory paths, which is characteristic of the Grandoreiro DLL side-loading technique.
Detects suspicious WMI queries to the SecurityCenter2 namespace for security product information (AntiVirusProduct, AntiSpywareProduct, FirewallProduct) originating from common web browsers or document editors. This behavior is indicative of the Grandoreiro banking trojan attempting to identify and evade security software.
Detects activity consistent with the Grandoreiro banking trojan, including DLL sideloading, screen capturing, keystroke hooking, unauthorized network connections to known banking infrastructure, and suspicious data exfiltration bursts.
Page 1 of 2