Grandoreiro DLL Side-Loading via Specific Malicious DLLs in AppData\Local
Detects execution activity associated with the Grandoreiro banking trojan, specifically identifying DLL side-loading of known malicious files (e.g., mingwm10.dll, libwebp.dll) from user-writable AppData directories, and the execution of unsigned binaries spawned by script interpreters like wscript.exe, cscript.exe, or mshta.exe.
SentinelOne
