Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
35 detections
Filters
Last updated
All Time
Detection languages
11
11
3
3
3
Contributors
25
10
Categories
24
16
11
7
5
Platforms
35
1
Products / Services
22
5
4
4
3
MITRE Techniques
18,116
15,638
12,586
8,396
6,226
Detects anomalous network traffic patterns characteristic of the Grandoreiro banking trojan, which tunnels Command and Control (C2) communications over STUN/WebRTC (UDP port 3478). The rule identifies processes that are not known web browsers or conferencing applications initiating these STUN connections, a technique used by the malware to blend with legitimate collaboration traffic.
Latin American banking trojan using DLL side-loading and overlay attacks
Latin American banking trojan using DLL side-loading and overlay attacks
Latin American banking trojan using DLL side-loading and overlay attacks
Detects process execution patterns associated with the Grandoreiro banking trojan, specifically the launching of browsers in kiosk mode for overlay attacks or the execution of suspicious non-UI binaries from scripts (wscript/cscript/mshta) located in user-writable directories.
Detects outbound network communication and DNS queries to cloud service endpoints (Google Cloud Pub/Sub, Azure MQTT, AWS IoT) originated by non-browser and non-cloud processes, which is a technique used by Grandoreiro banking trojan variants that side-load modules to tunnel command-and-control traffic.
Detects execution activity associated with the Grandoreiro banking trojan, specifically identifying DLL side-loading of known malicious files (e.g., mingwm10.dll, libwebp.dll) from user-writable AppData directories, and the execution of unsigned binaries spawned by script interpreters like wscript.exe, cscript.exe, or mshta.exe.
Detects outbound network connections over port 8883 (MQTT/IoT) indicative of the Grandoreiro banking trojan. The rule identifies suspicious, unsigned, or non-whitelisted processes attempting to initiate multiple connections to external endpoints, masquerading as legitimate IoT telemetry traffic using MQTT client configurations.
Detects execution patterns associated with the Grandoreiro banking trojan, specifically its overlay attack technique. The rule monitors for browsers launched in kiosk mode by unauthorized parent processes, the presence of Grandoreiro-specific banking identifier strings in process command lines, execution of unsigned binaries from AppData/Local that spawn browsers in kiosk mode, and the execution of specific known loader binaries spawned by script interpreters.
Detects behavior patterns associated with the Grandoreiro banking trojan, specifically the use of wscript.exe or cscript.exe to execute VBScript files that perform geolocation checks against ip-api.com, followed by the dropping of an executable file in the user's AppData\Local directory.
Detects artifacts and execution patterns associated with the Grandoreiro banking trojan. This includes the identification of known Embarcadero Delphi DLLs (mingwm10.dll, libwebp.dll, libffi-6.dll, libpng15.dll) being dropped into or loaded from AppData local directories, as well as wscript.exe or cscript.exe spawning suspicious executables from the same path, which is consistent with its VBS dropper chain.
Detects indicators of Grandoreiro banking trojan infection, including the loading of associated malicious DLLs from user-writable AppData directories, the execution of the specific binary 'ROt4I@m$etqv1Ns.exe' via script interpreters, and the spawning of unsigned executables from AppData by wscript.exe or cscript.exe.
Detects multiple concurrent attempts by a process to identify virtualization or analysis environments (sandbox evasion). The rule monitors for registry key lookups related to VMware/VirtualBox, as well as the execution of commands (via wmic, powershell, or tasklist) aimed at enumerating system information such as video controllers, boot times, operating system details, or process lists. An alert is generated when three or more distinct types of these checks are observed within a 60-second window by the same process, excluding administrative or system-level accounts.
Detects DLL side-loading activity associated with the Grandoreiro banking trojan. The rule identifies instances where legitimate, signed software (e.g., FastStone Image Viewer, MinGW, FreeMat, AbiWord) loads known malicious DLLs (e.g., mingwm10.dll, libwebp.dll) from user-writable directories such as %TEMP% or %APPDATA%, which is a characteristic behavior of the malware.
Page 2 of 2