Manic, Grandoreiro, and ToxicPanda 2.0 Banking Trojans: Detection and Defense Guide for SOC Teams

---
title: Suspicious Payload Execution from User-Writable Directory via LOLBin
id: 3f9a1b27-6c4d-4e58-9a71-2b8d4f6c1a90
status: experimental
description: Detects rundll32, regsvr32, or msiexec executing payloads from AppData/ProgramData/Temp, consistent with Grandoreiro and Manic staging chains delivered via phishing ZIP archives.
references:
  - https://attack.mitre.org/techniques/T1218/
  - https://www.securityweek.com/banking-trojans-manic-grandoreiro-toxicpanda-2-0-in-the-spotlight/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.defense_evasion
  - attack.t1218.011
  - attack.t1218.010
logsource:
  category: process_creation
  product: windows
detection:
  selection_lolbin:
    Image|endswith:
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\msiexec.exe'
  selection_path:
    CommandLine|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\ProgramData\'
      - '\Users\Public\'
  filter_software_install:
    ParentImage|endswith:
      - '\msiexec.exe'
    CommandLine|contains:
      - '/i'
  condition: selection_lolbin and selection_path and not filter_software_install
falsepositives:
  - Legitimate software installers staging from ProgramData
  - Enterprise software distribution tools
level: high
---
title: Banking Trojan Persistence via Registry Run Key in User-Writable Path
id: 8c2e5d14-4a6f-4b92-8e37-9d1c3a5f7b02
status: experimental
description: Detects registry Run key persistence pointing to executables or scripts in AppData, ProgramData, or Public folders — a hallmark of Grandoreiro, Manic, and commodity banking trojan persistence.
references:
  - https://attack.mitre.org/techniques/T1547/001/
  - https://www.securityweek.com/banking-trojans-manic-grandoreiro-toxicpanda-2-0-in-the-spotlight/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1547.001
logsource:
  category: registry_set
  product: windows
detection:
  selection_key:
    TargetObject|contains:
      - '\CurrentVersion\Run'
  selection_value:
    Details|contains:
      - '\AppData\'
      - '\ProgramData\'
      - '\Users\Public\'
      - 'regsvr32'
      - 'rundll32'
      - 'powershell'
  condition: selection_key and selection_value
falsepositives:
  - Legitimate user-installed applications registering autostart from AppData (e.g., Teams, Slack, OneDrive)
  - Recommend allowlisting known-good updater paths after baseline
level: high
---
title: Script Interpreter Spawned from Office or Archive-Extracted Content
id: 61b7f3c9-2d8a-4e15-bb46-7c9e2a4d8f31
status: experimental
description: Detects PowerShell, wscript, cscript, or mshta spawned by Office applications, email clients, or archive utilities — a common first-stage execution pattern in phishing-delivered banking trojan campaigns.
references:
  - https://attack.mitre.org/techniques/T1059/
  - https://www.securityweek.com/banking-trojans-manic-grandoreiro-toxicpanda-2-0-in-the-spotlight/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
  - attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\outlook.exe'
      - '\winrar.exe'
      - '\7z.exe'
      - '\explorer.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
  condition: selection_parent and selection_child
falsepositives:
  - explorer.exe launching scripts is common for legit admin tooling; alert volume should be reviewed against parent-child pairs and command lines before production
level: medium

// Hunt: Banking trojan staging chain — archive/Office/email parent spawning LOLBin or script child
let LolBins = dynamic(["rundll32.exe","regsvr32.exe","msiexec.exe","mshta.exe","wscript.exe","cscript.exe","powershell.exe"]);
let SuspiciousParents = dynamic(["winword.exe","excel.exe","outlook.exe","winrar.exe","7z.exe","thunderbird.exe"]);
let UserWritable = dynamic([@"\AppData\",@"\ProgramData\",@"\Users\Public\",@"\Temp\"]);
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ (SuspiciousParents)
   or (FileName in~ (LolBins) and ProcessCommandLine has_any (UserWritable))
| project TimeGenerated, DeviceName, AccountName,
          ParentProcess = InitiatingProcessFileName,
          ChildProcess = FileName, ProcessCommandLine,
          SHA256, ReportId
| order by TimeGenerated desc;

// Companion hunt: persistence via Run keys pointing into user-writable paths
DeviceRegistryEvents
| where TimeGenerated > ago(7d)
| where RegistryKey has_any (@"\CurrentVersion\Run", @"\CurrentVersion\RunOnce")
| where RegistryValueData has_any (@"\AppData\", @"\ProgramData\", @"\Users\Public\",
                                    "rundll32", "regsvr32", "powershell", "wscript")
| project TimeGenerated, DeviceName, InitiatingProcessAccountName,
          RegistryKey, RegistryValueName, RegistryValueData
| order by TimeGenerated desc;

// Rare outbound connections from LOLBins — candidate C2 staging
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("rundll32.exe","regsvr32.exe","mshta.exe")
| where RemoteUrl !has_any ("microsoft.com","windows.com","office.com")
| summarize ConnectionCount = count(), Devices = dcount(DeviceId)
          by RemoteUrl, InitiatingProcessFileName
| where Devices <= 3
| order by Devices asc, ConnectionCount desc;

-- Hunt: Banking trojan persistence and staging indicators (Grandoreiro/Manic class)
-- Combines Run-key audit with suspicious process lineage

LET persistence = SELECT Key.FullPath AS RegKey, Key.Name AS ValueName,
       Key.Data.String AS ValueData
FROM foreach(row={
    SELECT FullPath FROM glob(globs='HKEY_USERS\*\Software\Microsoft\Windows\CurrentVersion\Run*',
                              accessor='registry')
}, query={
    SELECT FullPath, Name, Data FROM glob(globs=FullPath + '\*', accessor='registry')
})
WHERE ValueData =~ '(?i)appdata|programdata|users\\\\public|rundll32|regsvr32|powershell|wscript'

LET suspicious_procs = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)appdata.*(rundll32|regsvr32|mshta)'
   OR Exe =~ '(?i)\\\\appdata\\\\(local|roaming)\\\\[^\\\\]+\.exe$'

SELECT * FROM persistence
UNION ALL
SELECT NULL AS RegKey, Name AS ValueName, CommandLine AS ValueData,
       Pid, Ppid, Exe, Username, CreateTime FROM suspicious_procs

#requires -RunAsAdministrator
# Banking Trojan Triage & Hardening — Manic / Grandoreiro class threats
# Security Arsenal — run via your RMM or Intune remediation

Write-Host "=== [1] Auditing Run/RunOnce persistence in user-writable paths ===" -ForegroundColor Cyan
$runKeys = @(
  'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run',
  'HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce',
  'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run',
  'HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce'
)
$findings = @()
foreach ($key in $runKeys) {
  if (Test-Path $key) {
    Get-ItemProperty -Path $key | ForEach-Object {
      $_.PSObject.Properties | Where-Object {
        $_.Value -match 'AppData|ProgramData|Users\\Public|rundll32|regsvr32|powershell|wscript'
      } | ForEach-Object {
        $findings += [PSCustomObject]@{ Key=$key; Name=$_.Name; Value=$_.Value }
      }
    }
  }
}
if ($findings) { $findings | Format-Table -AutoSize; Write-Warning "Review entries above — suspicious persistence candidates." }
else { Write-Host "No suspicious Run-key entries found." -ForegroundColor Green }

Write-Host "=== [2] Listing recently-created executables in Temp/AppData ===" -ForegroundColor Cyan
$recent = Get-ChildItem -Path "$env:TEMP","$env:LOCALAPPDATA","$env:APPDATA" -Recurse -Include *.exe,*.dll,*.msi,*.js,*.vbs,*.hta -ErrorAction SilentlyContinue |
  Where-Object { $_.CreationTime -gt (Get-Date).AddDays(-14) } |
  Sort-Object CreationTime -Descending | Select-Object -First 25 FullName, CreationTime
$recent | Format-Table -AutoSize

Write-Host "=== [3] Blocking mshta/wscript outbound via Windows Firewall (banker staging mitigation) ===" -ForegroundColor Cyan
$rules = @(
  @{Name='Block-mshta-Outbound';   Exe="$env:SystemRoot\System32\mshta.exe"},
  @{Name='Block-mshta-Outbound32'; Exe="$env:SystemRoot\SysWOW64\mshta.exe"}
)
foreach ($r in $rules) {
  if (-not (Get-NetFirewallRule -DisplayName $r.Name -ErrorAction SilentlyContinue)) {
    New-NetFirewallRule -DisplayName $r.Name -Direction Outbound -Program $r.Exe -Action Block -Profile Any | Out-Null
    Write-Host "Created firewall rule: $($r.Name)" -ForegroundColor Green
  } else { Write-Host "Rule exists: $($r.Name)" }
}

Write-Host "=== [4] Verifying Attack Surface Reduction (ASR) rule status (requires Defender) ===" -ForegroundColor Cyan
# ASR GUIDs: Office child processes, script obfuscation, executable content from email
$asrRules = @{
  'D4F940AB-401B-4EFC-AADC-AD5F3C50688A' = 'Block Office child processes'
  '5BEB7EFE-FD9A-4556-801D-275E5FFC04CC' = 'Block obfuscated scripts'
  'BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550' = 'Block executable content from email/webmail'
}
foreach ($guid in $asrRules.Keys) {
  $current = (Get-MpPreference).AttackSurfaceReductionRules_Ids
  if ($current -notcontains $guid) {
    Add-MpPreference -AttackSurfaceReductionRules_Ids $guid -AttackSurfaceReductionRules_Actions Enabled
    Write-Host "Enabled ASR: $($asrRules[$guid])" -ForegroundColor Green
  } else { Write-Host "ASR present: $($asrRules[$guid])" }
}
Write-Host "=== Triage complete. Export findings to your case management system. ===" -ForegroundColor Cyan