Grammar Router — Confidence Competition
Interactive visualization of Golliath's GrammarRouter: how LummaGrammar, RiseProGrammar, WhiteSnakeGrammar, RedLineGrammar, and GenericGrammar compete with confidence scores to claim an archive for extraction. Includes a live simulator where you can toggle layout signals and watch the router pick a winner.
By Mohamed Habib Jaouadi•June 22, 2026•
Post Related
#cti
#parser
#stealer-logs
#grammar
#lumma
#risepro
#whitesnake
#redline
Grammar Router — Confidence Competition
Each FamilyGrammar scores the layout evidence. Highest above 0.60 wins. Explore family signatures or simulate your own archive layout.
WhiteSnakeGrammar
confidence
0.95
Score
Above 0.60 threshold — wins routing
Primary Trigger
System_* + Cookies/Example
WhiteSnake Stealer aggregator repacks
Evidence scored by matches()
- - System_<HOSTNAME>/ directories in root
- - Cookies/ directory at root level
- - BankCard*.txt files present
Fields extracted
passwords (colon-separated)
cookies
autofill
credit cards