LANDFALL Spyware Suspicious File Permissions (777)
Detects the creation or modification of files, particularly shared objects (.so), on Android devices with overly permissive '777' (rwxrwxrwx) permissions. This behavior is a known tactic of the LANDFALL spyware, which sets these permissions on its staged components like 'dec_a.so' to ensure they are executable.
Microsoft Sentinel (KQL)
