Direct APK Download Detected (Quishing)
This rule detects attempts to download Android Application Package (APK) files directly to an endpoint. This activity is often associated with 'quishing' (QR code phishing) attacks, where users are tricked into scanning a malicious QR code that leads to a direct APK download, bypassing official app store security checks. The rule specifically looks for network connection success events where the remote URL or additional fields contain '.apk'.
Microsoft Sentinel (KQL)
