APT36 Ghazwa - Android Permission Enumeration Fingerprinting Followed by C2 POST

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•6

Detects anomalous surveillance-like behavior on Android devices associated with the APT36 Ghazwa spyware. The rule identifies applications that check more than 8 distinct sensitive Android permissions within a 60-second window, followed immediately by an outbound HTTP/HTTPS POST request to an external IP, indicative of spyware pre-staging and data exfiltration.