APT36 Ghazwa - Call Log and SMS ContentResolver Harvest with Outbound Exfiltration
Detects the Ghazwa spyware, attributed to APT36, querying sensitive Android system resources (CallLog and SMS Content Providers) from an application that is not a native dialer or messaging app. The rule further correlates this data access with subsequent outbound network activity, indicating potential data exfiltration.
YARA-L
