APT36 Ghazwa Spyware APK Masquerading as Security Update with Device Admin Request
This rule detects potentially malicious Android applications masquerading as security updates that request 'Device Administrator' permissions. Such apps often attempt to gain elevated privileges to maintain persistence, prevent uninstallation, or perform unauthorized administrative actions on the device.
Splunk (SPL)
