BTMOB/CraxsRAT Android RAT Accessibility Service Abuse and APK Sideloading

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•2

This rule detects activity associated with known Android Remote Access Trojans (RATs) such as BTMOB, CraxsRAT, CypherRAT, and SpySolr on SentinelOne-managed Android devices. It flags suspicious file creations (sideloaded APKs in user storage), specific malicious process names, SentinelOne threat indicators, and abuse of accessibility services for unauthorized remote control, keylogging, or screen overlay activities.