BTMOB/CraxsRAT/CypherRAT/SpySolr APK Drop or ADB Sideload on Windows Endpoint
This rule detects the presence of known Android Remote Access Trojan (RAT) APK files on Windows endpoints, or the use of Android Debug Bridge (adb.exe) to install such APKs. It monitors file creation/modification events for specific malicious filenames and process execution patterns involving 'adb install' commands, as well as suspicious script interpreters creating APK files in user-writable directories.
SentinelOne
