APK repackaging and Frida-gadget injection to bypass SSL pinning
This rule detects activities indicative of Android APK repackaging and the manual injection of the Frida-gadget library to bypass security controls like SSL pinning. It monitors for the use of APK patching tools followed by ADB installation commands, the installation of specific patched APK names, the presence of the Frida-gadget shared library file, and system-level signature mismatch errors from the PackageManager.
Microsoft Sentinel (KQL)
