Android root SSL-unpinning modules (JustTrustMe/TrustMeAlready/MagiskTrustUserCerts) with Magisk/Shamiko
This rule detects the presence of Android applications, packages, or signals related to root-based SSL unpinning modules (e.g., JustTrustMe, TrustMeAlready, MagiskTrustUserCerts) or instrumentation frameworks (Xposed, LSPosed) when associated with Magisk or Shamiko root management tools. These tools are commonly used by adversaries to bypass SSL certificate validation on compromised or rooted Android devices, allowing for man-in-the-middle (MITM) attacks against network traffic.
Microsoft Sentinel (KQL)
