Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7 detections
Filters
Last updated
All Time
Detection languages
3
2
1
1
Contributors
3
1
1
1
1
Categories
5
2
2
1
1
Platforms
6
1
1
1
Products / Services
2
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
Keenadu Backdoor
YARA
Matches published Keenadu-related MD5 hashes from the report.
Detects the creation or loading of the LANDFALL spyware's SELinux policy manipulator component (`l.so`). This component is used to gain elevated permissions and persistence on compromised Samsung Android devices. The rule identifies the component by its known hash or by its specific file name and path (`/data/data/com.samsung.ipservice/files/l.so`).
Detects the LANDFALL Android spyware manipulating SELinux policy by preloading a malicious shared object and passing a path to the 'l.so' policy manipulator component via the PRELOAD_PATH environment variable.
Detects malformed DNG/TIFF image files containing an embedded ZIP archive, a technique used to deliver the LANDFALL Android spyware.
Detects PhantomCard, an Android NFC-relay Trojan targeting banking customers in Brazil. It masquerades as a 'card protection' app and relays NFC data from the victim's card to the fraudster's device.
Detects network traffic to an ERMAC banking trojan exfiltration server by identifying a unique 'WWW-Authenticate' header in the HTTP response. This indicates a client device is communicating with a known ERMAC command and control server for data exfiltration.
KQL Query
