Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
2
1
Contributors
2
1
Categories
2
2
1
1
1
Platforms
3
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
Detects the RatHat Android malware component using getevent or direct access to /dev/input event files to capture user PINs and patterns. The rule filters for processes running under UID 2000 (shell) or identifying as liblocal-service, which are consistent with the malware's keylogging behavior.
Detects the activation of Android Accessibility Services by non-legitimate, potentially malicious applications. This behavior is commonly associated with banking trojans like Rokarolla that abuse accessibility permissions to perform UI automation, keystroke logging, and screen scraping.
Detects the activation of Android Accessibility Services by non-legitimate, potentially malicious applications. This behavior is commonly associated with banking trojans like Rokarolla that abuse accessibility permissions to perform UI automation, keystroke logging, and screen scraping.