Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4 detections
Filters
Last updated
All Time
Detection languages
3
1
Contributors
2
2
Categories
4
2
1
1
1
Platforms
4
Products / Services
1
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
This rule detects potentially malicious Android activity targeting financial and messaging applications (WeChat, Alipay). It monitors for suspicious app installation, abuse of Android accessibility services, and unauthorized overlay window activity which are common techniques used by banking trojans for credential theft and unauthorized transaction interception.
Detects anomalous surveillance-like behavior on Android devices associated with the APT36 Ghazwa spyware. The rule identifies applications that check more than 8 distinct sensitive Android permissions within a 60-second window, followed immediately by an outbound HTTP/HTTPS POST request to an external IP, indicative of spyware pre-staging and data exfiltration.
Detects the activation of Android Accessibility Services by non-legitimate, potentially malicious applications. This behavior is commonly associated with banking trojans like Rokarolla that abuse accessibility permissions to perform UI automation, keystroke logging, and screen scraping.
Detects the activation of Android Accessibility Services by non-legitimate, potentially malicious applications. This behavior is commonly associated with banking trojans like Rokarolla that abuse accessibility permissions to perform UI automation, keystroke logging, and screen scraping.