Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
1
1
Contributors
2
Categories
2
1
1
1
1
Platforms
2
Products / Services
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
This rule detects potentially malicious Android activity targeting financial and messaging applications (WeChat, Alipay). It monitors for suspicious app installation, abuse of Android accessibility services, and unauthorized overlay window activity which are common techniques used by banking trojans for credential theft and unauthorized transaction interception.
This rule detects activity associated with known Android Remote Access Trojans (RATs) such as BTMOB, CraxsRAT, CypherRAT, and SpySolr on SentinelOne-managed Android devices. It flags suspicious file creations (sideloaded APKs in user storage), specific malicious process names, SentinelOne threat indicators, and abuse of accessibility services for unauthorized remote control, keylogging, or screen overlay activities.