Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
1
1
Contributors
1
1
Categories
1
1
1
1
1
Platforms
2
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
Detects the RatHat malware agent (liblocal-service.so) being staged in the Android /data/local/tmp directory and the subsequent execution of an ADB shell command to automatically re-install the malicious APK, ensuring persistence even after the application has been uninstalled.
Detects the use of foreground services and WakeLock mechanisms on Android, which can be leveraged by malicious applications like PromptSpy to maintain persistence and prevent the application from being terminated by the system.
