Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
26 detections
Filters
Last updated
All Time
Detection languages
15
6
2
1
1
Contributors
8
7
6
2
1
Categories
9
4
4
4
4
Platforms
18
7
2
Products / Services
4
2
1
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
Detects the sequential activation of Android Accessibility services followed by Device Administrator activation by the same application within a short timeframe. This behavior is indicative of sophisticated Android malware, such as RatHat, establishing persistence and preventing uninstallation by combining Accessibility-based control with Device Admin-based device management capabilities (e.g., remote wipe or anti-uninstall).
Detects the sequential activation of Android Accessibility services followed by Device Administrator activation by the same application within a short timeframe. This behavior is indicative of sophisticated Android malware, such as RatHat, establishing persistence and preventing uninstallation by combining Accessibility-based control with Device Admin-based device management capabilities (e.g., remote wipe or anti-uninstall).
Detects the execution of Windows Installer (.msi) files or screensaver (.scr) files that were recently downloaded and executed via a web browser. Attackers often use these file types as lures for fake updates or software installers to execute malicious code on the victim's system.
Detects a specific Android sandbox escape technique where a malicious app enables Accessibility Services and Developer Options/Wireless Debugging to initiate a self-pairing ADB connection over localhost. This bypasses typical app sandbox restrictions, allowing the execution of processes with the UID 2000 (shell) context.
Detects two distinct suspicious activities on Android devices: the manual installation of an APK file using the 'pm' tool with specific flags, and the modification of security-sensitive settings to enable accessibility services via the 'settings' command. Both patterns are commonly associated with malicious Android applications or post-compromise activity.
Detects execution of malicious binaries ('liblocal-service.so', 'frpc', 'local-service.update') or suspicious shell commands on Android devices consistent with the RatHat malware family. The rule monitors for unauthorized APK installations, modification of accessibility service settings, and manipulation of system standby/doze modes via adb or local shell commands.
Detects malicious Android application activity where an app attempts to enable accessibility services and wireless debugging to perform unauthorized ADB pairing and connection. This technique is associated with the RatHat malware family to bypass sandbox protections and perform self-pairing for ADB access without user interaction.
Detects malicious Android applications that leverage Accessibility Services for automated interaction. Specifically, the rule monitors for the installation of an app, followed by the immediate enabling of Accessibility Services and subsequent synthetic tap events on the screen within a narrow timeframe. This pattern is characteristic of malware attempting to automatically grant itself sensitive permissions or bypass user consent dialogs, such as the behavior observed in the BTMOB RAT.
Detects replacement of screensaver executable for persistence
This rule detects network traffic over SMB (port 445) containing the string "SCRNSAVE.EXE" in a case-insensitive manner. This is indicative of a potential persistence mechanism where the screensaver executable has been replaced with a malicious one, and its name is being transmitted over the network, possibly during file transfer or command and control activities. The rule specifically looks for traffic flowing to the server on an established connection.
This rule detects the creation of files with a '.scr' extension, which are typically Windows screensaver executable files. Adversaries may create or modify these files to establish persistence by executing malicious content when user inactivity triggers the screensaver. The rule includes filters to reduce false positives from known legitimate processes creating screensaver files, such as Kindle.exe, Symantec Endpoint Protection's ccSvcHst.exe, and TiWorker.exe creating uwfservicingscr.scr.
This rule detects PowerShell commands that attempt to copy files into critical Windows system directories like "System32" or "SysWOW64". This activity can be indicative of persistence mechanisms, defense evasion, or credential access attempts, such as installing a malicious password filter DLL.
This rule detects suspicious modifications to screensaver settings in the Windows Registry using `reg.exe`. Adversaries may manipulate these settings to establish persistence by executing malicious content when a user is inactive. Specifically, it looks for `reg.exe` commands that modify the `ScreenSaveActive`, `ScreenSaveTimeout`, `ScreenSaverIsSecure`, or `SCRNSAVE.EXE` registry values within `HKEY_CURRENT_USER\Control Panel\Desktop` or `HKCU\Control Panel\Desktop` with the `/f` (force) flag.
Adversaries may establish persistence by executing malicious content triggered by user inactivity.
Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension
Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension
Aversaries may use to interact with a remote network share using Server Message Block (SMB).
This technique is used by post-exploitation frameworks.
This technique is used by post-exploitation frameworks.
Adversaries may establish persistence by executing malicious content triggered by user inactivity.
Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension
Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension
Adversaries may establish persistence by executing malicious content triggered by user inactivity.
Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension
Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension
'This rule identifies a web request to a URL that holds a file type, including .ps1, .bat, .vbs, and .scr that can be harmful if downloaded. This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM WebSession schema (ASIM WebSession Schema)'
Aversaries may use to interact with a remote network share using Server Message Block (SMB).
This technique is used by post-exploitation frameworks.
This technique is used by post-exploitation frameworks.
Detects value modification of registry key containing path to binary used as screensaver.
Detects value modification of registry key containing path to binary used as screensaver.
Page 1 of 2