Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1 detection
Filters
Last updated
All Time
Detection languages
1
Contributors
1
Categories
1
1
1
Platforms
1
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
Detects the Ghazwa spyware, attributed to APT36, querying sensitive Android system resources (CallLog and SMS Content Providers) from an application that is not a native dialer or messaging app. The rule further correlates this data access with subsequent outbound network activity, indicating potential data exfiltration.
