Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1 detection
Filters
Last updated
All Time
Detection languages
1
Contributors
1
Categories
1
1
1
Platforms
1
Products / Services
1
1
MITRE Techniques
18,154
15,694
12,637
8,448
6,267
This rule detects the presence of unauthorized WebView or HTML overlay windows rendered on top of active banking applications on Android devices. This behavior is indicative of credential-theft malware, such as banking trojans, which use overlays to capture user input, including banking credentials, while masking their activity over legitimate finance-related applications.
