Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
327 detections
Filters
Last updated
All Time
Detection languages
113
82
45
40
17
Contributors
117
114
23
15
12
Categories
104
100
94
71
62
Platforms
39,908
7,245
6,529
3,864
3,627
327
Products / Services
82
71
29
17
12
MITRE Techniques
62
45
43
42
34
CVEs
2
1
IDS Classtypes
54
14
6
3
1
IDS Protocols
48
25
5
3
Detects specific command strings ('proxy_open', 'proxy_data', 'proxy_close') associated with the Koktevrat Android RAT's tunneling functionality. The rule monitors outbound TCP traffic to identify the initiation, data transfer, and termination phases of a proxy connection, leveraging Suricata flowbits to track the state of the C2 tunnel.
Detects Koktevrat Stage 1 dropper (femam.apk / MandatGO) that decrypts and installs the encrypted wudEMR.apk secondary payload using a 3-byte XOR key
Detects Koktevrat Stage 1 dropper (femam.apk / MandatGO) that decrypts and installs the encrypted wudEMR.apk secondary payload using a 3-byte XOR key
Detects Koktevrat Stage 1 dropper (femam.apk / MandatGO) that decrypts and installs the encrypted wudEMR.apk secondary payload using a 3-byte XOR key
Detects network communication associated with Mantax Otax Android malware, including traffic to identified command-and-control (C2) infrastructure and attempts to retrieve dynamic configuration files from GitHub.
Detects network traffic (TLS SNI or HTTP Host) to Firebase domains (firebaseio.com, firebaseapp.com, firebasedatabase.app) associated with Mantax Otax and other Android ransomware families for ransom negotiation chat channels.
Detects network traffic (TLS SNI or HTTP Host) to Firebase domains (firebaseio.com, firebaseapp.com, firebasedatabase.app) associated with Mantax Otax and other Android ransomware families for ransom negotiation chat channels.
Detects network activity associated with the Mantax/Otax Android malware family, specifically identifying C2 communication to the domain apimantax.otax.fun via TLS SNI and HTTP host headers, as well as potential dynamic C2 configuration retrieval via GitHub using the OkHttp client.
Detects network communication associated with Mantax Otax Android malware, including traffic to identified command-and-control (C2) infrastructure and attempts to retrieve dynamic configuration files from GitHub.
Detects network traffic (TLS SNI or HTTP Host) to Firebase domains (firebaseio.com, firebaseapp.com, firebasedatabase.app) associated with Mantax Otax and other Android ransomware families for ransom negotiation chat channels.
Detects network communication to Firebase infrastructure (.firebaseio.com) initiated by Android devices, which may indicate command-and-control (C2) activity associated with the Mantax Otax malware family. This rule tracks initial connections and should be correlated with specific suspicious domains for higher confidence.
Detects network activity associated with the Mantax/Otax Android malware family, specifically identifying C2 communication to the domain apimantax.otax.fun via TLS SNI and HTTP host headers, as well as potential dynamic C2 configuration retrieval via GitHub using the OkHttp client.
Detects network activity associated with the Mantax/Otax Android malware family, specifically identifying C2 communication to the domain apimantax.otax.fun via TLS SNI and HTTP host headers, as well as potential dynamic C2 configuration retrieval via GitHub using the OkHttp client.
Detects network communication to Firebase infrastructure (.firebaseio.com) initiated by Android devices, which may indicate command-and-control (C2) activity associated with the Mantax Otax malware family. This rule tracks initial connections and should be correlated with specific suspicious domains for higher confidence.
Detects network communication to Firebase infrastructure (.firebaseio.com) initiated by Android devices, which may indicate command-and-control (C2) activity associated with the Mantax Otax malware family. This rule tracks initial connections and should be correlated with specific suspicious domains for higher confidence.
Detects when a non-system application on an Android device is granted Accessibility Service permissions or Notification Listener access. Malicious actors frequently abuse these permissions to perform overlay attacks, keylogging, or intercepting sensitive information such as 2FA codes.
This rule detects the use of the Frida dynamic instrumentation toolkit and the objection framework, specifically searching for command-line arguments and process names associated with their installation or use, as well as network activity on the default Frida server port (27042). It monitors for activities like SSL pinning bypass, mobile application patching, and remote agent deployment.
Detects a process reporting the display name TVHelper whose backing executable is actually libdevice.so or another binary outside standard OEM app directories, consistent with Kimwolf v7 relabeling its payload as the legitimate Android TV helper service to evade casual process-list review.
Detects su-privileged execution of an embedded ELF payload (libdevice.so or the disguised com.n2.systemservice package) from an application-data directory, consistent with the Kimwolf v7 Android dropper establishing persistence outside standard system binary paths.
Detects a single masquerading Kimwolf v7 binary (netd_service, TVHelper, or libdevice.so running from a disguised com.n2.systemservice path) generating at least three distinct flood traffic patterns (UDP game-protocol flood, DNS query flood, or TLS/HTTPS flood) within a 60-second window, indicative of active multi-vector DDoS command execution.
This rule detects the creation of diagnostic crash-dump files within known engineering log directories (e.g., slog, engineermode, vendor/log) within 30 minutes of EngineerModeActivity or YLog execution. This pattern is indicative of potential forensic evidence from an induced modem crash, consistent with known exploit chains targeting specific mobile device vulnerabilities.
Page 11 of 16