Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
327 detections
Filters
Last updated
All Time
Detection languages
113
82
45
40
17
Contributors
117
114
23
15
12
Categories
104
100
94
71
62
Platforms
39,908
7,245
6,529
3,864
3,627
327
Products / Services
82
71
29
17
12
MITRE Techniques
62
45
43
42
34
CVEs
2
1
IDS Classtypes
54
14
6
3
1
IDS Protocols
48
25
5
3
This rule detects the execution of the Unisoc/Sprd 'EngineerModeActivity' via ADB shell on Android devices. Invoking this activity enables diagnostic modes and debug logging, which are often used by threat actors to facilitate exploitation, reverse engineering, or the collection of sensitive crash dump information for modem-related research.
This rule detects the use of the Frida dynamic instrumentation toolkit and the objection framework, specifically searching for command-line arguments and process names associated with their installation or use, as well as network activity on the default Frida server port (27042). It monitors for activities like SSL pinning bypass, mobile application patching, and remote agent deployment.
Detects a process reporting the name netd_service whose backing executable path does not match genuine Android system netd binary locations, indicating Kimwolf v7 process masquerading to blend into legitimate network daemon activity.
Detects creation of an abstract Unix domain socket matching the Kimwolf v7 single-instance mutex naming convention (@*boxv7/@*boxv4/@*boxv5) by a process running from a non-system, application-data path.
This rule detects the presence of Android applications, packages, or signals related to root-based SSL unpinning modules (e.g., JustTrustMe, TrustMeAlready, MagiskTrustUserCerts) or instrumentation frameworks (Xposed, LSPosed) when associated with Magisk or Shamiko root management tools. These tools are commonly used by adversaries to bypass SSL certificate validation on compromised or rooted Android devices, allowing for man-in-the-middle (MITM) attacks against network traffic.
This rule detects activities indicative of Android APK repackaging and the manual injection of the Frida-gadget library to bypass security controls like SSL pinning. It monitors for the use of APK patching tools followed by ADB installation commands, the installation of specific patched APK names, the presence of the Frida-gadget shared library file, and system-level signature mismatch errors from the PackageManager.
This rule detects the presence of Android applications, packages, or signals related to root-based SSL unpinning modules (e.g., JustTrustMe, TrustMeAlready, MagiskTrustUserCerts) or instrumentation frameworks (Xposed, LSPosed) when associated with Magisk or Shamiko root management tools. These tools are commonly used by adversaries to bypass SSL certificate validation on compromised or rooted Android devices, allowing for man-in-the-middle (MITM) attacks against network traffic.
Detects the execution of 'su' or 'sh' binaries from within suspicious application-specific directories on Android devices. These directories typically house application libraries or data, and execution of system binaries from these locations, particularly when combined with arguments like 'persisted' or 'exit', is indicative of privilege escalation attempts or malicious persistence mechanisms by Android malware.
This rule detects activities indicative of Android APK repackaging and the manual injection of the Frida-gadget library to bypass security controls like SSL pinning. It monitors for the use of APK patching tools followed by ADB installation commands, the installation of specific patched APK names, the presence of the Frida-gadget shared library file, and system-level signature mismatch errors from the PackageManager.
Detects malicious Android applications that leverage Accessibility Services for automated interaction. Specifically, the rule monitors for the installation of an app, followed by the immediate enabling of Accessibility Services and subsequent synthetic tap events on the screen within a narrow timeframe. This pattern is characteristic of malware attempting to automatically grant itself sensitive permissions or bypass user consent dialogs, such as the behavior observed in the BTMOB RAT.
Detects the creation of overlay windows on top of sensitive financial or cryptocurrency applications and the granting of the SYSTEM_ALERT_WINDOW (draw-over-other-apps) permission to third-party applications. This behavior is highly characteristic of Android banking trojans attempting to capture credentials or PII via phishing overlays.
Detects the initialization of the PromptSpy malware's custom 'IpcSocket' class, which establishes a TCP listener bound to the localhost (127.0.0.1) address. This mechanism is utilized for inter-process communication between various components of the PromptSpy malware to coordinate malicious activities on the Android platform.
Detects the use of foreground services and WakeLock mechanisms on Android, which can be leveraged by malicious applications like PromptSpy to maintain persistence and prevent the application from being terminated by the system.
Detects the registration of a broadcast receiver for the 'BOOT_COMPLETED' intent, a technique commonly used by Android malware to achieve persistence by executing code automatically upon device startup.
Detects Android APK files that contain a combination of suspicious permissions and features often used for credential harvesting, specifically the binding of an accessibility service, SMS interception permissions, and overlay capability (System Alert Window).
Detects instances where a user successfully authenticates from a mobile device (Android or iPhone) that exhibits a geographic mismatch (geo_country vs registered_country), and subsequently performs a sensitive credential or MFA-related action (enrollment or reset) from a different device within one hour. This pattern is indicative of a potential session hijacking or credential compromise where an attacker attempts to establish persistence by enrolling their own MFA device.
Detects unauthorized usage of the Android AccessibilityService 'performGlobalAction' to trigger a 'BACK' operation specifically when the Android Settings application is active. This behavior is indicative of malicious applications attempting to obstruct user attempts to reach the Settings menu to uninstall a malicious package.
Detects the initialization of an Android package installation session using the 'PackageInstaller.createSession' API in conjunction with 'PackageInstaller$SessionParams'. This behavior is indicative of potential silent second-stage APK installation, a technique used by malicious applications to bypass standard installation prompts or deploy additional malicious components.
Detects the registration of a broadcast receiver for the 'BOOT_COMPLETED' intent, a technique commonly used by Android malware to achieve persistence by executing code automatically upon device startup.
Detects potentially malicious Android applications installed via non-standard sources that exhibit suspicious characteristics such as masquerading as system/security updates, requesting device administrator privileges, or clustering highly sensitive permissions like location, contacts, call logs, and audio recording.
This rule detects HTTP responses that return an Android Package (APK) file (application/vnd.android.package-archive) to a client. This is indicative of potential mobile malware delivery or unauthorized application distribution.
Page 12 of 16