Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
327 detections
Filters
Last updated
All Time
Detection languages
113
82
45
40
17
Contributors
117
114
23
15
12
Categories
104
100
94
71
62
Platforms
39,908
7,245
6,529
3,864
3,627
327
Products / Services
82
71
29
17
12
MITRE Techniques
62
45
43
42
34
CVEs
2
1
IDS Classtypes
54
14
6
3
1
IDS Protocols
48
25
5
3
Detects the Ghazwa spyware, attributed to APT36, querying sensitive Android system resources (CallLog and SMS Content Providers) from an application that is not a native dialer or messaging app. The rule further correlates this data access with subsequent outbound network activity, indicating potential data exfiltration.
Detects anomalous surveillance-like behavior on Android devices associated with the APT36 Ghazwa spyware. The rule identifies applications that check more than 8 distinct sensitive Android permissions within a 60-second window, followed immediately by an outbound HTTP/HTTPS POST request to an external IP, indicative of spyware pre-staging and data exfiltration.
Detects sideloaded Android applications that simultaneously initiate screen capture via the MediaProjection API and audio recording via the RECORD_AUDIO permission. This activity is consistent with surveillance capabilities of the Ghazwa spyware used by the APT36 threat actor.
Fraud framework powering scam domains for crypto and gambling schemes
Detects the installation and execution of known APT36 Ghazwa spyware variants (com.ghazwa.updates, com.chragall, or com.chagall) that are sideloaded (not from the official Google Play Store) and attempt to request or activate Device Administrator privileges via intent actions or receiver class activation.
This rule detects suspicious audio capture activity associated with the APT36 Ghazwa spyware. It monitors for the execution of specific foreground services (MEATIER or ADSFEAM) from the package 'com.ghazwa.updates' simultaneously with the application requesting 'RECORD_AUDIO' permissions on the same device.
Detects the APT36 Ghazwa spyware (GPSSERV component) performing periodic, continuous exfiltration of GPS coordinates to a specific command-and-control port (18585). The rule identifies suspicious network traffic from non-navigation applications that have requested location permissions, filtering out known legitimate mapping services.
This rule detects activity associated with known Android Remote Access Trojans (RATs) such as BTMOB, CraxsRAT, CypherRAT, and SpySolr on SentinelOne-managed Android devices. It flags suspicious file creations (sideloaded APKs in user storage), specific malicious process names, SentinelOne threat indicators, and abuse of accessibility services for unauthorized remote control, keylogging, or screen overlay activities.
Fraud framework powering scam domains for crypto and gambling schemes
This rule monitors Android system logs for suspicious activity related to the NearbyConnections API. It specifically flags incomplete UKEY2 handshakes, unauthenticated frame processing, and pre-authentication frame requests, which may indicate attempts to intercept or interfere with local device discovery and connection protocols.
This rule monitors Android system logs for suspicious activity related to the NearbyConnections API. It specifically flags incomplete UKEY2 handshakes, unauthenticated frame processing, and pre-authentication frame requests, which may indicate attempts to intercept or interfere with local device discovery and connection protocols.
Detects Android applications exhibiting multiple sensitive behaviors simultaneously within a 5-minute window, such as screen recording, audio capture, GPS tracking, and unauthorized access to SMS, call logs, or contacts. This behavior is strongly indicative of malicious mobile spyware.
This rule detects attempts by the Rokarolla trojan to disable Google Play Protect on Android devices. It monitors for Accessibility Service actions, Android Accessibility Events, or App Control Actions that target 'com.google.android.gms' and contain keywords like 'play_protect', 'PlayProtect', 'finskyEula', 'security_scan', or 'disable'. This behavior indicates the malware is trying to suppress security scans by Google Play Protect.
Detects the installation of the BTMOB Android RAT by identifying sideloaded application installations combined with the enablement of sensitive features such as Android Accessibility Services, device administrator registration, or the granting of high-risk permissions (SMS, camera, audio recording) typically used by mobile banking trojans.
Detects the activation of Android Accessibility Services by non-legitimate, potentially malicious applications. This behavior is commonly associated with banking trojans like Rokarolla that abuse accessibility permissions to perform UI automation, keystroke logging, and screen scraping.
Detects when the default SMS application on an Android device is changed to an application that is not recognized as a trusted SMS provider. This behavior is often indicative of malicious applications attempting to intercept incoming SMS messages, such as those containing multi-factor authentication (MFA) codes, by positioning themselves as the system's primary handler for SMS communications.
Detects the activation of Android Accessibility Services by non-legitimate, potentially malicious applications. This behavior is commonly associated with banking trojans like Rokarolla that abuse accessibility permissions to perform UI automation, keystroke logging, and screen scraping.
Detects the Montana Empire Android malware, either through a direct SHA256 hash match or through structural characteristics of the APK file (such as the presence of 'post.apk') combined with specific embedded strings commonly found in the attacker's fraudulent mobile landing pages used for social proof.
Detects instances where a user successfully authenticates from a mobile device (Android or iPhone) that exhibits a geographic mismatch (geo_country vs registered_country), and subsequently performs a sensitive credential or MFA-related action (enrollment or reset) from a different device within one hour. This pattern is indicative of a potential session hijacking or credential compromise where an attacker attempts to establish persistence by enrolling their own MFA device.
Detects network communication with the Rokarolla trojan's command and control (C2) server ('beralisvc.info') and subsequent injection of base64-encoded HTML phishing overlays into legitimate banking application UIs. The rule identifies C2 contact via network events and the presence of specific HTML content indicators ('html_base64', 'PCFEt0NUWVBFIGh0bWw+', 'com.imaginbank.app') in HTTP responses, suggesting an overlay attack.
Detects the creation or modification of APK files in user-accessible download and temporary directories initiated by web browsers or file management applications. This behavior is indicative of potential sideloading of malicious Android applications, often used in malware delivery campaigns.
Page 13 of 16