Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
327 detections
Filters
Last updated
All Time
Detection languages
113
82
45
40
17
Contributors
117
114
23
15
12
Categories
104
100
94
71
62
Platforms
39,908
7,245
6,529
3,864
3,627
327
Products / Services
82
71
29
17
12
MITRE Techniques
62
45
43
42
34
CVEs
2
1
IDS Classtypes
54
14
6
3
1
IDS Protocols
48
25
5
3
Detects network connections to known Command and Control (C2) IP addresses associated with the LANDFALL Android spyware. While the spyware is known to target Samsung Android devices, this rule detects connections from any device to provide broader coverage against infrastructure reuse.
Detects known malicious files associated with the LANDFALL Android spyware by their SHA256 hash. This provides a high-fidelity method for identifying the presence of the spyware on an endpoint.
Detects the creation or loading of the LANDFALL spyware's SELinux policy manipulator component (`l.so`). This component is used to gain elevated permissions and persistence on compromised Samsung Android devices. The rule identifies the component by its known hash or by its specific file name and path (`/data/data/com.samsung.ipservice/files/l.so`).
Detects the creation or modification of files, particularly shared objects (.so), on Android devices with overly permissive '777' (rwxrwxrwx) permissions. This behavior is a known tactic of the LANDFALL spyware, which sets these permissions on its staged components like 'dec_a.so' to ensure they are executable.
Detects outbound network connections from common messaging or gallery apps on Samsung Android devices to command and control (C2) infrastructure associated with the LANDFALL spyware.
ET MOBILE_MALWARE Klopatra CnC Domain in DNS Lookup (guncel-tv-player-lnat .]com)
ET MOBILE_MALWARE Observed Klopatra Domain (guncel-tv-player-lnat .]com) in TLS SNI
ET MOBILE_MALWARE Observed Klopatra Domain (adsservice2 .org) in TLS SNI
Detects network connections to Command and Control (C2) servers associated with the LANDFALL Android spyware. LANDFALL communicates over HTTPS, often on non-standard ports.
ET MOBILE_MALWARE Observed Klopatra Domain (adsservices .uk) in TLS SNI
ET MOBILE_MALWARE Klopatra CnC Domain in DNS Lookup (adsservice2 .org)
ET MOBILE_MALWARE Android/TrickMo.Banker POST Request
ET MOBILE_MALWARE Klopatra CnC Domain in DNS Lookup (adsservices .uk)
ET MOBILE_MALWARE Android/TrickMo.Banker Config Response
Detects post-exploitation behavior of LANDFALL spyware on Samsung devices. After exploiting CVE-2025-21042, the spyware uses LD_PRELOAD to inject a malicious shared object (.so) from its working directory (`/data/data/com.samsung.ipservice/files/`) into the benign `/system/bin/id` process, often via a shell wrapper.
ET MOBILE_MALWARE Android/TrickMo.Banker GET Config Request
Detects the creation of potential LANDFALL spyware delivery files. These are malformed DNG image files, often with filenames suggesting delivery via WhatsApp, used to exploit CVE-2025-21042.
Detects the LANDFALL Android spyware manipulating SELinux policy by preloading a malicious shared object and passing a path to the 'l.so' policy manipulator component via the PRELOAD_PATH environment variable.
Detects network connections to known Command and Control (C2) servers associated with the LANDFALL Android spyware. The spyware communicates over HTTPS, often on non-standard ports.
Detects network communication patterns associated with the LANDFALL Android spyware C2 servers. This includes connections to known malicious domains/IPs and specific HTTP POST requests used for beaconing.
Detects malformed DNG/TIFF image files used to deliver the LANDFALL Android spyware. These files contain an appended ZIP archive which holds the malicious components.
Page 15 of 16