Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
327 detections
Filters
Last updated
All Time
Detection languages
113
82
45
40
17
Contributors
117
114
23
15
12
Categories
104
100
94
71
62
Platforms
39,908
7,245
6,529
3,864
3,627
327
Products / Services
82
71
29
17
12
MITRE Techniques
62
45
43
42
34
CVEs
2
1
IDS Classtypes
54
14
6
3
1
IDS Protocols
48
25
5
3
Detects signs of Android Wireless Debugging being enabled and potentially leveraged, including the toggle of the ADB_WIFI_ENABLED setting, pairing code generation, accessibility interactions confirming pairing, and the instantiation of a TCP listener by the adbd process.
This rule detects network traffic originating from the RatHat Android malware, specifically identifying the 'SCROLL_DOWN' command in HTTP response bodies. This suggests the malware is receiving instructions from a C2 server to perform UI automation or interaction tasks.
Detects the execution of RatHat, a Go-based Android native daemon masquerading as 'liblocal-service.so'. The rule identifies the malware's use of ADB-derived shell commands to bypass Android Doze mode, prioritize background execution, and tamper with installed applications via pm (package manager) commands.
Detects unauthorized shell-level ADB commands characteristic of the RatHat Go Agent, including modifying doze/standby settings, granting security permissions (WRITE_SECURE_SETTINGS), and disabling or uninstalling system packages via the 'pm' command after self-pairing.
Detects the use of the 'getevent' debugging utility within an Android shell context (UID 2000) to monitor raw touch input events from /dev/input. This technique, often referred to as 'AdbTouchCapture', can be used to capture coordinate data from touchscreens, potentially bypassing system-level security controls like FLAG_SECURE to reconstruct user input, gestures, or PIN/pattern credentials.
Detects a malicious persistence pattern where an out-of-lifecycle daemon (e.g., liblocal-service.so) leverages ADB shell access to silently reinstall an APK and re-grant Accessibility permissions shortly after the application is removed by a user or the system.
Detects a malicious chain of events on Android devices, likely attributed to the RatHat malware, where the 'SystemHelperService' abuses Accessibility Services to programmatically enable Developer Options and Wireless Debugging. It further monitors for the capture of a 6-digit pairing code to facilitate unauthorized local ADB self-pairing.
This rule detects unauthorized screen surveillance on Android devices by correlating the execution of the minicap binary with subsequent network activity indicative of screen data exfiltration to a command-and-control (C2) server. It specifically looks for connections to known exfiltration paths associated with screen monitoring or video uploads within 30 minutes of minicap process activity, effectively identifying surveillance that bypasses Android's MediaProjection consent mechanism.
This rule detects unauthorized screen surveillance on Android devices by correlating the execution of the minicap binary with subsequent network activity indicative of screen data exfiltration to a command-and-control (C2) server. It specifically looks for connections to known exfiltration paths associated with screen monitoring or video uploads within 30 minutes of minicap process activity, effectively identifying surveillance that bypasses Android's MediaProjection consent mechanism.
Detects instances where an Android application, installed from a non-standard source (sideloaded via ADB or unknown sources), requests the BIND_ACCESSIBILITY_SERVICE permission for a service named 'SystemHelper'. This behavior is characteristic of mobile malware like Rathat that leverages accessibility services to gain unauthorized control over user credentials and bank accounts.
Detects the use of the 'getevent' command by a shell process to read raw touch input data from '/dev/input/event*'. This behavior is associated with Android malware attempting to capture user interaction or credentials by monitoring touch events.
Detects mobile malware, specifically the RatHat Android malware, attempting to display unauthorized overlay windows over legitimate banking and financial applications to harvest user credentials via WebView components.
Detects anomalous attempts to silently reinstall an APK or modify accessibility settings via a local ADB shell daemon (identified by specific local-service file paths). This behavior is characteristic of Android malware, such as RatHat, attempting to maintain persistence and gain unauthorized permissions.
Detects network requests related to the RatHat Android malware, specifically focusing on the retrieval of the 'minicap' tool used for screen capture and the subsequent exfiltration of captured screen data or video chunks.
Detects instances where an Android accessibility service named 'SystemHelper' programmatically modifies system settings to enable developer options, ADB debugging, or wireless debugging. This behavior is indicative of malicious applications attempting to gain unauthorized control over device configuration, often seen in Android banking trojans to facilitate command and control or data extraction.
Detects instances where an Android application attempts to initiate an ADB wireless pairing process by connecting to the local loopback address (127.0.0.1). This behavior is characteristic of malicious applications, such as the RatHat malware, attempting to gain unauthorized ADB access to the device to bypass security sandboxes or manipulate device settings.
Detects the execution of known malicious binaries or disguised Go-based daemons (such as frpc, liblocal-service, or libmedia_codec) within the /data/local/tmp/ directory by the Android 'shell' user. This activity is indicative of Rathat malware or similar threats leveraging ADB for persistent C2 communication.
Detects Android malware performing anti-debugging, anti-instrumentation, and environmental checks to evade analysis. The rule monitors for processes querying system properties, checking for debugging artifacts like TracerPid, attempting to locate Frida instrumentation agents, or identifying rooting/Xposed framework artifacts and emulator-specific files.
Detects anomalous ADB commands used by the RatHat Android malware to achieve persistence. This includes adding apps to the battery optimization whitelist, changing application standby buckets to 'active' to bypass background restrictions, disabling specific user-mode applications, or modifying accessibility service configurations.
Detects network activity associated with the 'RatHat' Android malware, specifically identifying attempts to retrieve tunnel configuration, deployment confirmation, and the initial reverse tunnel handshake using the fatedier/frp (Fast Reverse Proxy) tool.
Detects a non-system application using the PackageInstaller Session API to perform sideloading followed immediately by a request or binding to an AccessibilityService. This behavior is indicative of malicious droppers or malware (such as the RatHat Android malware family) attempting to bypass install restrictions and gain elevated control over the device to manipulate settings like Developer Options or Wireless Debugging.
Page 6 of 16