Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
327 detections
Filters
Last updated
All Time
Detection languages
113
82
45
40
17
Contributors
117
114
23
15
12
Categories
104
100
94
71
62
Platforms
39,908
7,245
6,529
3,864
3,627
327
Products / Services
82
71
29
17
12
MITRE Techniques
62
45
43
42
34
CVEs
2
1
IDS Classtypes
54
14
6
3
1
IDS Protocols
48
25
5
3
This rule detects a multi-stage phishing attack, often referred to as 'quishing'. It identifies incoming emails containing image (JPG, PNG) or PDF attachments that embed previously unseen URLs, correlated with a subsequent sign-in event from a mobile device by the same recipient, which is a common indicator of Adversary-in-the-Middle (AiTM) credential harvesting.
Detects Android device management (MDM) components (specifically 'com.corp.mdm') re-launching registration or sticky services upon system events such as boot completion, quick-boot, or package updates. This monitoring is intended to identify persistent components that maintain functionality across device restarts.
Detects Android device management (MDM) components (specifically 'com.corp.mdm') re-launching registration or sticky services upon system events such as boot completion, quick-boot, or package updates. This monitoring is intended to identify persistent components that maintain functionality across device restarts.
Detects Android device management (MDM) components (specifically 'com.corp.mdm') re-launching registration or sticky services upon system events such as boot completion, quick-boot, or package updates. This monitoring is intended to identify persistent components that maintain functionality across device restarts.
Detects malicious Android application installation or launch behavior consistent with the 'Corp MDM' implant. This rule specifically identifies instances where a package named 'com.corp.mdm' is installed or launched and rapidly requests a combination of high-risk permissions including SMS and telephony access (RECEIVE_SMS, READ_SMS, CALL_PHONE) alongside notification permissions, which is characteristic of the implant's initial setup phase.
Detects unauthorized or suspicious use of USSD codes by the corporate MDM agent to modify call-forwarding settings. This activity is indicative of a compromise where an attacker uses an MDM-controlled device to intercept calls or divert communications.
Detects outbound HTTP requests from endpoints to a known C2 infrastructure associated with mobile device spyware. The rule identifies two specific stages: polling for new commands using a GET request and posting command execution results using a POST request, both targeting an MDM-mimicking API structure.
Detects outbound HTTP requests from endpoints to a known C2 infrastructure associated with mobile device spyware. The rule identifies two specific stages: polling for new commands using a GET request and posting command execution results using a POST request, both targeting an MDM-mimicking API structure.
Detects cleartext HTTP POST requests to specific URI endpoints (/api/v1/devices/register or /api/v1/devices/heartbeat) known to be used by the Corp_MDM Android spyware for C2 communication, registration, or heartbeat signals.
Detects cleartext HTTP POST requests to specific URI endpoints (/api/v1/devices/register or /api/v1/devices/heartbeat) known to be used by the Corp_MDM Android spyware for C2 communication, registration, or heartbeat signals.
Detects network traffic patterns indicative of unauthorized or malicious APK sideloading attempts, specifically targeting fake Google Play delivery mechanisms, lure domains, and known command-and-control (C2) infrastructure.
Detects network traffic patterns indicative of unauthorized or malicious APK sideloading attempts, specifically targeting fake Google Play delivery mechanisms, lure domains, and known command-and-control (C2) infrastructure.
Detects network traffic patterns indicative of unauthorized or malicious APK sideloading attempts, specifically targeting fake Google Play delivery mechanisms, lure domains, and known command-and-control (C2) infrastructure.
Detects network traffic patterns indicative of unauthorized or malicious APK sideloading attempts, specifically targeting fake Google Play delivery mechanisms, lure domains, and known command-and-control (C2) infrastructure.
Detects HTTP requests to domains masquerading as Google Play ('playgoogle.') that are attempting to serve Android application packages (.apk). This is a common indicator of malicious sideloading campaigns using typosquatting to deceive users into downloading fake applications.
Detects HTTP requests to domains masquerading as Google Play ('playgoogle.') that are attempting to serve Android application packages (.apk). This is a common indicator of malicious sideloading campaigns using typosquatting to deceive users into downloading fake applications.
Detects HTTP requests to domains masquerading as Google Play ('playgoogle.') that are attempting to serve Android application packages (.apk). This is a common indicator of malicious sideloading campaigns using typosquatting to deceive users into downloading fake applications.
Detects HTTP requests to domains masquerading as Google Play ('playgoogle.') that are attempting to serve Android application packages (.apk). This is a common indicator of malicious sideloading campaigns using typosquatting to deceive users into downloading fake applications.
This rule detects HTTP GET requests resulting in the download of an Android Package (.apk) file where the host is not a known official Google Play or reputable third-party application distribution source. It further validates the detection by inspecting the HTTP response headers for the specific Android application package MIME type and the response body for indicators commonly associated with fake branded application portals.
Detects the execution of the Android system utility 'getevent' by suspicious processes or in contexts suggesting unauthorized input event monitoring. This may indicate an attempt to capture user input, touch events, or screen interaction data.
Detects anomalous process activity associated with the RatHat Android malware, specifically the execution of 'liblocal-service.so' as a daemon and its use for silent APK reinstallation or monitoring of package paths (via 'pm' commands).
Page 7 of 16