Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
327 detections
Filters
Last updated
All Time
Detection languages
113
82
45
40
17
Contributors
117
114
23
15
12
Categories
104
100
94
71
62
Platforms
39,908
7,245
6,529
3,864
3,627
327
Products / Services
82
71
29
17
12
MITRE Techniques
62
45
43
42
34
CVEs
2
1
IDS Classtypes
54
14
6
3
1
IDS Protocols
48
25
5
3
This rule detects HTTP GET requests resulting in the download of an Android Package (.apk) file where the host is not a known official Google Play or reputable third-party application distribution source. It further validates the detection by inspecting the HTTP response headers for the specific Android application package MIME type and the response body for indicators commonly associated with fake branded application portals.
Detects known Koktevrat Android RAT campaign APK artifacts by published SHA-256 hashes and associated package name string
Detects outbound network communication patterns (DNS lookups and TLS SNI traffic) associated with the Koktevrat Android RAT. The rule monitors for connections to known malicious domains used for command-and-control (C2) operations.
Detects Koktevrat Stage 2 Android RAT component (com.kowo.ciligeci) that unpacks the RC4-encrypted uoN.css/uoN.apk payload using the RC4 key iOZ
Detects Koktevrat Stage 1 dropper (femam.apk / MandatGO) that decrypts and installs the encrypted wudEMR.apk secondary payload using a 3-byte XOR key
This rule detects network traffic patterns associated with the RatHat Android malware. Specifically, it monitors for HTTP requests targeting the '/api/sapp' or '/api/bapp' URIs, which are used by this malware for C2 evasion or to retrieve its block list.
This rule detects potential keystroke logging activities on Android devices by monitoring the 'UniversalInputMonitor' accessibility service. This service is abused by the RatHat malware family and similar threats to capture user input, including passwords, PINs, and text entered into masked fields, by intercepting accessibility text events.
Detects the execution of the Android 'getevent' utility with arguments indicative of monitoring raw input device events (e.g., /dev/input/, EV_ABS, ABS_MT_POSITION). This activity is often associated with monitoring user input, touch events, or keystrokes, which can be indicative of keylogging or user interaction monitoring.
Detects suspicious Android application installation attempts using the 'pm install' command, triggered by processes or libraries named 'local-service' or 'liblocal-service.so'. This behavior is often associated with the manual side-loading of potentially malicious APK files in an Android environment.
Detects unauthorized Android Debug Bridge (ADB) commands or modifications to Android system settings that enable Wireless Debugging or Developer Options, originating from non-system applications. This behavior is indicative of malware or malicious actors attempting to maintain persistence or remote access via Android debugging interfaces.
Detects execution of malicious binaries ('liblocal-service.so', 'frpc', 'local-service.update') or suspicious shell commands on Android devices consistent with the RatHat malware family. The rule monitors for unauthorized APK installations, modification of accessibility service settings, and manipulation of system standby/doze modes via adb or local shell commands.
Detects network traffic containing configuration parameters associated with RatHat Android malware (FrpsAddr, FrpsPort, FrpsToken), indicating an attempt to establish a reverse tunnel to a Command and Control server for remote access or proxying.
Detects malicious Android application activity where an app attempts to enable accessibility services and wireless debugging to perform unauthorized ADB pairing and connection. This technique is associated with the RatHat malware family to bypass sandbox protections and perform self-pairing for ADB access without user interaction.
This rule monitors Android device process events for the execution of 'adb' commands aimed at modifying sensitive system configurations. It specifically tracks attempts to enable accessibility services, toggle wireless debugging, or establish unauthorized ADB pairings. The rule identifies potential malicious intent by aggregating multiple suspicious configuration changes on the same device within a short time window.
This rule monitors Android device process events for the execution of 'adb' commands aimed at modifying sensitive system configurations. It specifically tracks attempts to enable accessibility services, toggle wireless debugging, or establish unauthorized ADB pairings. The rule identifies potential malicious intent by aggregating multiple suspicious configuration changes on the same device within a short time window.
This rule detects HTTP GET requests resulting in the download of an Android Package (.apk) file where the host is not a known official Google Play or reputable third-party application distribution source. It further validates the detection by inspecting the HTTP response headers for the specific Android application package MIME type and the response body for indicators commonly associated with fake branded application portals.
This rule detects HTTP GET requests resulting in the download of an Android Package (.apk) file where the host is not a known official Google Play or reputable third-party application distribution source. It further validates the detection by inspecting the HTTP response headers for the specific Android application package MIME type and the response body for indicators commonly associated with fake branded application portals.
This rule detects network traffic patterns associated with the Koktevrat Android RAT, specifically identifying periodic TLS beacons (heartbeats) destined for known C2 domains (streams-tv.lol and stream-plus.lat). The behavior suggests the use of Android's AlarmManager to schedule recurring callbacks to the C2 infrastructure.
Detects known Koktevrat Android RAT campaign APK artifacts by published SHA-256 hashes and associated package name string
Detects known Koktevrat Android RAT campaign APK artifacts by published SHA-256 hashes and associated package name string
Detects Koktevrat Stage 2 Android RAT component (com.kowo.ciligeci) that unpacks the RC4-encrypted uoN.css/uoN.apk payload using the RC4 key iOZ
Page 9 of 16