Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
327 detections
Filters
Last updated
All Time
Detection languages
113
82
45
40
17
Contributors
117
114
23
15
12
Categories
104
100
94
71
62
Platforms
39,908
7,245
6,529
3,864
3,627
327
Products / Services
82
71
29
17
12
MITRE Techniques
62
45
43
42
34
CVEs
2
1
IDS Classtypes
54
14
6
3
1
IDS Protocols
48
25
5
3
Detects the presence of the OrbitalVoyage payload package or related artifact names in device file and process telemetry, including suspicious APK installations outside of authorized paths.
Detects network, DNS, email, and URL click events matching known IOC domains associated with AdFection, Candiru, and Discover-Tech threat intelligence reports.
Detects the execution of reverse engineering and decompilation tools such as JADX or Blutter against Android APK files or Flutter application binaries (libapp.so), as well as the creation of their typical output artifacts and staging folders.
Detects the execution of reverse engineering and decompilation tools such as JADX or Blutter against Android APK files or Flutter application binaries (libapp.so), as well as the creation of their typical output artifacts and staging folders.
Detects the execution of reverse engineering and decompilation tools such as JADX or Blutter against Android APK files or Flutter application binaries (libapp.so), as well as the creation of their typical output artifacts and staging folders.
Identifies devices that have been enrolled within the last 30 days, displaying details such as device name, model, enrollment profile name, and enrollment date.
Detects the execution of reverse engineering and decompilation tools such as JADX or Blutter against Android APK files or Flutter application binaries (libapp.so), as well as the creation of their typical output artifacts and staging folders.
Detects the execution of reverse engineering and decompilation tools such as JADX or Blutter against Android APK files or Flutter application binaries (libapp.so), as well as the creation of their typical output artifacts and staging folders.
Detects searches for the specific Android application package name 'com.ballbounce.Hizbartech', which may indicate investigation into potentially malicious or unwanted applications.
Detects network, DNS, email, and URL click events matching known IOC domains associated with AdFection, Candiru, and Discover-Tech threat intelligence reports.
Detects network, DNS, email, and URL click events matching known IOC domains associated with AdFection, Candiru, and Discover-Tech threat intelligence reports.
Detects when a device connects to a wireless network SSID that has not been observed in the baseline over the previous 14 days.
Detects network, DNS, email, and URL click events matching known IOC domains associated with AdFection, Candiru, and Discover-Tech threat intelligence reports.
Detects network, DNS, email, and URL click events matching known IOC domains associated with AdFection, Candiru, and Discover-Tech threat intelligence reports.
Detects network activity associated with the RatHat Android malware, specifically tracking device registration, log uploads to '/api/node/', and subsequent WebSocket protocol upgrades used for command-and-control communications.
Detects the RatHat ADB self-pairing sequence on Android devices, where an application uses shell-level access gained via ADB to stage and execute malicious binaries (such as Go Agents or FRP clients) from /data/local/tmp. The rule correlates the staging and execution of these specific binaries with subsequent network communication indicative of C2 or data exfiltration.
Detects a malicious sequence of actions originating from an Android Accessibility Service, specifically the 'SystemHelperService'. The activity involves the programmatic enablement of Developer Options and Wireless Debugging, followed by the unauthorized extraction of an ADB pairing PIN from the screen, bypassing user interaction requirements.
Detects the execution of RatHat, a Go-based Android native daemon masquerading as 'liblocal-service.so'. The rule identifies the malware's use of ADB-derived shell commands to bypass Android Doze mode, prioritize background execution, and tamper with installed applications via pm (package manager) commands.
Detects the downloading of Android application packages (.apk) from potentially untrusted or non-official third-party portals, which are often used in smishing or malvertising campaigns to deliver malicious applications to user devices.
Detects Android malware attempting to abuse accessibility services or system settings to enable wireless debugging and spawn an ADB shell with elevated privileges. This behavior is indicative of unauthorized control over the device via Android Debug Bridge (ADB).
Detects the execution of the suspicious shared library 'liblocal-service.so' from the '/data/local/tmp/' directory, initiated by the 'shell' user or an ADB parent process. This activity is associated with malicious behavior where Android debug bridge (ADB) is abused to stage and execute native daemons for privilege escalation or unauthorized system access.
Page 1 of 16