Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,100 downloads4,383 copies51 likes26,140 views
7,555 detections
Filters
Last updated
All Time
Detection languages
5,650
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
924
Platforms
4,191
1,622
1,250
676
676
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,520
1,413
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
This rule detects a suspicious monetization pattern where a user account experiences a high-risk sign-in event, followed shortly (within 2 hours) by the creation or modification of inbox rules. This pattern is often indicative of account compromise, where an adversary configures mailbox rules (e.g., forwarding or redirection) to facilitate data exfiltration or financial fraud.
Detects Android device management (MDM) components (specifically 'com.corp.mdm') re-launching registration or sticky services upon system events such as boot completion, quick-boot, or package updates. This monitoring is intended to identify persistent components that maintain functionality across device restarts.
Detects a specific concealment behavior attributed to the 'com.corp.mdm' Android implant. The rule monitors for a sequence of events where the application disables its own launcher (main activity) to hide from the app drawer, immediately followed by the initiation of a foreground service that masquerades as a system notification ('Android System' title with 'System service running.' text).
Detects a specific concealment behavior attributed to the 'com.corp.mdm' Android implant. The rule monitors for a sequence of events where the application disables its own launcher (main activity) to hide from the app drawer, immediately followed by the initiation of a foreground service that masquerades as a system notification ('Android System' title with 'System service running.' text).
Detects a specific concealment behavior attributed to the 'com.corp.mdm' Android implant. The rule monitors for a sequence of events where the application disables its own launcher (main activity) to hide from the app drawer, immediately followed by the initiation of a foreground service that masquerades as a system notification ('Android System' title with 'System service running.' text).
Detects malicious Android application installation or launch behavior consistent with the 'Corp MDM' implant. This rule specifically identifies instances where a package named 'com.corp.mdm' is installed or launched and rapidly requests a combination of high-risk permissions including SMS and telephony access (RECEIVE_SMS, READ_SMS, CALL_PHONE) alongside notification permissions, which is characteristic of the implant's initial setup phase.
Detects unauthorized or suspicious use of USSD codes by the corporate MDM agent to modify call-forwarding settings. This activity is indicative of a compromise where an attacker uses an MDM-controlled device to intercept calls or divert communications.
Detects unauthorized or suspicious use of USSD codes by the corporate MDM agent to modify call-forwarding settings. This activity is indicative of a compromise where an attacker uses an MDM-controlled device to intercept calls or divert communications.
Detects unauthorized or suspicious use of USSD codes by the corporate MDM agent to modify call-forwarding settings. This activity is indicative of a compromise where an attacker uses an MDM-controlled device to intercept calls or divert communications.
Detects unauthorized or suspicious use of USSD codes by the corporate MDM agent to modify call-forwarding settings. This activity is indicative of a compromise where an attacker uses an MDM-controlled device to intercept calls or divert communications.
Page 221 of 756