Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,100 downloads4,386 copies51 likes26,183 views
7,555 detections
Filters
Last updated
All Time
Detection languages
5,650
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
924
Platforms
4,191
1,622
1,250
676
676
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,520
1,413
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
Detects Android device management (MDM) components (specifically 'com.corp.mdm') re-launching registration or sticky services upon system events such as boot completion, quick-boot, or package updates. This monitoring is intended to identify persistent components that maintain functionality across device restarts.
Detects malicious Android application installation or launch behavior consistent with the 'Corp MDM' implant. This rule specifically identifies instances where a package named 'com.corp.mdm' is installed or launched and rapidly requests a combination of high-risk permissions including SMS and telephony access (RECEIVE_SMS, READ_SMS, CALL_PHONE) alongside notification permissions, which is characteristic of the implant's initial setup phase.
Detects processes running from user-writable locations (Temp/AppData/Public/Downloads) creating a self-referential Windows Firewall allow rule via netsh, consistent with NJRAT establishing outbound C2 connectivity while evading network-based blocking.
Detects cleartext HTTP POST requests to specific URI endpoints (/api/v1/devices/register or /api/v1/devices/heartbeat) known to be used by the Corp_MDM Android spyware for C2 communication, registration, or heartbeat signals.
Detects cleartext HTTP POST requests to specific URI endpoints (/api/v1/devices/register or /api/v1/devices/heartbeat) known to be used by the Corp_MDM Android spyware for C2 communication, registration, or heartbeat signals.
This rule monitors for outbound TCP and HTTP traffic to a known malicious infrastructure hosting a fake or compromised 'Corp MDM' (Mobile Device Management) admin panel, which serves as a Command and Control (C2) channel for spyware.
Detects network traffic patterns indicative of unauthorized or malicious APK sideloading attempts, specifically targeting fake Google Play delivery mechanisms, lure domains, and known command-and-control (C2) infrastructure.
Detects network traffic patterns indicative of unauthorized or malicious APK sideloading attempts, specifically targeting fake Google Play delivery mechanisms, lure domains, and known command-and-control (C2) infrastructure.
Detects network traffic patterns indicative of unauthorized or malicious APK sideloading attempts, specifically targeting fake Google Play delivery mechanisms, lure domains, and known command-and-control (C2) infrastructure.
Detects network traffic patterns indicative of unauthorized or malicious APK sideloading attempts, specifically targeting fake Google Play delivery mechanisms, lure domains, and known command-and-control (C2) infrastructure.
Page 293 of 756