Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,542 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the creation of scheduled tasks using schtasks.exe initiated by command shells where the task command points to files residing in non-standard or user-writable directories such as \Users\Public\, \PerfLogs\, or \ProgramData\. This pattern is frequently utilized by malware loaders like SocGholish, GootLoader, and various ransomware strains to achieve persistence following initial compromise.
Detects network activity associated with RatHat FRP (Fast Reverse Proxy), including configuration fetching, deployment notifications, and command-and-control handshakes. These rules monitor for specific HTTP API endpoints and TCP patterns used by the tool to establish unauthorized reverse tunnels.
Detects Android APK files utilizing anti-analysis techniques associated with the RatHat malware family, including malformed AndroidManifest.xml structures with custom 0x9999 chunk headers, high-entropy/oversized manifest files, and obfuscated DEX bytecode markers designed to disrupt static analysis and decompilation tools.
Detects outbound network requests to Google Gemini AI API endpoints from processes that are not common web browsers or known development tools. This behavior is indicative of unauthorized use of LLM services by non-browser applications, such as the RatHat UI-automation module, for processing sensitive data or automation tasks.
Detects unauthorized usage of Android Debug Bridge (ADB) commands to modify power management settings (Doze whitelist, app standby buckets) and grant secure settings permissions. These commands are typically used by persistent agents to prevent the operating system from terminating the process during battery optimization or low-resource states.
Detects a browser process downloading an APK installer file from a source other than official Google Play infrastructure. This behavior is commonly associated with smishing, malvertising, and redirection to deceptive third-party application portals used to distribute malware-laced APK droppers.
Detects execution of Android shell commands associated with power management and Doze mode exemptions (e.g., dumpsys deviceidle whitelist, pm grant) initiated by or involving a file named liblocal-service.so, which is characteristic of the Go Agent binary.
Detects network traffic associated with the RatHat malware family, which leverages the Gemini API to perform automated UI navigation on Android devices. The rule identifies both the outgoing prompt containing UI analysis instructions and the corresponding incoming API response containing coordinate-based navigation instructions.
Detects network communication to specific API endpoints associated with the RatHat Android malware, which leverages accessibility services for overlay-based credential harvesting and data exfiltration.
Detects anomalous attempts to silently reinstall an APK or modify accessibility settings via a local ADB shell daemon (identified by specific local-service file paths). This behavior is characteristic of Android malware, such as RatHat, attempting to maintain persistence and gain unauthorized permissions.
Page 325 of 1168