Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,552 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects unauthorized shell-level ADB commands characteristic of the RatHat Go Agent, including modifying doze/standby settings, granting security permissions (WRITE_SECURE_SETTINGS), and disabling or uninstalling system packages via the 'pm' command after self-pairing.
Detects the use of the 'getevent' debugging utility within an Android shell context (UID 2000) to monitor raw touch input events from /dev/input. This technique, often referred to as 'AdbTouchCapture', can be used to capture coordinate data from touchscreens, potentially bypassing system-level security controls like FLAG_SECURE to reconstruct user input, gestures, or PIN/pattern credentials.
Detects a malicious persistence pattern where an out-of-lifecycle daemon (e.g., liblocal-service.so) leverages ADB shell access to silently reinstall an APK and re-grant Accessibility permissions shortly after the application is removed by a user or the system.
Detects a malicious chain of events on Android devices, likely attributed to the RatHat malware, where the 'SystemHelperService' abuses Accessibility Services to programmatically enable Developer Options and Wireless Debugging. It further monitors for the capture of a 6-digit pairing code to facilitate unauthorized local ADB self-pairing.
Detects a suspected malicious sequence associated with RatHat activity. The rule identifies a device fetching an injection template configuration from a remote URL, followed by the exfiltration of credentials or form data to specific API endpoints on the same device within a 15-minute window.
This rule detects unauthorized screen surveillance on Android devices by correlating the execution of the minicap binary with subsequent network activity indicative of screen data exfiltration to a command-and-control (C2) server. It specifically looks for connections to known exfiltration paths associated with screen monitoring or video uploads within 30 minutes of minicap process activity, effectively identifying surveillance that bypasses Android's MediaProjection consent mechanism.
This rule detects unauthorized screen surveillance on Android devices by correlating the execution of the minicap binary with subsequent network activity indicative of screen data exfiltration to a command-and-control (C2) server. It specifically looks for connections to known exfiltration paths associated with screen monitoring or video uploads within 30 minutes of minicap process activity, effectively identifying surveillance that bypasses Android's MediaProjection consent mechanism.
Detects instances where an Android application, installed from a non-standard source (sideloaded via ADB or unknown sources), requests the BIND_ACCESSIBILITY_SERVICE permission for a service named 'SystemHelper'. This behavior is characteristic of mobile malware like Rathat that leverages accessibility services to gain unauthorized control over user credentials and bank accounts.
Detects the use of the 'getevent' command by a shell process to read raw touch input data from '/dev/input/event*'. This behavior is associated with Android malware attempting to capture user interaction or credentials by monitoring touch events.
Detects mobile malware, specifically the RatHat Android malware, attempting to display unauthorized overlay windows over legitimate banking and financial applications to harvest user credentials via WebView components.
Page 395 of 1168