Rokarolla Banking Trojan - Suspicious Android Accessibility Service Abuse
Detects the activation of Android Accessibility Services by non-legitimate, potentially malicious applications. This behavior is commonly associated with banking trojans like Rokarolla that abuse accessibility permissions to perform UI automation, keystroke logging, and screen scraping.
Microsoft Sentinel (KQL)
