RatHat getevent-based touch capture executed under shell UID
Detects the execution of the 'getevent' debugging utility within an Android ADB shell context, specifically targeting raw input events from /dev/input. This behavior is indicative of potential unauthorized input monitoring, such as capturing PINs, patterns, or passwords via touch coordinate tracking.
YARA-L
