RatHat-style automated screen-lock bypass command sequence
Detects a specific sequence of commands indicative of the RatHat malware on Android, involving waking the device followed by automated unlock gestures or PIN input and password retrieval commands.
Microsoft Sentinel (KQL)
