Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
1
1
Contributors
1
1
Categories
1
1
1
1
1
Platforms
2
Products / Services
1
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
Detects the RatHat Android malware component using getevent or direct access to /dev/input event files to capture user PINs and patterns. The rule filters for processes running under UID 2000 (shell) or identifying as liblocal-service, which are consistent with the malware's keylogging behavior.
Detects the creation of overlay windows on top of sensitive financial or cryptocurrency applications and the granting of the SYSTEM_ALERT_WINDOW (draw-over-other-apps) permission to third-party applications. This behavior is highly characteristic of Android banking trojans attempting to capture credentials or PII via phishing overlays.
