Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1 detection
Filters
Last updated
All Time
Detection languages
1
Contributors
1
Categories
1
1
1
Platforms
1
MITRE Techniques
18,177
15,736
12,662
8,477
6,294
Detects sideloaded Android applications that simultaneously initiate screen capture via the MediaProjection API and audio recording via the RECORD_AUDIO permission. This activity is consistent with surveillance capabilities of the Ghazwa spyware used by the APT36 threat actor.
