Android Spyware, PLC Attacks & AI Prompt Injection: Detecting and Defending Against Emerging Threat Vectors in 2026

---
title: Android Spyware Data Exfiltration
id: a7b3c9d4-1e5f-4a2b-8c6d-9e1f2a3b4c5d
status: experimental
description: Detects potential Android spyware behavior including excessive permission requests and data exfiltration patterns.
references:
  - https://attack.mitre.org/techniques/T1119/
  - https://attack.mitre.org/techniques/T1560/
author: Security Arsenal
date: 2026/07/14
tags:
  - attack.collection
  - attack.exfiltration
  - attack.t1119
  - attack.t1560
logsource:
  product: android
  category: network_connection
detection:
  selection:
    DestinationPort|endswith:
      - '443'
      - '8443'
    Initiated: 'true'
    AppName|contains:
      - 'safety'
      - 'security'
      - 'emergency'
      - 'protect'
  condition: selection and not filter
falsepositives:
  - Legitimate safety applications
level: high
---
title: PLC Unusual Protocol Activity
id: b8c4d0e5-2f6a-5b3c-9d7e-0f2a3b4c5d6e
status: experimental
description: Detects anomalous protocol activity in ICS/OT environments that may indicate PLC manipulation attempts.
references:
  - https://attack.mitre.org/techniques/T0885/
  - https://attack.mitre.org/techniques/T0869/
author: Security Arsenal
date: 2026/07/14
tags:
  - attack.ics
  - attack.t0885
  - attack.t0869
logsource:
  product: industrial_control_system
  category: network_connection
detection:
  selection:
    Protocol|contains:
      - 'modbus'
      - 'dnp3'
      - 'opcua'
    SourceUser|re: 'Admin|Operator|Engineer'
    BytesOut|gt: 10000
  condition: selection
falsepositives:
  - Legitimate engineering updates
  - Scheduled maintenance activities
level: high
---
title: Browser Extension Remote Access Behavior
id: c9d5f1a6-3g7b-6c4d-0e8f-1g3b4c5d6e7f
status: experimental
description: Detects browser extensions exhibiting remote access behaviors such as unauthorized WebSocket connections and unusual API calls.
references:
  - https://attack.mitre.org/techniques/T1219/
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/07/14
tags:
  - attack.command_and_control
  - attack.t1219
  - attack.t1071
logsource:
  product: browser
  category: extension
detection:
  selection:
    EventType: 'websocket'
    ExtensionPermissions|contains:
      - 'idle'
      - 'background'
      - 'webRequest'
    DestinationHostname|contains:
      - '.duckdns.org'
      - '.no-ip.org'
      - '.ddns.net'
  condition: selection
falsepositives:
  - Legitimate remote access tools
level: high
---
title: AI Agent Prompt Injection via Image
id: d0e6g2b7-4h8c-7d5e-1f9g-2h4c5d6e7f8g
status: experimental
description: Detects potential prompt injection attacks through image inputs to AI agents.
references:
  - https://attack.mitre.org/techniques/T1566/
  - https://attack.mitre.org/techniques/T1204/
author: Security Arsenal
date: 2026/07/14
tags:
  - attack.initial_access
  - attack.t1566
  - attack.t1204
logsource:
  product: ai_platform
  category: prompt_injection
detection:
  selection:
    InputType: 'image'
    ImageTextExtraction|contains:
      - 'ignore previous instructions'
      - 'override'
      - 'execute'
      - 'run'
      - 'system:'
  condition: selection
falsepositives:
  - Legitimate testing and development
level: medium

// Detect Android spyware data exfiltration patterns
DeviceNetworkEvents
| where ActionType in ("ConnectionAccepted", "ConnectionInitiated")
| where RemotePort in (443, 8443, 9999)
| where Timestamp >= ago(7d)
| where InitiatingProcessFolderPath contains "/data/app/" and (
    InitiatingProcessName contains "safety" or 
    InitiatingProcessName contains "security" or 
    InitiatingProcessName contains "emergency" or
    InitiatingProcessName contains "protect"
  )
| where SentBytes > 1000000
| project Timestamp, DeviceName, InitiatingProcessName, RemoteUrl, RemoteIP, SentBytes
| order by Timestamp desc

// Detect anomalous PLC protocol activity
CommonSecurityLog
| where DeviceVendor contains "Siemens" or DeviceVendor contains "Rockwell" or DeviceVendor contains "Schneider"
| where Protocol in ("Modbus", "DNP3", "OPC-UA")
| where Timestamp >= ago(7d)
| where SentBytes > 10000
| summarize count(), max(SentBytes) by Protocol, SourceUserName, DestinationIP
| where count_ > 100
| project Protocol, SourceUserName, DestinationIP, count_, max_SentBytes

// Detect browser extension remote access behaviors
DeviceNetworkEvents
| where ActionType in ("ConnectionInitiated", "DnsQuery")
| where InitiatingProcessName endswith ".exe"
| where InitiatingProcessFolderPath contains "Extensions"
| where RemoteUrl contains "duckdns.org" or RemoteUrl contains "no-ip.org" or RemoteUrl contains "ddns.net"
| project Timestamp, DeviceName, InitiatingProcessName, RemoteUrl, RemoteIP, LocalPort
| order by Timestamp desc

// Detect AI prompt injection via images
let suspiciousKeywords = dynamic(["ignore previous instructions", "override", "execute", "run", "system:", "ignore all", "new instructions"]);
AuditLogs
| where Timestamp >= ago(7d)
| where OperationName contains "AI" and (OperationName contains "Prompt" or OperationName contains "Generation")
| where RequestResources contains "image" or RequestResources contains "Image"
| extend isSuspicious = coalesce(array_index_any(RequestResources, (item: string) => item has_any(suspiciousKeywords)), false)
| where isSuspicious == true
| project Timestamp, OperationName, Caller, RequestResources, ObjectId
| order by Timestamp desc

-- Hunt for Android applications with suspicious permission combinations
SELECT 
    PackageName, 
    AppName, 
    VersionName,
    Permissions,
    InstallTime,
    LastUpdateTime,
    SourceDir,
    UID
FROM android_packages()
WHERE Permissions =~ 'android.permission.READ_SMS' 
   AND Permissions =~ 'android.permission.ACCESS_FINE_LOCATION'
   AND Permissions =~ 'android.permission.RECORD_AUDIO'
   AND (AppName =~ 'safety' OR AppName =~ 'security' OR AppName =~ 'emergency' OR AppName =~ 'protect')

-- Hunt for browser extensions with remote access capabilities
SELECT 
    Name,
    ID,
    Version,
    Enabled,
    Path,
    Permissions,
    InstallTime
FROM chrome_extensions()
WHERE Permissions =~ 'background' 
   AND Permissions =~ 'webRequest'
   AND Permissions =~ 'tabs'

-- Hunt for processes with network connections to suspicious domains
SELECT 
    Pid,
    Name,
    Username,
    CommandLine,
    Cwd,
    Exe,
    CreateTime
FROM pslist()
JOIN ON Pid = Pid
(
    SELECT 
        Pid,
        RemoteAddress,
        RemotePort,
        State
    FROM netstat()
    WHERE RemoteAddress =~ 'duckdns.org' 
       OR RemoteAddress =~ 'no-ip.org' 
       OR RemoteAddress =~ 'ddns.net'
)

-- Hunt for recent AI prompt processing logs
SELECT 
    Timestamp,
    Service,
    EventType,
    Prompt,
    InputType,
    Output,
    SourceIP,
    User
FROM file(files="/var/log/ai_service/*")
WHERE EventType =~ "prompt_processing"
  AND InputType =~ "image"
  AND (Prompt =~ "ignore" OR Prompt =~ "override" OR Prompt =~ "execute" OR Prompt =~ "run")

# Script to check for and remediate suspicious browser extensions
# Run this on endpoints with browser extensions installed

# Function to check Chrome extensions
function Check-ChromeExtensions {
    $chromeExtensionsPath = "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Extensions"
    if (Test-Path $chromeExtensionsPath) {
        $extensions = Get-ChildItem -Path $chromeExtensionsPath -Directory
        
        foreach ($ext in $extensions) {
            $manifestPath = Join-Path -Path $ext.FullName -ChildPath "*\manifest."
            if (Test-Path $manifestPath) {
                $manifest = Get-Content -Path $manifestPath | ConvertFrom-Json
                
                # Check for suspicious permissions
                $suspiciousPermissions = @("background", "webRequest", "idle")
                $hasSuspiciousPerms = $false
                
                if ($manifest.permissions) {
                    foreach ($perm in $manifest.permissions) {
                        if ($perm -in $suspiciousPermissions) {
                            $hasSuspiciousPerms = $true
                        }
                    }
                }
                
                # Report suspicious extensions
                if ($hasSuspiciousPerms) {
                    Write-Output "Suspicious extension found: $($manifest.name), ID: $($ext.Name), Permissions: $($manifest.permissions -join ', ')"
                    
                    # Option to remove extension
                    $remove = Read-Host "Do you want to remove this extension? (Y/N)"
                    if ($remove -eq "Y") {
                        Remove-Item -Path $ext.FullName -Recurse -Force
                        Write-Output "Extension removed: $($ext.Name)"
                    }
                }
            }
        }
    }
}

# Function to check for suspicious network connections
function Check-SuspiciousConnections {
    $suspiciousDomains = @("duckdns.org", "no-ip.org", "ddns.net")
    
    $connections = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue
    
    foreach ($conn in $connections) {
        try {
            $process = Get-Process -Id $conn.OwningProcess -ErrorAction SilentlyContinue
            $remoteAddress = [System.Net.Dns]::GetHostEntry($conn.RemoteAddress).HostName
            
            foreach ($domain in $suspiciousDomains) {
                if ($remoteAddress -like "*$domain*") {
                    Write-Output "Suspicious connection found: Process: $($process.ProcessName), PID: $($conn.OwningProcess), Remote: $remoteAddress"
                    
                    # Option to kill the process
                    $kill = Read-Host "Do you want to terminate this process? (Y/N)"
                    if ($kill -eq "Y") {
                        Stop-Process -Id $conn.OwningProcess -Force
                        Write-Output "Process terminated: PID $($conn.OwningProcess)"
                    }
                }
            }
        } catch {
            # Skip errors in resolving hostnames
            continue
        }
    }
}

# Main execution
Write-Output "Starting security check..."
Check-ChromeExtensions
Check-SuspiciousConnections
Write-Output "Security check completed."