Defending Against Trojanized Mobile Apps: Lessons from the RedAlert Spyware Campaign

---
title: Potential Mobile APK Download via Command Line
id: 550d9a23-0f72-4e3a-a8c5-1d2f3b4c5d6e
status: experimental
description: Detects command-line tools (PowerShell, Curl, Wget) attempting to download Android APK files, which may indicate a drive-by download or smishing link access on a corporate workstation.
references:
  - https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2023/11/20
tags:
  - attack.command_and_control
  - attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\powershell.exe'
      - '\curl.exe'
      - '\wget.exe'
    CommandLine|contains:
      - '.apk'
      - 'android'
      - 'application/vnd.android.package-archive'
condition: selection
falsepositives:
  - Legitimate developers downloading test builds
level: medium
---
title: Android Debug Bridge (ADB) Execution
id: a7c8d9e0-f1a2-3456-bcde-f01234567890
status: experimental
description: Detects the execution of ADB (Android Debug Bridge), which is often used to side-load applications or debug mobile devices. Unauthorized use can indicate attempts to bypass mobile security controls.
references:
  - https://attack.mitre.org/techniques/T1112/
author: Security Arsenal
date: 2023/11/20
tags:
  - attack.execution
  - attack.t1059.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\adb.exe'
condition: selection
falsepositives:
  - Authorized mobile development or IT administration
level: low
---
title: Suspicious Network Connection to Non-Standard High Port
id: b8e9f1a2-0b3c-4d5e-6f7a-8b9c0d1e2f3a
status: experimental
description: Detects processes establishing network connections to non-standard high ports, often used by malware C2 (Command and Control) servers to bypass firewall filtering.
references:
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2023/11/20
tags:
  - attack.command_and_control
  - attack.t1071
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort|between: 9000-9999
    Initiated: 'true'
condition: selection
falsepositives:
  - Legitimate business applications using custom high ports
level: medium

// Hunt for ADB execution on endpoints
DeviceProcessEvents 
| where Timestamp > ago(7d)
| where FileName =~ "adb.exe"
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, ProcessCommandLine
| order by Timestamp desc


// Network connections to suspicious domains or ports associated with mobile C2
// Replace 'high_port_range' with specific C2 ports if known from IOCs
DeviceNetworkEvents 
| where Timestamp > ago(24h)
| where RemotePort > 1024 and RemotePort < 65535
| where ActionType == "ConnectionSuccess"
| summarize count() by DeviceName, RemoteUrl, RemotePort
| where count_ > 50 // Potential beaconing

-- Hunt for APK files in user download directories
SELECT FullPath, Size, Mtime, Atime
FROM glob(globs="C:/Users/*/Downloads/*.apk")
WHERE Mtime > now() - 7d


-- Hunt for ADB execution evidence in process lists or recent file access
SELECT Pid, Name, Exe, CommandLine, StartTime
FROM pslist()
WHERE Exe =~ "adb"
   OR CommandLine =~ "adb"

# Audit for ADB and recent APKs
Write-Host "Checking for Android Debug Bridge (ADB)..."
$adbPath = Get-ChildItem -Path "C:\" -Filter "adb.exe" -Recurse -ErrorAction SilentlyContinue

if ($adbPath) {
    Write-Host "[WARNING] ADB found at:" $adbPath.FullName -ForegroundColor Red
} else {
    Write-Host "[INFO] No ADB instances found on local drives." -ForegroundColor Green
}

Write-Host "\nChecking for recently downloaded APK files..."
$apkFiles = Get-ChildItem -Path "C:\Users\*\Downloads" -Filter "*.apk" -Recurse -ErrorAction SilentlyContinue | Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) }

if ($apkFiles) {
    Write-Host "[WARNING] Recent APK downloads found:" -ForegroundColor Red
    $apkFiles | Select-Object FullName, LastWriteTime
} else {
    Write-Host "[INFO] No recent APK files found in Downloads." -ForegroundColor Green
}