← Back to SOC feed Coverage →

sms-fraud examples

yara LOW Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-05-09T11:00:00Z · Confidence: medium

Hunt Hypothesis

The hypothesis is that the detected behavior may indicate an adversary attempting to exploit SMS-based fraud by leveraging compromised accounts to send malicious or deceptive messages. A SOC team should proactively hunt for this behavior in Azure Sentinel to identify and mitigate potential fraud attempts before they escalate into larger security incidents.

YARA Rule

rule sms_fraud : MSACM32 android
{
		meta:
		author = "Fernando Denis https://twitter.com/fdrg21"
		reference = "https://koodous.com/"
		description = "sms-fraud examples"
		sample = "8b9cabd2dafbba57bc35a19b83bf6027d778f3b247e27262ced618e031f9ca3d c52112b45164b37feeb81e0b5c4fcbbed3cfce9a2782a2a5001fb37cfb41e993"

	strings:
		$string_a = "MSACM32.dll"
		$string_b = "android.provider.Telephony.SMS_RECEIVED"
		$string_c = "MAIN_TEXT_TAG"

	condition:
		all of ($string_*) and
		androguard.permission(/android.permission.SEND_SMS/)
		
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 3 string patterns in its detection logic.

References

False Positive Guidance

Original source: https://github.com/Yara-Rules/rules/blob/main/deprecated/Android/Android_malware_SMSsender.yar