Quokka - Malicious Results Detected
Detects if there are any malicious results in the app events coming from organization devices.
Detection logic
Detection requirements
- Platform
- AndroidiOS
The rule states no platform. This is derived from the 40 ATT&CK techniques it maps to.
- Log source product
- qscoutappeventsccfdefinition
- Log source service
- qscoutappevents_cl
MITRE ATT&CK mappings
28 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.
Outside the enterprise matrix
- T1406T14063 detections cover this technique
- T1409T14092 detections cover this technique
- T1414T14143 detections cover this technique
- T1417T14172 detections cover this technique
- T1418T14184 detections cover this technique
- T1422T14221 detection covers this technique
- T1424T14242 detections cover this technique
- T1429T14291 detection covers this technique
- T1430T14301 detection covers this technique
- T1471T14711 detection covers this technique
- T1474T14742 detections cover this technique
- T1481T14811 detection covers this technique
- T1509T15091 detection covers this technique
- T1512T15121 detection covers this technique
- T1513T15131 detection covers this technique
- T1516T15161 detection covers this technique
- T1517T15171 detection covers this technique
- T1532T15321 detection covers this technique
- T1541T15411 detection covers this technique
- T1544T15441 detection covers this technique
- T1582T15823 detections cover this technique
- T1616T16161 detection covers this technique
- T1617T16171 detection covers this technique
- T1623T16231 detection covers this technique
- T1624T16241 detection covers this technique
- T1625T16251 detection covers this technique
- T1627T16271 detection covers this technique
- T1628T16281 detection covers this technique
- T1629T16297 detections cover this technique
- T1630T16302 detections cover this technique
- T1631T16311 detection covers this technique
- T1633T16331 detection covers this technique
- T1634T16341 detection covers this technique
- T1635T16352 detections cover this technique
- T1636T16361 detection covers this technique
- T1638T16381 detection covers this technique
- T1640T16401 detection covers this technique
- T1641T16412 detections cover this technique
- T1642T16421 detection covers this technique
- T1643T16431 detection covers this technique
No references are available for this detection.
From the source
- At source
- Open at source
- Upstream identifier
- 97ad71ed-e4c0-4f7a-b1a2-683108bece4f
- Tagged by the source as
- CollectionCommandAndControlCredentialAccessDefenseEvasionDiscoveryExecutionImpactInitialAccessPersistencePrivilegeEscalation
Licence
- Published under
- MIT LicenseRead the licence
- Attribution
- Required
- Obtained under
- MITRead the origin licence
Authorship
- Published
- Sep 1, 2026
- Version
- 1