In the evolving landscape of mobile security threats, traditional detection methods often struggle to effectively identify and mitigate the risks posed by malicious APKs. This study introduces an integrated approach that combines the strengths of Snort and Wireshark with the dynamic response capabilities of Wazuh Manager. Initially, we leverage Snort’s robust network intrusion detection capabilities, enhanced through a custom plugin in Wireshark, to monitor and analyze APK file transfers. This setup allows for effective capture and initial screening of APKs based on known malicious signatures and anomalous network patterns. We then employed Wazuh Manager to facilitate an active response strategy. It automates the response to threats detected by Snort, for instance, isolating the affected systems, alerting administrators, and preventing the execution of suspicious APKs. This proactive approach not only aims to stop malware before it causes harm but also adaptively handles the evolving threat landscape by continuously updating detection rules and response strategies based on new intelligence. Our research indicates that an effective defense against malicious APKs involves monitoring, detecting, and actively responding to these threats. The integration of these tools provides a scalable and adaptable framework that can evolve with emerging threats, offering practical solutions for both organizational and individual security needs. This research investigates the potential of combining network and detection tools, which have been proven effective in computer settings, with active response systems. It establishes a foundation for future advancements in mobile security methodologies using a layered defense approach, making it highly relevant to the broader field of mobile internet security.