DET0630 Detection of Device Administrator Permissions
| Item |
Value |
| ID |
DET0630 |
| Version |
1.0 |
| Created |
21 October 2025 |
| Last Modified |
21 October 2025 |
Technique Detected: T1626.001 (Device Administrator Permissions)
Analytics
Android
AN1701
The user is prompted for approval when an application requests device administrator permissions.
Application vetting services can check for the string BIND_DEVICE_ADMIN in the application’s manifest. This indicates it can prompt the user for device administrator permissions.
The user can see which applications are registered as device administrators in the device settings.
Log Sources
Mutable Elements