Skip to content

DET0635 Detection of Accounts

Item Value
ID DET0635
Version 1.0
Created 21 October 2025
Last Modified 21 October 2025

Technique Detected: T1636.005 (Accounts)

Analytics

Android

AN1708

Monitor for API calls that are related to the AccountManager API on Android and Keychain services on iOS. Application vetting services may look for MANAGE_ACCOUNTS in an Android application’s manifest. Most applications do not need access to accounts, so extra scrutiny may be applied to those that request it.

Log Sources
Data Component Name Channel
OS API Execution (DC0021) Process None
Permissions Requests (DC0114) Application Vetting None
Mutable Elements
Field Description

iOS

AN1709

Monitor for API calls that are related to the AccountManager API on Android and Keychain services on iOS. Application vetting services may look for MANAGE_ACCOUNTS in an Android application’s manifest. Most applications do not need access to accounts, so extra scrutiny may be applied to those that request it.

Log Sources
Data Component Name Channel
OS API Execution (DC0021) Process None
Permissions Requests (DC0114) Application Vetting None
Mutable Elements
Field Description