Detection of Device Lockout

Technique Detected:  Device Lockout | T1629.002

ID: DET0603
Domains: Mobile
Analytics: AN1652
Version: 1.0
Created: 21 October 2025
Last Modified: 21 October 2025

Analytics

AN1652

The user can view a list of device administrators in device settings and revoke permission where appropriate. Applications that request device administrator permissions should be scrutinized further for malicious behavior.

Log Sources
Data Component Name Channel
System Settings (DC0118) User Interface None