Detection of Access Notifications

Technique Detected:  Access Notifications | T1517

ID: DET0611
Domains: Mobile
Analytics: AN1665
Version: 1.0
Created: 21 October 2025
Last Modified: 21 October 2025

Analytics

AN1665

The user can also inspect and modify the list of applications that have notification access through the device settings (e.g. Apps & notification -> Special app access -> Notification access).
Application vetting services can look for applications requesting the BIND_NOTIFICATION_LISTENER_SERVICE permission in a service declaration.

Log Sources
Data Component Name Channel
System Settings (DC0118) User Interface None
Permissions Requests (DC0114) Application Vetting None