Detection of Remote Access Software

Technique Detected:  Remote Access Software | T1663

ID: DET0624
Domains: Mobile
Analytics: AN1689, AN1690
Version: 1.0
Created: 21 October 2025
Last Modified: 21 October 2025

Analytics

AN1689

Remote access software typically requires many privileged permissions, such as accessibility services or device administrator.

Log Sources
Data Component Name Channel
Permissions Request (DC0116) User Interface None

AN1690

Remote access software typically requires many privileged permissions, such as accessibility services or device administrator.

Log Sources
Data Component Name Channel
Permissions Request (DC0116) User Interface None