Detection of Accounts

Technique Detected:  Accounts | T1636.005

ID: DET0635
Domains: Mobile
Analytics: AN1708, AN1709
Version: 1.0
Created: 21 October 2025
Last Modified: 21 October 2025

Analytics

AN1708

Monitor for API calls that are related to the AccountManager API on Android and Keychain services on iOS.
Application vetting services may look for MANAGE_ACCOUNTS in an Android application’s manifest. Most applications do not need access to accounts, so extra scrutiny may be applied to those that request it.

Log Sources
Data Component Name Channel
OS API Execution (DC0021) Process None
Permissions Requests (DC0114) Application Vetting None

AN1709

Monitor for API calls that are related to the AccountManager API on Android and Keychain services on iOS.
Application vetting services may look for MANAGE_ACCOUNTS in an Android application’s manifest. Most applications do not need access to accounts, so extra scrutiny may be applied to those that request it.

Log Sources
Data Component Name Channel
OS API Execution (DC0021) Process None
Permissions Requests (DC0114) Application Vetting None