Detection of Accounts

Technique Detected:  Accounts | T1636.005

ID: DET0635
Domains: Mobile
Analytics: AN1708, AN1709
Version: 1.0
Created: 21 October 2025
Last Modified: 21 October 2025

Analytics

AN1708

OLD: Monitor for API calls that are related to the AccountManager API on Android and Keychain services on iOS.
Application vetting services may look for MANAGE_ACCOUNTS in an Android application’s manifest. Most applications do not need access to accounts, so extra scrutiny may be applied to those that request it.

NEW: A defender observes an Android application invoking the AccountManager API.

Log Sources
Data Component Name Channel
OS API Execution (DC0021) android:logcat Invocation of AccountManager.getAccounts()

AN1709

Monitor for API calls that are related to the AccountManager API on Android and Keychain services on iOS.
Application vetting services may look for MANAGE_ACCOUNTS in an Android application’s manifest. Most applications do not need access to accounts, so extra scrutiny may be applied to those that request it.

Log Sources
Data Component Name Channel
OS API Execution (DC0021) Process None
Application Permission (DC0114) Application Vetting None