Detection of Boot or Logon Initialization Scripts

ID: DET0654
Domains: Mobile
Analytics: AN1739, AN1740
Version: 1.0
Created: 21 October 2025
Last Modified: 21 October 2025

Analytics

AN1739

On Android, Verified Boot can detect unauthorized modifications to the system partition.[1] Android's SafetyNet API provides remote attestation capabilities, which could potentially be used to identify and respond to compromise devices. Samsung Knox provides a similar remote attestation capability on supported Samsung devices.

Log Sources
Data Component Name Channel
Host Status (DC0018) Sensor Health None

AN1740

On Android, Verified Boot can detect unauthorized modifications to the system partition.[1] Android's SafetyNet API provides remote attestation capabilities, which could potentially be used to identify and respond to compromise devices. Samsung Knox provides a similar remote attestation capability on supported Samsung devices.

Log Sources
Data Component Name Channel
Host Status (DC0018) Sensor Health None

References