ADB activation of Android EngineerModeActivity diagnostic mode
This rule detects the execution of the Unisoc/Sprd 'EngineerModeActivity' via ADB shell on Android devices. Invoking this activity enables diagnostic modes and debug logging, which are often used by threat actors to facilitate exploitation, reverse engineering, or the collection of sensitive crash dump information for modem-related research.
Microsoft Sentinel (KQL)
