RatHat abuse of pm disable-user/uninstall shell commands

Ibrahim Saud@tektrix

•updated Sep 18, 2026•1•0•6

Detects the use of the Android Package Manager (pm) utility via ADB to either disable or uninstall packages for the system user (user 0). This activity is often used by adversaries to remove security applications, anti-malware, or logging utilities from an Android device.