RatHat getevent Hardware Touch Keylogging via ADB Shell UID 2000

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•1

Detects the execution of the Android 'getevent' utility with arguments indicative of monitoring raw input device events (e.g., /dev/input/, EV_ABS, ABS_MT_POSITION). This activity is often associated with monitoring user input, touch events, or keystrokes, which can be indicative of keylogging or user interaction monitoring.