RatHat Accessibility Abuse to Enable Wireless ADB Debugging
Detects anomalous configuration of Android devices by identifying instances where an accessibility service is granted combined with the enabling of wireless ADB debugging or ADB pairing code extraction. This behavior is often associated with malicious applications seeking unauthorized control or remote access to the device.
Splunk (SPL)
