RatHat Accessibility-Driven ADB Wireless Debugging Self-Pairing

Arnold Chan@slaz

•updated Sep 18, 2026•0•0•3

This rule monitors Android device process events for the execution of 'adb' commands aimed at modifying sensitive system configurations. It specifically tracks attempts to enable accessibility services, toggle wireless debugging, or establish unauthorized ADB pairings. The rule identifies potential malicious intent by aggregating multiple suspicious configuration changes on the same device within a short time window.