Device Admin Command Abuse for Anti-Removal and Destructive Fallback
Detects specific Android device admin command sequences that indicate attempts to establish persistent access by hardening the device against removal (e.g., enabling uninstall protection, setting device admin passwords, disabling biometrics) or destructive actions like performing a factory reset or self-uninstallation.
Sigma
