t1626-001-device-administrator-permissions

name	T1626.001_device-administrator-permissions
description	Adversaries may abuse Android’s device administration API to obtain a higher degree of control over the device.
category	authorization
version	18.1
author	cyberstrike-official
tags	["mitre-attack","mobile","t1626.001","privilege-escalation","android","sub-technique"]
technique_id	T1626.001
tactic	privilege-escalation
all_tactics	["privilege-escalation"]
platforms	["Android"]
mitre_url	https://attack.mitre.org/techniques/T1626/001
tech_stack	["android"]
cwe_ids	["CWE-269"]
chains_with	["T1626"]
prerequisites	["T1626"]
severity_boost	{"T1626":"Chain with T1626 for deeper attack path"}

T1626.001 Device Administrator Permissions

Sub-technique of: T1626

High-Level Description

Adversaries may abuse Android’s device administration API to obtain a higher degree of control over the device. By abusing the API, adversaries can perform several nefarious actions, such as resetting the device’s password for Endpoint Denial of Service, factory resetting the device for File Deletion and to delete any traces of the malware, disabling all the device’s cameras, or to make it more difficult to uninstall the app.

Device administrators must be approved by the user at runtime, with a system popup showing which actions have been requested by the app. In conjunction with other techniques, such as Input Injection, an app can programmatically grant itself administrator permissions without any user input.

Kill Chain Phase

• Privilege Escalation (TA0029)

Platforms: Android

What to Check

• Identify if Device Administrator Permissions technique is applicable to target mobile environment
• Check Android devices for indicators of Device Administrator Permissions
• Verify mitigations are bypassed or absent (2 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Identify Attack Surface

Determine if the target mobile environment is susceptible to Device Administrator Permissions by examining the target platforms (Android).

Assess Existing Defenses

Review whether mitigations for T1626.001 are in place. If defenses are absent or misconfigured, this technique may be exploitable.

Remediation Guide

M1006 Use Recent OS Version

Changes were introduced in Android 7 to make abuse of device administrator permissions more difficult.

M1011 User Guidance

Users should scrutinize every device administration permission request. If the request is not expected or the user does not recognize the application, the application should be uninstalled immediately.

Detection

Detection of Device Administrator Permissions

Risk Assessment

Finding	Severity	Impact
Device Administrator Permissions technique applicable	High