For Android, detect Abuse Elevation Control Mechanism from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; OS API Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: App invokes privileged framework APIs (accessibility performAction, WindowManager.addView TYPE_APPLICATION_OVERLAY, PackageInstaller) immediately after acquiring elevation control mechanism without expected user settings navigation time]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
| Data Component | Name | Channel |
|---|---|---|
| Application Permission (DC0114) | android:DevicePolicyManager | DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review |
| OS API Execution (DC0021) | mobile:DynamicAnalysis | Dynamic API/runtime trace: App invokes privileged framework APIs (accessibility performAction, WindowManager.addView TYPE_APPLICATION_OVERLAY, PackageInstaller) immediately after acquiring elevation control mechanism without expected user settings navigation time |
| Field | Description |
|---|---|
| ElevationAllowList | Approved apps for each elevation mechanism: accessibility (approved screen readers), SYSTEM_ALERT_WINDOW (approved chat bubbles), INSTALL_PACKAGES (MDM agent, approved enterprise installer). Derive from MDM catalog. |
| ElevationActionWindow | Default 30s between permission acquisition and privileged action invocation. Legitimate use requires user to navigate settings before granting; immediate action post-acquisition is suspicious. |
| TargetAppList | Banking, auth, enterprise apps. Elevation control abuse against these is high-confidence malicious. |