Detection of Suppress Application Icon

ID: DET0714
Domains: Mobile
Analytics: AN1842
Version: 1.0
Created: 21 October 2025
Last Modified: 12 May 2026

Analytics

AN1842

For Android, detect Suppress Application Icon from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; OS API Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: App invokes PackageManager.setComponentEnabledSetting() to COMPONENT_ENABLED_STATE_DISABLED on its own LAUNCHER activity while continuing active background or foreground-service execution]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.

Log Sources
Data Component Name Channel
Application Permission (DC0114) android:DevicePolicyManager DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review
OS API Execution (DC0021) mobile:DynamicAnalysis Dynamic API/runtime trace: App invokes PackageManager.setComponentEnabledSetting() to COMPONENT_ENABLED_STATE_DISABLED on its own LAUNCHER activity while continuing active background or foreground-service execution
Mutable Elements
Field Description
KnownHeadlessApps Enterprise apps legitimately designed without launcher icons (MDM agent, background sync daemons). Derive from MDM catalog. Tightening: empty — all icon suppression during active execution is flagged.
ApprovedMediaApps Media editing, backup, and secure note apps with legitimate need to manage media file visibility. Derive from MDM catalog. Tightening: empty — any app hiding multimedia files post-collection is anomalous.