Device Administrator Permissions - T1401 (82f04b1e-5371-4a6f-be06-411f0f43b483)
Adversaries may request device administrator permissions to perform malicious actions.
By abusing the device administration API, adversaries can perform several nefarious actions, such as resetting the device’s password for Device Lockout, factory resetting the device to Delete Device Data and any traces of the malware, disabling all of the device’s cameras, or make it more difficult to uninstall the app.(Citation: Android DeviceAdminInfo)
Device administrators must be approved by the user at runtime, with a system popup showing which of the actions have been requested by the app. In conjunction with other techniques, such as Input Injection, an app can programmatically grant itself administrator permissions without any user input.