Add improved heuristic detections to AppOps module

2026-08-12 06:00:20 +02:00 · 2025-01-30 13:02:26 +01:00
parent 0962383b46
commit 43901c96a0
4 changed files with 68 additions and 14 deletions
@@ -43,5 +43,21 @@ class TestDumpsysAppopsArtifact:
        ind.ioc_collections[0]["app_ids"].append("com.facebook.katana")
        da.indicators = ind
        assert len(da.detected) == 0
+
        da.check_indicators()
-        assert len(da.detected) == 1
+        detected_by_ioc = [
+            detected for detected in da.detected if detected.get("matched_indicator")
+        ]
+        detected_by_permission_heuristic = [
+            detected
+            for detected in da.detected
+            if all(
+                [
+                    perm["name"] == "REQUEST_INSTALL_PACKAGES"
+                    for perm in detected["permissions"]
+                ]
+            )
+        ]
+        assert len(da.detected) == 3
+        assert len(detected_by_ioc) == 1
+        assert len(detected_by_permission_heuristic) == 2