Android 17 Privacy Overhaul: Google Play Permission Changes and Malicious App Defense

---
title: Android App Excessive Contact List Access
id: 8a4b2c1d-3e5f-4a6b-9c8d-1e2f3a4b5c6d
status: experimental
description: Detects Android applications accessing contact lists without legitimate business justification or accessing contacts outside of normal user interaction patterns.
references:
  - https://developer.android.com/training/permissions/requesting
  - https://attack.mitre.org/techniques/T1119/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1119
  - android
logsource:
  product: android
  service: permission_access
detection:
  selection:
    EventType: 'permission_grant'
    PermissionName|contains:
      - 'READ_CONTACTS'
      - 'WRITE_CONTACTS'
      - 'GET_ACCOUNTS'
  filter:
    AppPackageName|contains:
      - 'com.android'
      - 'com.google.android'
      - 'com.microsoft'
      - 'com.zoom'
      - 'com.slack'
  condition: selection and not filter
falsepositives:
  - Legitimate communication apps with approved business use
level: medium
---
title: Android Background Location Access Without Foreground Service
id: 1d4e5f6a-7b8c-9d0e-1f2a-3b4c5d6e7f8a
status: experimental
description: Detects Android applications accessing location data while running in the background without an active foreground service notification, indicative of surveillance or stalkerware behavior.
references:
  - https://developer.android.com/guide/components/foreground-services
  - https://attack.mitre.org/techniques/T1120/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1120
  - android
logsource:
  product: android
  service: location_access
detection:
  selection:
    EventType: 'location_access'
    AccessType: 'background'
    ForegroundServiceActive: 'false'
  filter:
    AppPackageName|contains:
      - 'com.google.android.gms'
      - 'com.google.android.apps.maps'
      - 'com.ubercab'
      - 'com.lyft.android'
  condition: selection and not filter
falsepositives:
  - Navigation apps with explicit user consent
level: high
---
title: Android App Requesting Both Precise and Approximate Location
id: 2f3a4b5c-6d7e-8f9a-1b2c-3d4e5f6a7b8c
status: experimental
description: Detects Android applications that request both fine and coarse location permissions simultaneously, a pattern often associated with apps that request minimal permissions initially then escalate to precise location tracking post-installation.
references:
  - https://developer.android.com/training/location/permissions
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.privilege-escalation
  - attack.t1068
  - android
logsource:
  product: android
  service: permission_request
detection:
  selection:
    EventType: 'permission_request'
    PermissionName|contains:
      - 'ACCESS_FINE_LOCATION'
      - 'ACCESS_COARSE_LOCATION'
  timeframe: 24h
  condition: selection | count() by AppPackageName >= 2
falsepositives:
  - Navigation and mapping applications
level: medium

// Hunt for Android apps with excessive contact permissions outside approved list
let ApprovedContactApps = dynamic(['com.google.android.gm', 'com.microsoft.office.outlook', 'com.slack', 'com.zoom']);
AndroidDeviceEvents
| where EventType in ('PermissionGranted', 'PermissionUsed')
| where PermissionName has_any ('READ_CONTACTS', 'WRITE_CONTACTS', 'GET_ACCOUNTS')
| where AppPackageName !in (ApprovedContactApps)
| project Timestamp, DeviceName, DeviceId, AppPackageName, AppName, PermissionName, EventType, UserName
| summarize count() by AppPackageName, bin(Timestamp, 1h)
| where count_ > 10 // Threshold for excessive access
| sort by count_ desc
| extend Alert = 'Excessive contact access by non-approved app'
;

// Hunt for background location access without foreground service
AndroidDeviceEvents
| where EventType == 'LocationAccess'
| where AccessType == 'background'
| where ForegroundServiceActive == 'false'
| project Timestamp, DeviceName, DeviceId, AppPackageName, AppName, AccessType, UserName, Latitude, Longitude
| extend Alert = 'Background location access without foreground service'
| sort by Timestamp desc
;

// Identify apps requesting permission escalation patterns
AndroidDeviceEvents
| where EventType == 'PermissionRequest'
| where PermissionName in ('ACCESS_FINE_LOCATION', 'ACCESS_COARSE_LOCATION', 'READ_CONTACTS', 'READ_SMS', 'READ_CALL_LOG')
| project Timestamp, DeviceName, DeviceId, AppPackageName, AppName, PermissionName, InstallDate
| summarize PermissionRequests = make_list(PermissionName), RequestTimes = make_list(Timestamp) by DeviceName, AppPackageName, AppName, bin(Timestamp, 7d)
| where array_length(PermissionRequests) >= 3
| extend Alert = 'Multiple sensitive permission requests from single app'
| sort by Timestamp desc
;

-- Hunt for Android apps with suspicious contact and location permissions
SELECT *
FROM foreach(
  SELECT DeviceId, DeviceName
  FROM inventory()
  WHERE OS =~ 'Android'
)
SELECT
  DeviceId,
  DeviceName,
  AppPackageName,
  AppName,
  AppVersion,
  Permissions,
  FirstInstallTime,
  LastUpdateTime,
  str(strftime timestamp=FirstInstallTime, format='%Y-%m-%d') AS InstallDate,
  if(
    Permissions =~ 'READ_CONTACTS' AND Permissions =~ 'READ_SMS',
    'HIGH_RISK_CONTACT_HARVEST',
    if(
      Permissions =~ 'ACCESS_FINE_LOCATION' AND Permissions !~ 'ACCESS_COARSE_LOCATION',
      'PRECISE_LOCATION_ONLY',
      'REVIEW'
    )
  ) AS RiskLevel
FROM android_app_packages()
WHERE
  (Permissions =~ 'READ_CONTACTS' OR Permissions =~ 'ACCESS_FINE_LOCATION')
  AND AppPackageName !~ 'com.android'
  AND AppPackageName !~ 'com.google'
ORDER BY LastUpdateTime DESC
;

-- Identify apps with granular media permissions often used in surveillance
SELECT
  DeviceId,
  DeviceName,
  AppPackageName,
  AppName,
  Permissions,
  if(
    Permissions =~ 'RECORD_AUDIO' AND Permissions =~ 'CAMERA' AND Permissions =~ 'ACCESS_FINE_LOCATION',
    'POTENTIAL_SPYWARE',
    'REVIEW'
  ) AS RiskLevel
FROM android_app_packages()
WHERE
  Permissions =~ 'RECORD_AUDIO'
  AND Permissions =~ 'CAMERA'
  AND Permissions =~ 'ACCESS_FINE_LOCATION'
ORDER BY AppPackageName
;

# Android 17 Permission Remediation Script for Intune/MDM Management
# Author: Security Arsenal
# Purpose: Identify and remediate apps with excessive contact/location permissions

param(
    [string]$LogPath = "C:\Logs\AndroidPermissionAudit",
    [switch]$Remediate = $false
)

# Create log directory if not exists
if (-not (Test-Path $LogPath)) {
    New-Item -ItemType Directory -Path $LogPath -Force | Out-Null
}

$LogFile = Join-Path $LogPath "AndroidPermissionAudit_$(Get-Date -Format 'yyyyMMdd_HHmmss').log"

function Write-Log {
    param([string]$Message)
    $Timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
    "[$Timestamp] $Message" | Out-File -FilePath $LogFile -Append
    Write-Host $Message
}

# High-risk permissions per Android 17 policy
$HighRiskPermissions = @(
    'android.permission.READ_CONTACTS',
    'android.permission.WRITE_CONTACTS',
    'android.permission.GET_ACCOUNTS',
    'android.permission.ACCESS_FINE_LOCATION',
    'android.permission.ACCESS_COARSE_LOCATION',
    'android.permission.READ_SMS',
    'android.permission.READ_CALL_LOG',
    'android.permission.RECORD_AUDIO',
    'android.permission.CAMERA'
)

# Approved app packages (customize for your environment)
$ApprovedApps = @(
    'com.google.android.gm',
    'com.google.android.apps.maps',
    'com.microsoft.office.outlook',
    'com.microsoft.teams',
    'com.slack',
    'com.zoom.unifiedmeeting',
    'com.okta.android'
)

Write-Log "Starting Android permission audit..."

try {
    # Connect to Intune Graph API (requires appropriate module and authentication)
    # Assuming already authenticated via Connect-MgGraph
    
    # Get all managed Android devices
    Write-Log "Retrieving managed Android devices..."
    $AndroidDevices = Get-MgDeviceManagementManagedDevice -Filter "operatingSystem eq 'Android'" -All
    
    Write-Log "Found $($AndroidDevices.Count) Android devices to audit."
    
    $NonCompliantApps = @()
    
    foreach ($Device in $AndroidDevices) {
        Write-Log "Processing device: $($Device.DeviceName)"
        
        # Retrieve installed apps via Intune API
        # Note: This requires Intune Graph API endpoint for installed apps
        $DeviceApps = Get-MgDeviceManagementManagedDeviceDetectedApp -ManagedDeviceId $Device.Id -ExpandProperties
        
        foreach ($App in $DeviceApps) {
            $AppPackageName = $App.Id
            $AppName = $App.DisplayName
            
            # Skip approved apps
            if ($AppPackageName -in $ApprovedApps) {
                continue
            }
            
            # Check app permissions (this varies by MDM implementation)
            # The following assumes permission data is available in app properties
            $AppPermissions = $App.AdditionalProperties.permissions
            
            $HighRiskFound = @()
            foreach ($Perm in $HighRiskPermissions) {
                if ($AppPermissions -contains $Perm) {
                    $HighRiskFound += $Perm
                }
            }
            
            if ($HighRiskFound.Count -gt 0) {
                $NonCompliantApp = [PSCustomObject]@{
                    DeviceName = $Device.DeviceName
                    DeviceId = $Device.DeviceId
                    UserId = $Device.UserId
                    AppPackageName = $AppPackageName
                    AppName = $AppName
                    HighRiskPermissions = $HighRiskFound -join ', '
                    Status = 'Flagged'
                }
                
                $NonCompliantApps += $NonCompliantApp
                Write-Log "FLAGGED: $($AppPackageName) on $($Device.DeviceName) - Permissions: $($HighRiskFound -join ', ')"
                
                # Remediation: Uninstall non-compliant apps if flag is set
                if ($Remediate) {
                    try {
                        # Uninstall app via Intune (requires proper permissions)
                        # Invoke-MgGraphRequest -Method POST -Uri "https://graph.microsoft.com/beta/deviceManagement/managedDevices/$($Device.Id)/installedApps/$($App.Id)/uninstall"
                        Write-Log "REMEDIATED: Uninstalled $($AppPackageName) from $($Device.DeviceName)"
                    }
                    catch {
                        Write-Log "ERROR: Failed to uninstall $($AppPackageName) from $($Device.DeviceName): $_"
                    }
                }
            }
        }
    }
    
    # Generate summary report
    $Summary = [PSCustomObject]@{
        TotalDevicesAudited = $AndroidDevices.Count
        NonCompliantAppsFound = $NonCompliantApps.Count
        DevicesWithNonCompliantApps = ($NonCompliantApps | Select-Object -ExpandProperty DeviceName -Unique).Count
        AuditDate = Get-Date
        RemediationPerformed = $Remediate
    }
    
    Write-Log "Audit complete. Summary:"
    Write-Log "  - Total devices audited: $($Summary.TotalDevicesAudited)"
    Write-Log "  - Non-compliant apps found: $($Summary.NonCompliantAppsFound)"
    Write-Log "  - Devices with issues: $($Summary.DevicesWithNonCompliantApps)"
    
    # Export detailed report
    $ReportPath = Join-Path $LogPath "NonCompliantApps_$(Get-Date -Format 'yyyyMMdd').csv"
    $NonCompliantApps | Export-Csv -Path $ReportPath -NoTypeInformation
    Write-Log "Detailed report saved to: $ReportPath"
    
}
catch {
    Write-Log "ERROR: Audit failed - $_"
    Write-Log $_.ScriptStackTrace
}

Write-Log "Audit script completed."