lab 2 · persistence hunt

Find a planted stalkerware-like app using evidence output alone, identify its persistence surface, and write your first mini-report.

90 minbeginnertriagereporting

objective

Move from "the tool printed flags" to "here is the app, here is the surface, here is the evidence, here is my confidence." This is the first lab where you produce a defensible finding.

materials

Lab 1 completed
A device pre-loaded by the instructor
apts.sh
The methodology reference open in a tab

procedure

Your instructor has planted one benign, stalkerware-like app on the device (it requests accessibility and device-admin rights). You are not told which app.
Run triage and collect the evidence set:
workstation
```
$ ./apts.sh
```
Work the six persistence surfaces in the evidence output. Cross-reference the enabled accessibility services and active device admins against the third-party package list.
Check installer provenance — is the suspect app sideloaded (installer null / shell)?
Check whether the app hides its launcher icon (present in the third-party list but absent from launcher activities).
Line up the install timeline against when the "symptoms" supposedly began.
Name the app and the exact surface(s) it uses, with the evidence file and line that prove it.

deliverable

One-page mini-report: the app package name, the persistence surface(s) it abused, the evidence file + line proving each, a stated confidence level, and a one-line remediation. Correlation across surfaces scores higher than a single lucky hit.

hint

Accessibility + device-admin + sideloaded install on the same package is a story, not a coincidence. One dangerous permission is normal; the combination is the signal.