Overview
Android's new Intrusion Logging feature, introduced as part of the Advanced Protection Mode, offers a powerful yet privacy-conscious way to capture forensic evidence on devices suspected of being compromised by sophisticated spyware. Unlike traditional security logs, this opt-in tool is designed to be persistent and privacy-preserving, storing critical event data locally so that security teams or advanced users can investigate after the fact—without uploading logs to the cloud. This tutorial walks you through enabling, using, and interpreting Intrusion Logging on compatible Android devices.
Prerequisites
Device and OS Requirements
Intrusion Logging is available on devices running Android 14 or later that support the Advanced Protection Program. Most Pixel phones (Pixel 6 and newer) and select enterprise-managed devices are eligible. Check your device's security settings for Advanced Protection.
Google Account and Advanced Protection Enrollment
You must have a Google Account enrolled in the Advanced Protection Program. This is the same program that enforces strong two-factor authentication and restricts third-party app access. Enroll at myaccount.google.com/advanced-protection.
Knowledge of Basic Forensics
While no deep expertise is required, familiarity with reading log files, using ADB (Android Debug Bridge), and understanding common spyware indicators will help you get the most out of this feature.
Step-by-Step Instructions
1. Enable Advanced Protection Mode on Your Device
Open Settings > Security & privacy > Advanced > Advanced Protection. Toggle the switch to turn it on. You may need to sign in with your enrolled Google Account and verify your identity. Once active, you'll notice stricter controls on sideloaded apps and permissions.
2. Activate Intrusion Logging
After enabling Advanced Protection Mode, navigate to Settings > Security & privacy > Intrusion Logging (a new option may appear after reboot). Tap Turn on. A warning explains that logs are stored locally and can be exported for forensic analysis. Accept the terms.
Note: Intrusion Logging works silently in the background, recording system-level events relevant to spyware, such as process launches, network connections, and system call patterns.
3. Access and Export Forensic Logs
To view logs directly on the device, go back to the Intrusion Logging settings page. You'll see a View Log button that shows recent entries in a timestamped, read-only format. For deeper analysis, export the log:
- Tap Export Log and choose a save location (e.g., Downloads). The export creates an encrypted, but decodable, JSON file.
- Alternatively, use ADB for a raw dump:
adb shell dumpsys intrusion_logging
This command outputs structured data including event IDs, severity levels, and process names.
4. Interpret Key Log Entries
Intrusion Logs capture several categories:
- Suspicious process activity – Launching apps from unknown sources (e.g.,
com.spyware.app) - Privilege escalation attempts – Root permissions requested unexpectedly
- Unusual network calls – Connections to known C2 (command & control) servers
- Anomalous system call sequences – Indicators of obfuscation or evasion
Each entry includes a confidence score (low, medium, high) to help prioritize investigation. For example:
"event_id": 1452,
"timestamp": "2025-04-08T14:23:19Z",
"process": "/data/app/com.example.suspicious",
"action": "bind_socket",
"destination_ip": "185.xxx.xxx.xxx",
"confidence": "high"Cross-reference IP addresses with known threat intelligence feeds or use tools like VirusTotal.
Common Mistakes
- Enabling Intrusion Logging without Advanced Protection – The feature doesn't appear until Advanced Protection Mode is active. First ensure you're enrolled in the program.
- Ignoring privacy implications – Logs contain sensitive data (e.g., installed apps). Handle exported files securely; delete them after analysis.
- Expecting real-time alerts – Intrusion Logging is a forensic tool, not a live anti-malware agent. It records for later review, not instant notification.
- Overlooking the confidence score – A low-confidence entry may be a false positive. Always investigate context before concluding compromise.
Summary
Android's Intrusion Logging provides a privacy-respecting, opt-in forensic capability for detecting advanced spyware. Enable it via Advanced Protection Mode, export encrypted logs, and analyze key events to identify compromise. Use responsibly and combine with regular security audits.