A locked system tells you nothing when someone tries to get in. ThetaSecurity OS is instrumented as well as locked. Three detectors run continuously and report to Sentinel.
Cellular baseband and IMSI catchers
False base stations, often called Stingrays, usually force a phone off 5G or LTE onto legacy 2G or 3G. Those protocols offer weak or no encryption and let the interceptor identify the handset. The detector monitors radio state through TelephonyManager. It flags a sudden drop to a legacy network that has no ordinary explanation, such as a tower that advertises unusual parameters or a downgrade in an area with good coverage.
When it fires, Sentinel tells you what changed and what to do. Usually that means keeping calls on the encrypted SIP path, not using carrier SMS, or turning the cellular radio off.
Tor and VPN tunnel watchdog
The encrypted path only protects you while it is up. The watchdog tracks routing integrity through ConnectivityManager. It catches a Tor circuit drop, an unexpected disconnect, a route that bypasses the tunnel, or a DNS request that would leak outside it. Treat a watchdog alert as a reason to stop sensitive work until the tunnel is back.
AppOps permission auditing
Spyware and over-curious apps want the camera, the microphone, and the clipboard. The auditor intercepts background attempts to use them without explicit, real-time consent. The attempt is refused and Sentinel names the app. Repeated attempts are a strong sign that the app should be removed.
Detection is not prevention by itself. A downgrade alert means an interceptor may be nearby. The protection is the encrypted path, and the decision to keep sensitive traffic off the cellular radio.