How Android Intrusion Logging and Delegated Scope give defenders OS-level evidence, and how Zimperium MTD used these logs to expose RatHat malware.