Branding and improper operation detection on a user equipment

A user equipment includes a radio transceiver, a processor coupled to the processor, and a storage device containing executable instructions. When executed by the processor, the instructions cause the processor to examine files in the storage device for a signature indicative of a branding element and, upon detection of the signature in a file, perform a branding action on the file with the detected signature. The instructions also cause the processor to determine whether an application loaded on the storage device is operating consistent with permissions set for the application and with a usage profile for the application and to generate an alert when the operation of the application is inconsistent with the usage profile despite being consistent with the permissions.