API calls utilized by an application that could indicate malicious activity
| Name | Channel |
|---|---|
| android:logcat | SELinux AVC related to execute_no_trans/execmem after decode/unpack activity by the same app UID |
| Application Vetting | None |
| iOS:unifiedlog | Repeated sandbox or policy violations by a single process or app bundle (for example, deny rules) followed by successful access to resources or APIs that normally require higher privileges |
| iOS:unifiedlog | mmap with PROT_EXEC and PROT_WRITE by sandboxed app |
| mobile:DynamicAnalysis | Dynamic API/runtime trace: APK or IPA contains SystemProperties.get() calls, Runtime.exec getprop invocations, or code patterns checking for emulator artifacts (ro.product.model=sdk, IMEI=000000, screen size, sensor absence) — static detection of environment-check co |
| mobile:DynamicAnalysis | Dynamic API/runtime trace: IPA contains UIDevice.currentDevice.model checks for Simulator strings, CMMotionManager.isDeviceMotionAvailable comparisons, or other Simulator-detection patterns — static detection of iOS environment-check code |
| mobile:DynamicAnalysis | Dynamic API/runtime trace: ClipboardManager.addOnPrimaryClipChangedListener() |
| mobile:DynamicAnalysis | Dynamic API/runtime trace: UIPasteboard.general.string property accessed by app |
| mobile:DynamicAnalysis | Dynamic API/runtime trace: AccessibilityEvent.TYPE_VIEW_TEXT_CHANGED received by listener_app NOT IN $AccessibilityAllowList$ |
| mobile:DynamicAnalysis | Dynamic API/runtime trace: AccessibilityEvent.TYPE_VIEW_TEXT_CHANGED received by listener NOT IN $AccessibilityAllowList$ at rate > $KeystrokeEventThreshold$ per minute with source_apps spanning > $AppMonitorCountThreshold$ distinct apps |
| mobile:DynamicAnalysis | Dynamic API/runtime trace: PackageManager.getInstalledPackages() or getInstalledApplications() called by app NOT IN $AppEnumAllowList$ |
| mobile:DynamicAnalysis | Dynamic API/runtime trace: UIApplication.canOpenURL() called > $URLProbeThreshold$ times with schemes NOT declared in app's LSApplicationQueriesSchemes within $ProbeWindow$ |
| mobile:DynamicAnalysis | Dynamic API/runtime trace: PackageManager.getPackageInfo() called for package names IN $SecurityToolPackageList$ by app NOT IN $AppEnumAllowList$ |
| mobile:DynamicAnalysis | Dynamic API/runtime trace: UIApplication.canOpenURL() called with schemes IN $MDMToolSchemeList$ by app NOT IN $AppEnumAllowList$ |
| mobile:DynamicAnalysis | Dynamic API/runtime trace: WifiInfo.getBSSID() |
| mobile:DynamicAnalysis | Dynamic API/runtime trace: NetworkInterface.getNetworkInterfaces() |
| mobile:DynamicAnalysis | Dynamic API/runtime trace: ConnectivityManager.getActiveNetworkInfo() or InetAddress.isReachable() called by app NOT IN $ConnectivityAllowList$ at app launch or on schedule without user action |
| mobile:DynamicAnalysis | Dynamic API/runtime trace: NWPathMonitor.start() or SCNetworkReachabilityGetFlags() called by app NOT IN $ConnectivityAllowList$ at launch or on background schedule |
| mobile:DynamicAnalysis | Dynamic API/runtime trace: WifiManager.getScanResults() |
| mobile:DynamicAnalysis | Dynamic API/runtime trace: CNCopyCurrentNetworkInfo() or NEHotspotHelper.register() called by app NOT IN $WiFiAllowList$ |
| mobile:DynamicAnalysis | Dynamic API/runtime trace: android.os.Build field reads > $SysInfoFieldThreshold$ distinct fields within $SysInfoWindow$ by app NOT IN $SysInfoAllowList$ at launch or in background |
| mobile:DynamicAnalysis | Dynamic API/runtime trace: UIDevice.current.model |
| mobile:DynamicAnalysis | Dynamic API/runtime trace: AudioRecord.startRecording() or MediaRecorder.start() called by app NOT IN $AudioAllowList$ |
| mobile:DynamicAnalysis | Dynamic API/runtime trace: LocationManager.requestLocationUpdates() called with minTime < $LocationUpdateFreqThreshold$ by app NOT IN $LocationAllowList$ |
| mobile:DynamicAnalysis | Dynamic API/runtime trace: FirebaseMessaging.getToken() called for project_id NOT IN $FCMAllowList$ — rogue FCM project registration is the adversary enabling C2 over Google infrastructure |
| mobile:DynamicAnalysis | Dynamic API/runtime trace: UNUserNotificationCenter or legacy UIApplication.registerForRemoteNotifications with Apple Team ID NOT IN $APNSAllowList$ — rogue APNS sender registration |
| mobile:DynamicAnalysis | Dynamic API/runtime trace: AccessibilityService receiving events from dc(source_app) > $AccessibilityTargetThreshold$ distinct apps INCLUDING apps IN $TargetAppList$ — broad monitoring across apps distinguishes malware from single-purpose assistive tech |
| mobile:DynamicAnalysis | Dynamic API/runtime trace: getNetworkInterfaces() OR NetworkInterface.getHardwareAddress() called within $ProcReadWindow$ of /proc reads by same app — network MAC OUI check completes hardware fingerprint |
| mobile:DynamicAnalysis | Dynamic API/runtime trace: UIDevice.currentDevice.model |
| mobile:DynamicAnalysis | Dynamic API/runtime trace: PackageManager.queryIntentActivities() returns handler_count > 1 for custom URI scheme |
| mobile:DynamicAnalysis | Dynamic API/runtime trace: PackageManager reports two or more apps with identical URI scheme intent-filter |
| mobile:DynamicAnalysis | Dynamic API/runtime trace: ContentResolver.query() to sensitive provider URI (contacts, calendar, call_log, sms) with query_count > $ContentQueryThreshold$ by app NOT IN $ApprovedDataApps$ |
| mobile:DynamicAnalysis | Dynamic API/runtime trace: CNContactStore.enumerateContacts or EKEventStore.fetchEvents or CLLocationManager.startUpdatingLocation called with broad scope by app NOT IN $ApprovedDataApps$ |
| mobile:DynamicAnalysis | Dynamic API/runtime trace: ContentResolver.query(CalendarContract) with query_count > $CalendarQueryThreshold$ by app NOT IN $ApprovedCalendarApps$ |
| mobile:DynamicAnalysis | Dynamic API/runtime trace: EKEventStore.fetchEvents() or enumerateEvents() with date_range > $CalendarDateRangeThreshold$ days by app NOT IN $ApprovedCalendarApps$ |
| mobile:DynamicAnalysis | Dynamic API/runtime trace: ContentResolver.query(CallLog.Calls) with query_count > $CallLogQueryThreshold$ by app NOT IN $ApprovedDialerApps$ |
| mobile:DynamicAnalysis | Dynamic API/runtime trace: ContentResolver.query(ContactsContract) with projection=all_fields |
| mobile:DynamicAnalysis | Dynamic API/runtime trace: CNContactStore.enumerateContacts with CNContactFetchRequest.keysToFetch containing all contact keys by app NOT IN $ApprovedContactsApps$ |
| mobile:DynamicAnalysis | Dynamic API/runtime trace: ContentResolver.query(Telephony.Sms) including both inbox |
| mobile:DynamicAnalysis | Dynamic API/runtime trace: AccountManager.getAccounts() OR getAccountsByType() called > $AccountEnumThreshold$ times within $AccountEnumWindow$ by app NOT IN $ApprovedAuthenticatorApps$ |
| mobile:DynamicAnalysis | Dynamic API/runtime trace: SecItemCopyMatching() called with kSecMatchLimitAll |
| mobile:DynamicAnalysis | Dynamic API/runtime trace: InetAddress.getByName() or DnsResolver called > $DGACandidateThreshold$ times with algorithmically-distinct hostnames in $DGAWindow$ — rapid programmatic resolution attempts |
| mobile:DynamicAnalysis | Dynamic API/runtime trace: DevicePolicyManager.resetPassword() or lockNow() or wipeData() called by caller NOT IN $MDMAgentPackageList$ |
| mobile:DynamicAnalysis | Dynamic API/runtime trace: ContentResolver.update() called by writer_app NOT IN $LegitimateIPCPartners$ for target_app's content provider URI |
| mobile:DynamicAnalysis | Dynamic API/runtime trace: ClipboardManager.addOnPrimaryClipChangedListener() registered |
| mobile:DynamicAnalysis | Dynamic API/runtime trace: DevicePolicyManager.lockNow() or resetPassword() called by caller NOT IN $MDMAgentPackageList$ |
| mobile:DynamicAnalysis | Dynamic API/runtime trace: SmsManager.sendTextMessage() called by app NOT IN $ApprovedMessagingApps$ |
| mobile:DynamicAnalysis | Dynamic API/runtime trace: NotificationListenerService.onNotificationPosted() receiving notifications from source_app IN $HighValueNotifApps$ by listener NOT IN $NotificationAllowList$ |
| mobile:DynamicAnalysis | Dynamic API/runtime trace: camera activated within app IN $MessagingAppList$ — QR scan requires camera access; activation in messaging app context is the trigger signal |