System Settings represent user-visible or OS-level configuration settings that influence device behavior, application permissions, connectivity, or system features.
Monitoring system settings changes allows defenders to detect abnormal modifications that may indicate malicious activity or device compromise.
Collection Methods
| Name | Channel |
|---|---|
| android:DevicePolicyManager | DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported |
| android:MDMLog | device USB mode change (charging to file transfer / debugging / accessory) |
| android:MDMLog | Application or service remains active, foregrounds, or overlays during device locked state or immediately at unlock transition with weak recent user interaction context |
| android:MDMLog | No user-initiated airplane mode, radio disablement, or managed network setting change occurred during repeated connectivity degradation |
| iOS:MDM | DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries |
| iOS:MDMLog | Trusted computer / host relationship established or relevant device trust setting changed |
| iOS:MDMLog | No user-initiated airplane mode or radio-related setting change occurred while applications experience repeated network unavailability |
| MobileEDR:telemetry | Settings.Secure/Global write to install_unknown_apps=1 by process NOT IN MDMAgentPackageList + PackageInstaller call with unknown cert within TimeWindow where MDM agent is the only authorized settings writer |
| MobileEDR:telemetry | Microphone sensor activation or audio recording session initiated by application process |
| MobileEDR:telemetry | Application transitions to background or executes while screen locked during microphone session |
| MobileEDR:telemetry | Cellular service state transitions (in-service→no-service), SIM state change, carrier/operator identifier change, or baseband/telephony stack state change observed by agent telemetry |
| MobileEDR:telemetry | Application remains backgrounded while accessibility service continues to receive events or perform actions across other foreground apps |
| MobileEDR:telemetry | Camera sensor access began from app identity and remained active for sustained capture interval in app context not mapped to approved video recording workflow |
| MobileEDR:telemetry | Camera sensor access occurred while AppState=background, foreground service active without visible user action, or DeviceLockState=locked during capture interval |
| MobileEDR:telemetry | Foreground service continues accessing camera, microphone, location, or other while-in-use sensors after service promotion and outside recent user interaction |
| User Interface | None |