For Android, detect Unix Shell from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Command Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: Unix shell process (sh, bash, busybox sh, toybox) spawns as child of app process with command-line arguments indicating scripted operation — shell with arguments confirms script execution not interactive terminal]; Process Creation via Application Vetting / Managed Device Telemetry [Application invokes Runtime.exec(), ProcessBuilder.start(), or JNI-backed launcher with sh, bash, toybox, toolbox, or su as command argument NOT IN $ApprovedShellApps$ — explicit Unix shell invocation]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
| Data Component | Name | Channel |
|---|---|---|
| Command Execution (DC0064) | mobile:DynamicAnalysis | Dynamic API/runtime trace: Unix shell process (sh, bash, busybox sh, toybox) spawns as child of app process with command-line arguments indicating scripted operation — shell with arguments confirms script execution not interactive terminal |
| Process Creation (DC0032) | mobile:DynamicAnalysis | Application invokes Runtime.exec(), ProcessBuilder.start(), or JNI-backed launcher with sh, bash, toybox, toolbox, or su as command argument NOT IN $ApprovedShellApps$ — explicit Unix shell invocation |
| Field | Description |
|---|---|
| ApprovedShellApps | Terminal emulator apps (developer fleet only). Production managed devices: empty — no app should spawn Unix shells. Derive from IT device classification. |
| ShellActivityWindow | Default 30s between shell spawn and follow-on file/network activity. |
For iOS, detect Unix Shell from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Command Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: Shell or command-executing child process with arguments spawned under managed app context on supervised iOS device]; Process Creation via Application Vetting / Managed Device Telemetry [Managed iOS app invokes process-launch behavior resulting in sh, bash, or equivalent shell child process on supervised device — any shell spawn on stock iOS is a jailbreak indicator]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
| Data Component | Name | Channel |
|---|---|---|
| Command Execution (DC0064) | mobile:DynamicAnalysis | Dynamic API/runtime trace: Shell or command-executing child process with arguments spawned under managed app context on supervised iOS device |
| Process Creation (DC0032) | mobile:DynamicAnalysis | Managed iOS app invokes process-launch behavior resulting in sh, bash, or equivalent shell child process on supervised device — any shell spawn on stock iOS is a jailbreak indicator |
| Field | Description |
|---|---|
| ApprovedShellApps | Terminal emulator apps (developer fleet only). Production managed devices: empty — no app should spawn Unix shells. Derive from IT device classification. |
| ShellActivityWindow | Default 30s between shell spawn and follow-on file/network activity. |