For Android, detect Drive-By Compromise by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate File Creation via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: open() with O_CREAT for APK or binary file in /sdcard/ or /data/local/tmp/ by browser process within $DriveByWindow$ — payload drop confirms exploit code execution]; Network Traffic Content via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed]; Process Creation via Application Vetting / Managed Device Telemetry [execve()]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
| Data Component | Name | Channel |
|---|---|---|
| File Creation (DC0039) | mobile:ForensicArtifacts | Dynamic filesystem trace or acquired app-container/filesystem artifacts: open() with O_CREAT for APK or binary file in /sdcard/ or /data/local/tmp/ by browser process within $DriveByWindow$ — payload drop confirms exploit code execution |
| Network Traffic Content (DC0085) | webproxy:applog | DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed |
| Process Creation (DC0032) | mobile:DynamicAnalysis | execve() |
| Field | Description |
|---|---|
| URLReputationThreshold | Default score 50/100. Derive from threat intel feed vendor scoring. |
| DomainAgeDays | Default 30 days. Newly registered domain + browser exploit = high-confidence. |
| KnownBrowserChildren | Renderer, GPU process, browser service workers. Derive from browser process baseline. |
| DriveByWindow | Default 30s between URL navigation and process spawn. |
For iOS, detect Drive-By Compromise by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Network Connection Creation via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]; Network Traffic Content via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed]; Process Creation via Application Vetting / Managed Device Telemetry [com.apple.WebKit or com.apple.WebContent process fault at level=fault within $DriveByWindow$ of navigation to flagged URL — kernel fault in WebKit subsystem is the exploit-execution signal]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
| Data Component | Name | Channel |
|---|---|---|
| Network Connection Creation (DC0082) | iOS:NetworkExtension | NEFilterFlow / per-app VPN / secure-web-gateway flow metadata |
| Network Traffic Content (DC0085) | webproxy:applog | DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed |
| Process Creation (DC0032) | mobile:DynamicAnalysis | com.apple.WebKit or com.apple.WebContent process fault at level=fault within $DriveByWindow$ of navigation to flagged URL — kernel fault in WebKit subsystem is the exploit-execution signal |
| Field | Description |
|---|---|
| URLReputationThreshold | Default score 50/100. |
| DomainAgeDays | Default 30 days. |
| DriveByWindow | Default 30s. |
| SafariBrowsingBaseline | Known CDN/content destinations from 30-day Safari baseline. Derive by measurement. |
| PostExploitWindow | Default 60s between WebKit fault and post-exploit connection. |