For Android, detect Evade Analysis Environment primarily during application vetting or controlled analysis rather than assuming a live device SOC feed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: APK or IPA contains SystemProperties.get() calls, Runtime.exec getprop invocations, or code patterns checking for emulator artifacts (ro.product.model=sdk, IMEI=000000, screen size, sensor absence) — static detection of environment-check co]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
| Data Component | Name | Channel |
|---|---|---|
| API Calls (DC0112) | mobile:DynamicAnalysis | Dynamic API/runtime trace: APK or IPA contains SystemProperties.get() calls, Runtime.exec getprop invocations, or code patterns checking for emulator artifacts (ro.product.model=sdk, IMEI=000000, screen size, sensor absence) — static detection of environment-check co |
| Field | Description |
|---|---|
| EnvCheckThreshold | Default 5 calls per category within window. Tightening: 3. |
| EnvCheckWindow | Default 10s at cold launch. |
| SystemEnumAllowList | MDM agent, diagnostic apps. Minimal. |
| AppCDNList | Per-app CDN. Derive by measurement. |
| FollowOnWindow | Default 120s. |
For iOS, detect Evade Analysis Environment primarily during application vetting or controlled analysis rather than assuming a live device SOC feed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: IPA contains UIDevice.currentDevice.model checks for Simulator strings, CMMotionManager.isDeviceMotionAvailable comparisons, or other Simulator-detection patterns — static detection of iOS environment-check code]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
| Data Component | Name | Channel |
|---|---|---|
| API Calls (DC0112) | mobile:DynamicAnalysis | Dynamic API/runtime trace: IPA contains UIDevice.currentDevice.model checks for Simulator strings, CMMotionManager.isDeviceMotionAvailable comparisons, or other Simulator-detection patterns — static detection of iOS environment-check code |
| Field | Description |
|---|---|
| EnvCheckWindow | Default 5s at cold launch. |
| SystemEnumAllowList | MDM agent, approved analytics SDK. Minimal. |
| AppCDNList | Per-app CDN. Derive by measurement. |