For Android, detect Dead Drop Resolver by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; Application State via Android Enterprise / EMM [Managed package inventory/status and package metadata]; Network Traffic Content via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
| Data Component | Name | Channel |
|---|---|---|
| Application Permission (DC0114) | android:DevicePolicyManager | DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review |
| Application State (DC0123) | android:EMM | Managed package inventory/status and package metadata |
| Network Traffic Content (DC0085) | webproxy:applog | DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed |
| OS API Execution (DC0021) | mobile:DynamicAnalysis | Dynamic API/runtime trace: Background work scheduler or persistent service triggered the platform retrieval without user interaction |
| Field | Description |
|---|---|
| AppDeclaredCDN | Per-app declared network destinations. Legitimate platform accesses (e.g., Slack app connecting to slack.com) should be in this list. Any platform access outside declared CDN is the dead-drop signal. |
| ApprovedPlatformApps | Apps approved for each public platform: social media apps for their own platform, productivity apps for their cloud storage. Non-platform apps accessing these platforms in background are anomalous. |
| AppBaselineDomains | 30-day per-app network destination baseline. |
| ResolverPivotWindow | Default 120s between dead-drop fetch and C2 pivot connection. Tightening: 30s — synchronous resolve-then-connect. |
For iOS, detect Dead Drop Resolver by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]; Application State via Apple MDM [InstalledApplicationList / ManagedApplicationList]; Network Traffic Content via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
| Data Component | Name | Channel |
|---|---|---|
| Application Permission (DC0114) | mobile:ApplicationVetting | Code-signing entitlements and Info.plist privacy usage-description keys |
| Application State (DC0123) | iOS:MDM | InstalledApplicationList / ManagedApplicationList |
| Network Traffic Content (DC0085) | webproxy:applog | DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed |
| OS API Execution (DC0021) | mobile:DynamicAnalysis | Dynamic API/runtime trace: Background task or networking subsystem event immediately before platform retrieval |
| Field | Description |
|---|---|
| AppDeclaredCDN | Per-app declared network destinations. Legitimate platform accesses (e.g., Slack app connecting to slack.com) should be in this list. Any platform access outside declared CDN is the dead-drop signal. |
| ApprovedPlatformApps | Apps approved for each public platform: social media apps for their own platform, productivity apps for their cloud storage. Non-platform apps accessing these platforms in background are anomalous. |
| AppBaselineDomains | 30-day per-app network destination baseline. |
| ResolverPivotWindow | Default 120s between dead-drop fetch and C2 pivot connection. Tightening: 30s — synchronous resolve-then-connect. |