For Android, detect Remote Access Software by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; Network Connection Creation via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]; Network Traffic Flow via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
| Data Component | Name | Channel |
|---|---|---|
| Application Permission (DC0114) | android:DevicePolicyManager | DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review |
| Network Connection Creation (DC0082) | android:EnterpriseNetworkLog | DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata |
| Network Traffic Flow (DC0078) | android:EnterpriseNetworkLog | DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata |
| Field | Description |
|---|---|
| RASAppSignatures | TeamViewer, AnyDesk, AirDroid, AirMirror package names. |
| ApprovedRASApps | IT-authorized remote support packages. Keep minimal. |
| RASInfrastructureIPs | Published IP ranges for approved RAS vendors. Derive from vendor documentation. |
| PersistentSessionThreshold | Default 300s — confirms active session vs connection test. |
| InteractiveRatioRange | Default inbound/outbound ratio 0.1–10.0 — interactive vs pure exfil. Derive from RAS session baseline. |
For iOS, detect Remote Access Software by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]; Network Connection Creation via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]; Network Traffic Flow via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
| Data Component | Name | Channel |
|---|---|---|
| Application Permission (DC0114) | mobile:ApplicationVetting | Code-signing entitlements and Info.plist privacy usage-description keys |
| Network Connection Creation (DC0082) | iOS:NetworkExtension | NEFilterFlow / per-app VPN / secure-web-gateway flow metadata |
| Network Traffic Flow (DC0078) | iOS:NetworkExtension | NEFilterFlow / per-app VPN / secure-web-gateway flow metadata |
| Field | Description |
|---|---|
| RASAppBundleIDs | TeamViewer, AnyDesk, AirServer iOS bundle IDs. |
| ApprovedRASApps | IT-authorized iOS remote support bundles. |
| RASInfrastructureIPs | RAS vendor published IP ranges. |
| PersistentSessionThreshold | Default 300s. |
| InteractiveRatioRange | Default 0.1–10.0. |