For Android, detect System Checks by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: getNetworkInterfaces() OR NetworkInterface.getHardwareAddress() called within $ProcReadWindow$ of /proc reads by same app — network MAC OUI check completes hardware fingerprint]; File Access via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: open() for read on /proc/cpuinfo]; Network Connection Creation via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
| Data Component | Name | Channel |
|---|---|---|
| API Calls (DC0112) | mobile:DynamicAnalysis | Dynamic API/runtime trace: getNetworkInterfaces() OR NetworkInterface.getHardwareAddress() called within $ProcReadWindow$ of /proc reads by same app — network MAC OUI check completes hardware fingerprint |
| File Access (DC0055) | mobile:ForensicArtifacts | Dynamic filesystem trace or acquired app-container/filesystem artifacts: open() for read on /proc/cpuinfo |
| Network Connection Creation (DC0082) | android:EnterpriseNetworkLog | DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata |
| Field | Description |
|---|---|
| ProcReadAllowList | Performance monitoring, MDM agent. Minimal. Derive from MDM catalog. |
| ProcReadWindow | Default 30s — environment checks are synchronous. |
| AppCDNList | Per-app CDN. Derive by measurement. |
| FollowOnWindow | Default 120s. |
For iOS, detect System Checks by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: UIDevice.currentDevice.model]; Application State via Apple MDM [InstalledApplicationList / ManagedApplicationList]; Network Connection Creation via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
| Data Component | Name | Channel |
|---|---|---|
| API Calls (DC0112) | mobile:DynamicAnalysis | Dynamic API/runtime trace: UIDevice.currentDevice.model |
| Application State (DC0123) | iOS:MDM | InstalledApplicationList / ManagedApplicationList |
| Network Connection Creation (DC0082) | iOS:NetworkExtension | NEFilterFlow / per-app VPN / secure-web-gateway flow metadata |
| Field | Description |
|---|---|
| ProcReadWindow | Default 5s at cold launch. |
| SystemEnumAllowList | MDM agent, approved analytics SDK. |
| SimulatorModelPatterns | Known Xcode Simulator model strings (x86_64, iPhone Simulator, etc.). Derive from Apple developer documentation. |