For Android, detect Exploitation for Client Execution by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Host Status via Android Enterprise DPC [DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported]; Network Connection Creation via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]; Process Creation via Application Vetting / Managed Device Telemetry [execve()]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
| Data Component | Name | Channel |
|---|---|---|
| Host Status (DC0018) | android:DevicePolicyManager | DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported |
| Network Connection Creation (DC0082) | android:EnterpriseNetworkLog | DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata |
| Process Creation (DC0032) | mobile:DynamicAnalysis | execve() |
| Field | Description |
|---|---|
| MediaProcessList | mediaserver, chromium, com.android.browser, com.android.mms, com.android.messaging. Expand per installed browser. |
| KnownMediaChildren | Renderer, GPU process, sandboxed service workers. Derive from media process baseline. |
| ExploitWindow | Default 10s between media process activity and child spawn. |
| AppBaselineDomains | Per-app CDN baseline. |
| PostExploitWindow | Default 30s between child spawn and C2 connection. |
| PatchLagThreshold | Default 30 days. Context only — not primary signal. |
For iOS, detect Exploitation for Client Execution by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Host Status via Apple MDM [DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries]; Network Connection Creation via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]; Process Creation via Application Vetting / Managed Device Telemetry [com.apple.WebContent or com.apple.imagent process shows unexpected child spawn or memory fault at level=fault in Unified Log — kernel fault in message-processing subsystem is exploit execution signal]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
| Data Component | Name | Channel |
|---|---|---|
| Host Status (DC0018) | iOS:MDM | DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries |
| Network Connection Creation (DC0082) | iOS:NetworkExtension | NEFilterFlow / per-app VPN / secure-web-gateway flow metadata |
| Process Creation (DC0032) | mobile:DynamicAnalysis | com.apple.WebContent or com.apple.imagent process shows unexpected child spawn or memory fault at level=fault in Unified Log — kernel fault in message-processing subsystem is exploit execution signal |
| Field | Description |
|---|---|
| AppleSystemBaseline | Known Apple CDN, update, and push notification server IP ranges. Derive from Apple published IP lists. |
| PostExploitWindow | Default 60s between fault and C2 connection. |
| MinSecureVersion | Latest Apple security release. Update from Apple security advisories. |