For Android, detect Accounts by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: AccountManager.getAccounts() OR getAccountsByType() called > $AccountEnumThreshold$ times within $AccountEnumWindow$ by app NOT IN $ApprovedAuthenticatorApps$]; Network Traffic Flow via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]; Permissions Request via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
| Data Component | Name | Channel |
|---|---|---|
| API Calls (DC0112) | mobile:DynamicAnalysis | Dynamic API/runtime trace: AccountManager.getAccounts() OR getAccountsByType() called > $AccountEnumThreshold$ times within $AccountEnumWindow$ by app NOT IN $ApprovedAuthenticatorApps$ |
| Network Traffic Flow (DC0078) | android:EnterpriseNetworkLog | DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata |
| Permissions Request (DC0116) | android:DevicePolicyManager | DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review |
| Field | Description |
|---|---|
| ApprovedAuthenticatorApps | MDM agent, approved authenticator, sync adapter apps. Minimal. |
| AccountEnumThreshold | Default 5 calls — sync adapters call getAccountsByType once per type; bulk = enumeration. |
| AccountEnumWindow | Default 60s. |
| AccountUplinkThreshold | Default 5KB — account metadata is small; even small upload is significant. |
| AppCDNList | Per-app CDN. Derive by measurement. |
| ExfilWindow | Default 120s. |
For iOS, detect Accounts by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: SecItemCopyMatching() called with kSecMatchLimitAll]; Application Permission via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]; Network Traffic Content via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
| Data Component | Name | Channel |
|---|---|---|
| API Calls (DC0112) | mobile:DynamicAnalysis | Dynamic API/runtime trace: SecItemCopyMatching() called with kSecMatchLimitAll |
| Application Permission (DC0114) | mobile:ApplicationVetting | Code-signing entitlements and Info.plist privacy usage-description keys |
| Network Traffic Content (DC0085) | webproxy:applog | DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed |
| Field | Description |
|---|---|
| AccountUplinkThreshold | Default 5KB — credential metadata is small. |
| AppCDNList | Per-app CDN. Derive by measurement. |
| ExfilWindow | Default 120s. |