For Android, detect Foreground Persistence by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application State via Android Enterprise / EMM [Managed package inventory/status and package metadata]; OS API Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: App invokes startForegroundService() or startForeground() NOT IN $ApprovedForegroundServiceApps$]; System Settings via Android Enterprise DPC [DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
| Data Component | Name | Channel |
|---|---|---|
| Application State (DC0123) | android:EMM | Managed package inventory/status and package metadata |
| OS API Execution (DC0021) | mobile:DynamicAnalysis | Dynamic API/runtime trace: App invokes startForegroundService() or startForeground() NOT IN $ApprovedForegroundServiceApps$ |
| System Settings (DC0118) | android:DevicePolicyManager | DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported |
| Field | Description |
|---|---|
| ApprovedForegroundServiceApps | Media players, navigation apps, VoIP apps, approved fitness trackers — apps with legitimate foreground service need. Derive from MDM catalog. Tightening: strict list. |
| ForegroundDurationThreshold | Default 3600s (1 hour) sustained foreground service. Legitimate foreground services (music playback, navigation) have user-aligned durations. Extended overnight foreground service is persistence abuse. |
| InteractionThreshold | Default 300s. Foreground service accessing sensors >5min after last user touch is covert. |