For Android, detect Clipboard Data by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: ClipboardManager.addOnPrimaryClipChangedListener()]; Application State via Android Enterprise / EMM [Managed package inventory/status and package metadata]; Network Connection Creation via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
| Data Component | Name | Channel |
|---|---|---|
| API Calls (DC0112) | mobile:DynamicAnalysis | Dynamic API/runtime trace: ClipboardManager.addOnPrimaryClipChangedListener() |
| Application State (DC0123) | android:EMM | Managed package inventory/status and package metadata |
| Network Connection Creation (DC0082) | android:EnterpriseNetworkLog | DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata |
| Field | Description |
|---|---|
| ClipboardAllowList | Approved IME apps, approved password managers. Derive from MDM catalog. |
| SensitiveClipPattern | Bitcoin/Ethereum wallet regex, IBAN format, password-manager copy markers. Tunable to org-specific patterns. |
| ClipExfilWindow | Default 10s — clipboard replacement is synchronous. |
| AppCDNList | Per-app CDN. Derive by measurement. |
For iOS, detect Clipboard Data by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: UIPasteboard.general.string property accessed by app]; Network Connection Creation via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]; System Notifications via Managed App Telemetry / Apple MDM [ManagedApplicationFeedback or application-generated telemetry]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
| Data Component | Name | Channel |
|---|---|---|
| API Calls (DC0112) | mobile:DynamicAnalysis | Dynamic API/runtime trace: UIPasteboard.general.string property accessed by app |
| Network Connection Creation (DC0082) | iOS:NetworkExtension | NEFilterFlow / per-app VPN / secure-web-gateway flow metadata |
| System Notifications (DC0117) | iOS:ManagedAppLog | ManagedApplicationFeedback or application-generated telemetry |
| Field | Description |
|---|---|
| SensitiveClipPattern | Wallet/IBAN/credential regex. Tunable to org context. |
| PasteNotifWindow | Default 5s — iOS generates notification synchronously. |
| ClipExfilWindow | Default 10s. |
| AppCDNList | Per-app CDN. Derive by measurement. |