For Android, detect Keylogging by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: AccessibilityEvent.TYPE_VIEW_TEXT_CHANGED received by listener NOT IN $AccessibilityAllowList$ at rate > $KeystrokeEventThreshold$ per minute with source_apps spanning > $AppMonitorCountThreshold$ distinct apps]; Network Traffic Content via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed]; Permissions Request via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
| Data Component | Name | Channel |
|---|---|---|
| API Calls (DC0112) | mobile:DynamicAnalysis | Dynamic API/runtime trace: AccessibilityEvent.TYPE_VIEW_TEXT_CHANGED received by listener NOT IN $AccessibilityAllowList$ at rate > $KeystrokeEventThreshold$ per minute with source_apps spanning > $AppMonitorCountThreshold$ distinct apps |
| Network Traffic Content (DC0085) | webproxy:applog | DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed |
| Permissions Request (DC0116) | android:DevicePolicyManager | DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review |
| Field | Description |
|---|---|
| AccessibilityAllowList | Approved assistive tech only. Minimal list. |
| KeystrokeEventThreshold | Default 50 events/min — human typing baseline. Derive by measurement. |
| AppMonitorCountThreshold | Default 3 distinct source apps — keylogger monitors broadly; assistive tech monitors narrowly. |
| TargetAppList | Banking, auth, enterprise app packages. |
| KeylogPayloadThreshold | Default 1KB — keystroke logs are small and dense. |
| KeylogExfilWindow | Default 300s. |
| AppCDNList | Per-app CDN. Derive by measurement. |
For iOS, detect Keylogging by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application State via Apple MDM [InstalledApplicationList / ManagedApplicationList]; Network Traffic Flow via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]; Permissions Request via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
| Data Component | Name | Channel |
|---|---|---|
| Application State (DC0123) | iOS:MDM | InstalledApplicationList / ManagedApplicationList |
| Network Traffic Flow (DC0078) | iOS:NetworkExtension | NEFilterFlow / per-app VPN / secure-web-gateway flow metadata |
| Permissions Request (DC0116) | mobile:ApplicationVetting | Code-signing entitlements and Info.plist privacy usage-description keys |
| Field | Description |
|---|---|
| KeyboardAllowList | IT-approved keyboard bundles. |
| KeyboardVendorEndpoints | Known vendor cloud endpoints per approved keyboard. |
| KeystrokeFrequencyThreshold | Default 2 packets/sec. |
| KeylogVolumeThreshold | Default 10KB per session — keystroke logs are small but dense. |