For Android, detect Exploitation for Privilege Escalation by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; Host Status via Android Enterprise DPC [DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported]; Network Traffic Flow via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
| Data Component | Name | Channel |
|---|---|---|
| Application Permission (DC0114) | android:DevicePolicyManager | DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review |
| Host Status (DC0018) | android:DevicePolicyManager | DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported |
| Network Traffic Flow (DC0078) | android:EnterpriseNetworkLog | DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata |
| Field | Description |
|---|---|
| PatchLagThreshold | Default 30 days. Align to org patch SLA. |
| PrivilegedAppList | MDM agent, OTA update service, approved Device Admin apps. |
| EscalationWindow | Default 600s after root detection. Adjust to MDM check-in interval. |
| AppBaselineDomains | Per-device CDN baseline, 30-day measurement. |
For iOS, detect Exploitation for Privilege Escalation by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Host Status via Apple MDM [DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries]; Network Traffic Flow via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]; OS API Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: Unified Log entry at level=fault in subsystem com.apple.kernel or com.apple.sandbox within $KernelFaultWindow$ of integrity_check failure — kernel-level fault coincident with integrity failure is the exploit-execution signal; requires super]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
| Data Component | Name | Channel |
|---|---|---|
| Host Status (DC0018) | iOS:MDM | DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries |
| Network Traffic Flow (DC0078) | iOS:NetworkExtension | NEFilterFlow / per-app VPN / secure-web-gateway flow metadata |
| OS API Execution (DC0021) | mobile:DynamicAnalysis | Dynamic API/runtime trace: Unified Log entry at level=fault in subsystem com.apple.kernel or com.apple.sandbox within $KernelFaultWindow$ of integrity_check failure — kernel-level fault coincident with integrity failure is the exploit-execution signal; requires super |
| Field | Description |
|---|---|
| KernelFaultWindow | Default 60s between integrity failure and kernel fault. |
| AppBaselineDomains | Per-device CDN baseline, 30-day. |
| PostExploitWindow | Default 300s after integrity failure. |