For Android, detect Archive Collected Data from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; File Creation via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: App reads files across multiple directories or databases in background state (collection phase) then invokes archive or compression routines on collected content — read-then-archive sequence is the staging chain]; File Creation via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: App writes archive-like container, high-entropy packaged blob, or .zip/.gz output to app-private or cache path after bulk data collection — archive artifact in private storage is the staging evidence]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
| Data Component | Name | Channel |
|---|---|---|
| Application Permission (DC0114) | android:DevicePolicyManager | DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review |
| File Creation (DC0039) | mobile:ForensicArtifacts | Dynamic filesystem trace or acquired app-container/filesystem artifacts: App reads files across multiple directories or databases in background state (collection phase) then invokes archive or compression routines on collected content — read-then-archive sequence is the staging chain |
| mobile:ForensicArtifacts | Dynamic filesystem trace or acquired app-container/filesystem artifacts: App writes archive-like container, high-entropy packaged blob, or .zip/.gz output to app-private or cache path after bulk data collection — archive artifact in private storage is the staging evidence | |
| OS API Execution (DC0021) | mobile:DynamicAnalysis | Dynamic API/runtime trace: App invokes ZIP, GZIP, or bulk-buffer packaging routines (ZipOutputStream, DeflaterOutputStream, similar) on previously accessed local data in background state |
| mobile:DynamicAnalysis | Dynamic API/runtime trace: App applies encryption to newly created archive or staged data blob before network transmission — encrypt-after-archive confirms adversary-controlled packing for exfil |
| Field | Description |
|---|---|
| TimeWindow | Correlation window between data access, package creation, encryption, and optional network upload |
| AllowedAppList | Apps legitimately expected to package local data such as backup, cloud sync, file manager, or media editing apps |
| AllowedPathList | Expected storage paths for legitimate archives, exports, or caches |
| ForegroundStateRequired | Whether packaging/export behavior should occur only during active user-driven workflows |
| BurstReadThreshold | Number of files or records read in a short interval before archive creation |
| ArchiveSizeThreshold | Minimum output size for suspicious packaged blob or archive |
| EntropyThreshold | Threshold for identifying encrypted or heavily compressed output |
| UplinkBytesThreshold | Minimum upload size consistent with recent archive creation |
For iOS, detect Archive Collected Data from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Application Permission via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]; Application State via Apple MDM [InstalledApplicationList / ManagedApplicationList]; File Creation via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: App writes large container, temp package, or high-entropy blob to container-local storage after clustered data access — staged archive artifact]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
| Data Component | Name | Channel |
|---|---|---|
| Application Permission (DC0114) | mobile:ApplicationVetting | Code-signing entitlements and Info.plist privacy usage-description keys |
| Application State (DC0123) | iOS:MDM | InstalledApplicationList / ManagedApplicationList |
| File Creation (DC0039) | mobile:ForensicArtifacts | Dynamic filesystem trace or acquired app-container/filesystem artifacts: App writes large container, temp package, or high-entropy blob to container-local storage after clustered data access — staged archive artifact |
| OS API Execution (DC0021) | mobile:DynamicAnalysis | Dynamic API/runtime trace: App performs bulk data transformation or packaging-like processing on collected records prior to outbound transfer on supervised device |
| Field | Description |
|---|---|
| TimeWindow | Correlation window between lifecycle event, local package creation, and upload |
| AllowedAppList | Managed apps expected to archive, export, or synchronize data |
| AllowedDestinationList | Approved cloud, enterprise, or sync endpoints for legitimate exports |
| ForegroundStateRequired | Whether packaging or export should occur only during active user interaction |
| ArchiveSizeThreshold | Minimum size for suspicious local package or blob |
| EntropyThreshold | Threshold for identifying encrypted or compressed staged output |
| UplinkBytesThreshold | Minimum outbound volume consistent with recently created archive |