For Android, detect Security Software Discovery by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: PackageManager.getPackageInfo() called for package names IN $SecurityToolPackageList$ by app NOT IN $AppEnumAllowList$]; Application State via Android Enterprise / EMM [Managed package inventory/status and package metadata]; Network Connection Creation via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
| Data Component | Name | Channel |
|---|---|---|
| API Calls (DC0112) | mobile:DynamicAnalysis | Dynamic API/runtime trace: PackageManager.getPackageInfo() called for package names IN $SecurityToolPackageList$ by app NOT IN $AppEnumAllowList$ |
| Application State (DC0123) | android:EMM | Managed package inventory/status and package metadata |
| Network Connection Creation (DC0082) | android:EnterpriseNetworkLog | DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata |
| Field | Description |
|---|---|
| SecurityToolPackageList | Known MDM agent, MTD/EDR, AV package names. Maintain from vendor documentation. Update when new tools deployed. |
| AppEnumAllowList | MDM agent, system diagnostic only. |
| GuardrailWindow | Default 300s — time window within which C2 connection is expected post-check if guardrail not triggered. |
For iOS, detect Security Software Discovery by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: UIApplication.canOpenURL() called with schemes IN $MDMToolSchemeList$ by app NOT IN $AppEnumAllowList$]; Application Permission via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]; Network Connection Creation via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
| Data Component | Name | Channel |
|---|---|---|
| API Calls (DC0112) | mobile:DynamicAnalysis | Dynamic API/runtime trace: UIApplication.canOpenURL() called with schemes IN $MDMToolSchemeList$ by app NOT IN $AppEnumAllowList$ |
| Application Permission (DC0114) | mobile:ApplicationVetting | Code-signing entitlements and Info.plist privacy usage-description keys |
| Network Connection Creation (DC0082) | iOS:NetworkExtension | NEFilterFlow / per-app VPN / secure-web-gateway flow metadata |
| Field | Description |
|---|---|
| MDMToolSchemeList | Known MDM agent, MTD/EDR URI scheme patterns. Derive from deployed tool documentation. |
| AppEnumAllowList | MDM agent, system tools only. |
| GuardrailWindow | Default 300s. |