For Android, detect Exfiltration Over Alternative Protocol by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; Application State via Android Enterprise / EMM [Managed package inventory/status and package metadata]; Network Connection Creation via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
| Data Component | Name | Channel |
|---|---|---|
| Application Permission (DC0114) | android:DevicePolicyManager | DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review |
| Application State (DC0123) | android:EMM | Managed package inventory/status and package metadata |
| Network Connection Creation (DC0082) | android:EnterpriseNetworkLog | DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata |
| Network Traffic Content (DC0085) | webproxy:applog | DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed |
| Network Traffic Flow (DC0078) | android:EnterpriseNetworkLog | DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata |
| Field | Description |
|---|---|
| BeaconVarianceThreshold | Default 15% interval variance — human-driven traffic varies more. Derive from baseline traffic analysis. |
| PayloadVarianceThreshold | Default 100 bytes stdev — beacon payloads are uniform; human traffic varies. |
| AppBaselineDomains | Per-app known CDN/update domains from 30-day baseline. Derive by measurement. |
| BeaconMinCount | Default 10 connections — single or few connections are not beacon patterns. |
For iOS, detect Application Layer Protocol by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]; Application State via Apple MDM [InstalledApplicationList / ManagedApplicationList]; Network Connection Creation via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
| Data Component | Name | Channel |
|---|---|---|
| Application Permission (DC0114) | mobile:ApplicationVetting | Code-signing entitlements and Info.plist privacy usage-description keys |
| Application State (DC0123) | iOS:MDM | InstalledApplicationList / ManagedApplicationList |
| Network Connection Creation (DC0082) | iOS:NetworkExtension | NEFilterFlow / per-app VPN / secure-web-gateway flow metadata |
| Network Traffic Content (DC0085) | webproxy:applog | DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed |
| Network Traffic Flow (DC0078) | iOS:NetworkExtension | NEFilterFlow / per-app VPN / secure-web-gateway flow metadata |
| Field | Description |
|---|---|
| MDMApprovedCatalog | MDM-managed app list. |
| AppBaselineDomains | Per-app CDN/update domains, 30-day baseline. |
| BeaconVarianceThreshold | Default 15% interval variance. Derive from baseline traffic analysis. |
| PayloadVarianceThreshold | Default 100 bytes stdev. |
| BeaconMinCount | Default 10 connections. |