For Android, detect User Evasion from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Application State via Android Enterprise / EMM [Managed package inventory/status and package metadata]; OS API Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: App invokes SensorManager.registerListener() for TYPE_ACCELEROMETER or TYPE_GYROSCOPE NOT IN $ApprovedMotionApps$ followed by conditional execution branching correlated with sensor readings — motion sensing followed by behavioral conditiona]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
| Data Component | Name | Channel |
|---|---|---|
| Application State (DC0123) | android:EMM | Managed package inventory/status and package metadata |
| OS API Execution (DC0021) | mobile:DynamicAnalysis | Dynamic API/runtime trace: App invokes SensorManager.registerListener() for TYPE_ACCELEROMETER or TYPE_GYROSCOPE NOT IN $ApprovedMotionApps$ followed by conditional execution branching correlated with sensor readings — motion sensing followed by behavioral conditiona |
| Field | Description |
|---|---|
| TimeWindow | Correlation window between motion-state inference and subsequent deferred execution |
| IdleThreshold | Threshold defining when device motion or interaction is considered low enough to permit hidden execution |
| InteractionSignalSet | Environment-specific set of motion or activity signals used to infer user presence |
| AllowedAppList | Baseline of legitimate applications expected to use motion or activity sensing while also conditionally changing behavior |
| ForegroundStateRequired | Whether suspiciousness increases when deferred activity starts from background or with no recent foreground interaction |
| UplinkBytesThreshold | Minimum outbound traffic threshold used to distinguish meaningful deferred operation from benign maintenance traffic |