For Android, detect Remote Device Management Services by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Cloud Service Enumeration via Application Vetting / Cloud Service Audit [Instrumented app API trace and corresponding cloud-service audit/API telemetry]; Protected Configuration via Android Enterprise DPC [DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported]; User Account Authentication via Application Vetting / Identity Provider Telemetry [App authentication flow instrumentation or IdP sign-in/audit events]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
| Data Component | Name | Channel |
|---|---|---|
| Cloud Service Enumeration (DC0083) | cloud:AuditLog | Instrumented app API trace and corresponding cloud-service audit/API telemetry |
| Protected Configuration (DC0115) | android:DevicePolicyManager | DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported |
| User Account Authentication (DC0002) | idp:AuditLog | App authentication flow instrumentation or IdP sign-in/audit events |
| Field | Description |
|---|---|
| AdminAllowedIPs | IT office IPs, VPN egress IPs, known admin workstation IPs. Derive from IT network documentation. |
| LocationQueryThreshold | Default 10 device queries per session. Single queries are normal; bulk is anomalous. |
| LocationQueryWindow | Default 300s. |
| AuthCorrelationWindow | Default 3600s between auth event and location query. |
For iOS, detect Remote Device Management Services by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application State via Apple MDM [InstalledApplicationList / ManagedApplicationList]; Cloud Service Enumeration via Application Vetting / Cloud Service Audit [Instrumented app API trace and corresponding cloud-service audit/API telemetry]; User Account Authentication via Application Vetting / Identity Provider Telemetry [App authentication flow instrumentation or IdP sign-in/audit events]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
| Data Component | Name | Channel |
|---|---|---|
| Application State (DC0123) | iOS:MDM | InstalledApplicationList / ManagedApplicationList |
| Cloud Service Enumeration (DC0083) | cloud:AuditLog | Instrumented app API trace and corresponding cloud-service audit/API telemetry |
| User Account Authentication (DC0002) | idp:AuditLog | App authentication flow instrumentation or IdP sign-in/audit events |
| Field | Description |
|---|---|
| FindMyQueryThreshold | Default 5 queries per session — legitimate users check location once; adversary polls repeatedly. |
| LocationQueryWindow | Default 300s. |
| UserKnownDevices | User's registered device IPs and user agents from enterprise IdP device registry. |