For Android, detect Compromise Software Dependencies and Development Tools by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; Application State via Android Enterprise / EMM [Managed package inventory/status and package metadata]; OS API Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: App begins first-seen network connections to destinations matching known-malicious SDK C2 patterns or outside $SDKBaselineEndpoints$ for embedded SDK namespace]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
| Data Component | Name | Channel |
|---|---|---|
| Application Permission (DC0114) | android:DevicePolicyManager | DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review |
| Application State (DC0123) | android:EMM | Managed package inventory/status and package metadata |
| OS API Execution (DC0021) | mobile:DynamicAnalysis | Dynamic API/runtime trace: App begins first-seen network connections to destinations matching known-malicious SDK C2 patterns or outside $SDKBaselineEndpoints$ for embedded SDK namespace |
| Protected Configuration (DC0115) | android:DevicePolicyManager | DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported |
| Field | Description |
|---|---|
| SDKBaselineEndpoints | Known analytics/telemetry endpoints for embedded SDKs (Firebase, Adjust, AppsFlyer, etc.). Derive from SDK vendor documentation. Any SDK endpoint outside this list post-update is anomalous. |
| PostInstallWindow | Default 86400s. Same as T1474 parent. |
For iOS, detect Compromise Software Dependencies and Development Tools from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Application Permission via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]; Application State via Apple MDM [InstalledApplicationList / ManagedApplicationList]; OS API Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: Known app begins first-seen use of protected categories (analytics, location, contacts) matching known-SDK behavior patterns post-update]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
| Data Component | Name | Channel |
|---|---|---|
| Application Permission (DC0114) | mobile:ApplicationVetting | Code-signing entitlements and Info.plist privacy usage-description keys |
| Application State (DC0123) | iOS:MDM | InstalledApplicationList / ManagedApplicationList |
| OS API Execution (DC0021) | mobile:DynamicAnalysis | Dynamic API/runtime trace: Known app begins first-seen use of protected categories (analytics, location, contacts) matching known-SDK behavior patterns post-update |
| Protected Configuration (DC0115) | iOS:MDM | DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries |
| Field | Description |
|---|---|
| SDKBaselineEndpoints | Known analytics/telemetry endpoints for embedded SDKs (Firebase, Adjust, AppsFlyer, etc.). Derive from SDK vendor documentation. Any SDK endpoint outside this list post-update is anomalous. |
| PostInstallWindow | Default 86400s. Same as T1474 parent. |