For Android, detect Data from Local System from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; File Access via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: App reads files across $MinDirectoryCount$+ distinct parent directories with file_read_count > $FileReadRateThreshold$ within $DataCollectionWindow$ in background or low-interaction state — bulk cross-directory read is the collection signal]; OS API Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: App invokes ContentResolver or SAF (Storage Access Framework) queries across multiple user-data paths outside its own sandbox in background state]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
| Data Component | Name | Channel |
|---|---|---|
| Application Permission (DC0114) | android:DevicePolicyManager | DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review |
| File Access (DC0055) | mobile:ForensicArtifacts | Dynamic filesystem trace or acquired app-container/filesystem artifacts: App reads files across $MinDirectoryCount$+ distinct parent directories with file_read_count > $FileReadRateThreshold$ within $DataCollectionWindow$ in background or low-interaction state — bulk cross-directory read is the collection signal |
| OS API Execution (DC0021) | mobile:DynamicAnalysis | Dynamic API/runtime trace: App invokes ContentResolver or SAF (Storage Access Framework) queries across multiple user-data paths outside its own sandbox in background state |
| Field | Description |
|---|---|
| ApprovedDataCollectionApps | Approved backup, sync, file manager, and media apps. Derive from MDM catalog. Tightening: strict list — any unapproved app with broad file access is flagged. |
| FileReadRateThreshold | Default 50 file reads within window across 3+ directories. Derive from approved backup app baseline. Tightening: 10 reads — catches targeted collection. |
| MinDirectoryCount | Default 3 distinct parent directories. Single-directory reads may be legitimate (photo editor); cross-directory reads indicate collection sweep. |
| DataCollectionWindow | Default 60s observation window. |
| AppCDNList | Per-app CDN baseline. |
| ExfilWindow | Default 120s between staging and upload. |
For iOS, detect Data from Local System primarily during application vetting or controlled analysis rather than assuming a live device SOC feed. Correlate Application Permission via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]; File Access via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: App reads multiple files from Photos library, Files provider, or iCloud Drive in background or lock-adjacent state exceeding $FileReadRateThreshold$ within $DataCollectionWindow$]; OS API Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: Managed app accesses broad local data scope without user-initiated document picker interaction on supervised device]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
| Data Component | Name | Channel |
|---|---|---|
| Application Permission (DC0114) | mobile:ApplicationVetting | Code-signing entitlements and Info.plist privacy usage-description keys |
| File Access (DC0055) | mobile:ForensicArtifacts | Dynamic filesystem trace or acquired app-container/filesystem artifacts: App reads multiple files from Photos library, Files provider, or iCloud Drive in background or lock-adjacent state exceeding $FileReadRateThreshold$ within $DataCollectionWindow$ |
| OS API Execution (DC0021) | mobile:DynamicAnalysis | Dynamic API/runtime trace: Managed app accesses broad local data scope without user-initiated document picker interaction on supervised device |
| Field | Description |
|---|---|
| ApprovedDataCollectionApps | Approved backup, sync, file manager, and media apps. Derive from MDM catalog. Tightening: strict list — any unapproved app with broad file access is flagged. |
| FileReadRateThreshold | Default 50 file reads within window across 3+ directories. Derive from approved backup app baseline. Tightening: 10 reads — catches targeted collection. |
| MinDirectoryCount | Default 3 distinct parent directories. Single-directory reads may be legitimate (photo editor); cross-directory reads indicate collection sweep. |
| DataCollectionWindow | Default 60s observation window. |
| AppCDNList | Per-app CDN baseline. |
| ExfilWindow | Default 120s between staging and upload. |