For Android, detect Masquerading from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; File Creation via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: app binary written to device storage as part of install — confirms impersonating app is being persisted]; File Metadata via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: installed app package_name Levenshtein distance <= $NameDistanceThreshold$ to entry in $KnownAppCatalog$]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
| Data Component | Name | Channel |
|---|---|---|
| Application Permission (DC0114) | android:DevicePolicyManager | DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review |
| File Creation (DC0039) | mobile:ForensicArtifacts | Dynamic filesystem trace or acquired app-container/filesystem artifacts: app binary written to device storage as part of install — confirms impersonating app is being persisted |
| File Metadata (DC0059) | mobile:ForensicArtifacts | Dynamic filesystem trace or acquired app-container/filesystem artifacts: installed app package_name Levenshtein distance <= $NameDistanceThreshold$ to entry in $KnownAppCatalog$ |
| Field | Description |
|---|---|
| NameDistanceThreshold | Default Levenshtein distance 2. Tightening: 1 — only single-char variants. Loosening: 3 — more coverage, more FP. |
| KnownAppCatalog | MDM-approved catalog plus Play Store reference catalog with cert fingerprints. Update with each new enterprise app deployment. |
| IconHashThreshold | Default perceptual hash distance < 10. Derive from baseline icon hash comparison. |
| MDMApprovedCatalog | MDM-managed app list. |
For iOS, detect Masquerading by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]; File Metadata via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: bundle_id LIKE $KnownSystemNamespace$]; Network Traffic Flow via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
| Data Component | Name | Channel |
|---|---|---|
| Application Permission (DC0114) | mobile:ApplicationVetting | Code-signing entitlements and Info.plist privacy usage-description keys |
| File Metadata (DC0059) | mobile:ForensicArtifacts | Dynamic filesystem trace or acquired app-container/filesystem artifacts: bundle_id LIKE $KnownSystemNamespace$ |
| Network Traffic Flow (DC0078) | iOS:NetworkExtension | NEFilterFlow / per-app VPN / secure-web-gateway flow metadata |
| Field | Description |
|---|---|
| KnownSystemNamespace | com.apple.*, org.whispersystems.*, com.google.* — reserved/well-known namespaces. |
| MDMApprovedCatalog | MDM-managed app list. |
| ImpersonatedAppPermissionProfile | Permission set of each known-good app that could be impersonated. Derive from MDM app catalog audit. |
| ImpersonatedAppCDN | Known network destinations for each enterprise app that could be impersonated. |