For Android, detect Compromise Software Supply Chain from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; Application State via Android Enterprise / EMM [Managed package inventory/status and package metadata]; File Creation via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: Compromised app writes staging, cache, or export artifacts inconsistent with its declared function within $PostInstallWindow$]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
| Data Component | Name | Channel |
|---|---|---|
| Application Permission (DC0114) | android:DevicePolicyManager | DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review |
| Application State (DC0123) | android:EMM | Managed package inventory/status and package metadata |
| File Creation (DC0039) | mobile:ForensicArtifacts | Dynamic filesystem trace or acquired app-container/filesystem artifacts: Compromised app writes staging, cache, or export artifacts inconsistent with its declared function within $PostInstallWindow$ |
| OS API Execution (DC0021) | mobile:DynamicAnalysis | Dynamic API/runtime trace: Recently updated trusted app invokes special-access paths, account services, or accessibility not present in prior version baseline |
| Field | Description |
|---|---|
| TimeWindow | Correlation window between install/update and subsequent runtime/network effects. |
| AllowedAppList | Approved managed or trusted applications vary by organization and device group. |
| AllowedInstallerSources | Permitted installer source or app delivery mechanism differs by fleet and policy. |
| AllowedSigningBaseline | Expected signing lineage, certificate relationship, or integrity metadata vary by package. |
| ForegroundStateRequired | Some protected-resource use is legitimate only when an app is foregrounded. |
| RecentUserInteractionWindow | Defines how close behavior must be to user interaction to be considered expected. |
| AllowedDestinations | Expected app destinations, CDNs, APIs, and service providers vary by app and tenant. |
For iOS, detect Compromise Software Supply Chain from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Application Permission via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]; Application State via Apple MDM [InstalledApplicationList / ManagedApplicationList]; OS API Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: Launch services, extension-handling, or framework subsystem anomalies occur near install or first launch of recently updated trusted app on supervised device]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
| Data Component | Name | Channel |
|---|---|---|
| Application Permission (DC0114) | mobile:ApplicationVetting | Code-signing entitlements and Info.plist privacy usage-description keys |
| Application State (DC0123) | iOS:MDM | InstalledApplicationList / ManagedApplicationList |
| OS API Execution (DC0021) | mobile:DynamicAnalysis | Dynamic API/runtime trace: Launch services, extension-handling, or framework subsystem anomalies occur near install or first launch of recently updated trusted app on supervised device |
| Field | Description |
|---|---|
| TimeWindow | Correlation window between app install/update and subsequent lifecycle or network anomalies. |
| SupervisedRequired | Strongest app inventory and managed state analytics depend on supervised iOS devices. |
| AllowedManagedApps | Approved managed app set varies by organization, business unit, and device profile. |
| ExpectedVersionTransitionPolicy | Allowed upgrade paths, release rings, and phased rollout patterns vary by environment. |
| AllowedDestinations | Expected app destinations, enterprise backends, Apple services, and CDNs differ by app. |
| BackgroundRefreshBaseline | Legitimate background activity differs by app category and policy. |
| RecentUserInteractionWindow | Defines how close runtime/network activity must be to user action to be considered expected. |
| UplinkBytesThreshold | Threshold for suspicious post-update outbound transfer volume. |