Complete technique description
Adversaries may capture audio to collect information by leveraging standard operating system APIs of a mobile device. Examples of audio information adversaries may target include user conversations, surroundings, phone calls, or other sensitive information.
Android and iOS, by default, require that applications request device microphone access from the user.
On Android devices, applications must hold the `RECORD_AUDIO` permission to access the microphone or the `CAPTURE_AUDIO_OUTPUT` permission to access audio output. Because Android does not allow third-party applications to hold the `CAPTURE_AUDIO_OUTPUT` permission by default, only privileged applications, such as those distributed by Google or the device vendor, can access audio output.[Android Permissions] However, adversaries may be able to gain this access after successfully elevating their privileges. With the `CAPTURE_AUDIO_OUTPUT` permission, adversaries may pass the `MediaRecorder.AudioSource.VOICE_CALL` constant to `MediaRecorder.setAudioOutput`, allowing capture of both voice call uplink and downlink.[Manifest.permission]
On iOS devices, applications must include the `NSMicrophoneUsageDescription` key in their `Info.plist` file to access the microphone.[Requesting Auth-Media Capture]
Official technique definition · Open in the interactive matrix
Detection telemetry and configuration
These contracts are selected through exact technique-to-data-component relationships or explicitly labelled planning overrides. Configure a collector at the relevant observation point; a telemetry name alone is not coverage.
API Calls · source-mapped
DC0112 collection page — Instrument selected APIs in the owned test app or approved research build; log caller, API, sanitized argument class and return status.
Providers and collection configuration
- Android logcat: Permitted logs from a consented test device/emulator; output depends on build, permissions and instrumentation.
- Android dumpsys: Point-in-time service/package state on an authorized development device.
- Instrumented test application: Own-app permission, API and state callbacks; not universal visibility into other apps.
- Use a disposable emulator or owned development device with approved debugging. Record OS/API level, app version and instrumentation privileges.
- Collect only relevant logcat buffers/tags and service snapshots; add explicit own-app instrumentation for events absent from OS logs.
- Forward sanitized logs and compare before/after state. Remove test data and revoke debugging access after the lab session.
Required normalized fields: package, api, result, thread.
Illustrative collection event
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0112",
"collector": "illustrative-lab-collector",
"observation": {
"package": "test.example.lab",
"api": "android.hardware.camera2.CameraManager.openCamera",
"result": "permission_denied",
"thread": "main"
}
}
Visibility limits: Android tooling does not imply iOS coverage. Standard mobile apps cannot observe all other apps or protected OS internals; MDM status is not full API, filesystem or content telemetry.
Application Permission · source-mapped
DC0114 collection page — Compare manifest declarations with runtime granted state using authorized package inspection and own-app permission checks.
Providers and collection configuration
- Android logcat: Permitted logs from a consented test device/emulator; output depends on build, permissions and instrumentation.
- Android dumpsys: Point-in-time service/package state on an authorized development device.
- Instrumented test application: Own-app permission, API and state callbacks; not universal visibility into other apps.
- Use a disposable emulator or owned development device with approved debugging. Record OS/API level, app version and instrumentation privileges.
- Collect only relevant logcat buffers/tags and service snapshots; add explicit own-app instrumentation for events absent from OS logs.
- Forward sanitized logs and compare before/after state. Remove test data and revoke debugging access after the lab session.
Required normalized fields: package, permission, declared, granted.
adb shell dumpsys package test.example.lab
Read-only snapshot on a consented debug device. Replace the example package with your owned test app. Output and access vary by Android build; this is not a permission-request event stream.
Illustrative collection event
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0114",
"collector": "illustrative-lab-collector",
"observation": {
"package": "test.example.lab",
"permission": "android.permission.CAMERA",
"declared": true,
"granted": false
}
}
Visibility limits: Android tooling does not imply iOS coverage. Standard mobile apps cannot observe all other apps or protected OS internals; MDM status is not full API, filesystem or content telemetry.
File Creation · source-mapped
DC0039 collection page — Scope Sysmon FileCreate (11) to the lab directory; retain the process and file path. Differentiate creation/overwrite if the sensor can.
Providers and collection configuration
- Microsoft Sysmon: Windows event-based collection; enable the event types needed below.
- Linux Audit: Linux alternative for supported system-call and file events; different semantics and fields.
- Apple Endpoint Security clients: macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.
- On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
- Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
- For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms.
Required normalized fields: process_id, path, action, size_bytes.
Illustrative collection event
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0039",
"collector": "illustrative-lab-collector",
"observation": {
"process_id": 4200,
"path": "C:\\Lab\\demo.txt",
"action": "create",
"size_bytes": 64
}
}
Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.
Network Traffic Flow · source-mapped
DC0078 collection page — Collect Zeek conn.log, Suricata flow events or exporter equivalents, including observation point and sampling settings.
Providers and collection configuration
- Zeek: Connection and protocol metadata from traffic visible to the sensor.
- Suricata EVE: Configured flow, alert, DNS, HTTP, TLS and protocol records.
- AWS VPC Flow Logs: IP traffic metadata alternative; no packet payload or DNS answer history, and some traffic is not logged.
- Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.
- Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.
- Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection.
Required normalized fields: source_ip, destination_ip, destination_port, protocol, bytes_sent, bytes_received.
Illustrative collection event
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0078",
"collector": "illustrative-lab-collector",
"observation": {
"source_ip": "192.0.2.10",
"destination_ip": "198.51.100.20",
"destination_port": 443,
"protocol": "tcp",
"bytes_sent": 128,
"bytes_received": 512
}
}
Visibility limits: Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.
Permissions Request · source-mapped
DC0116 collection page — Correlate own-app request/callback instrumentation with the consented test-device prompt. A request callback alone does not prove a prompt appeared (for example, a previously denied permission).
Providers and collection configuration
- Android logcat: Permitted logs from a consented test device/emulator; output depends on build, permissions and instrumentation.
- Android dumpsys: Point-in-time service/package state on an authorized development device.
- Instrumented test application: Own-app permission, API and state callbacks; not universal visibility into other apps.
- Use a disposable emulator or owned development device with approved debugging. Record OS/API level, app version and instrumentation privileges.
- Collect only relevant logcat buffers/tags and service snapshots; add explicit own-app instrumentation for events absent from OS logs.
- Forward sanitized logs and compare before/after state. Remove test data and revoke debugging access after the lab session.
Required normalized fields: package, permission, action, prompt_observed, result.
Illustrative collection event
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0116",
"collector": "illustrative-lab-collector",
"observation": {
"package": "test.example.lab",
"permission": "android.permission.CAMERA",
"action": "permission_prompt",
"prompt_observed": true,
"result": "denied"
}
}
Visibility limits: Android tooling does not imply iOS coverage. Standard mobile apps cannot observe all other apps or protected OS internals; MDM status is not full API, filesystem or content telemetry.