Application Permission — Detection Telemetry

Collection and providers

Compare manifest declarations with runtime granted state using authorized package inspection and own-app permission checks.

• Android logcat: Permitted logs from a consented test device/emulator; output depends on build, permissions and instrumentation.
• Android dumpsys: Point-in-time service/package state on an authorized development device.
• Instrumented test application: Own-app permission, API and state callbacks; not universal visibility into other apps.

Configuration

• Use a disposable emulator or owned development device with approved debugging. Record OS/API level, app version and instrumentation privileges.
• Collect only relevant logcat buffers/tags and service snapshots; add explicit own-app instrumentation for events absent from OS logs.
• Forward sanitized logs and compare before/after state. Remove test data and revoke debugging access after the lab session.

adb shell dumpsys package test.example.lab

Read-only snapshot on a consented debug device. Replace the example package with your owned test app. Output and access vary by Android build; this is not a permission-request event stream.

Synthetic event example

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0114",
  "collector": "illustrative-lab-collector",
  "observation": {
    "package": "test.example.lab",
    "permission": "android.permission.CAMERA",
    "declared": true,
    "granted": false
  }
}

Visibility and validation

Android tooling does not imply iOS coverage. Standard mobile apps cannot observe all other apps or protected OS internals; MDM status is not full API, filesystem or content telemetry.

• Record the lab scope, collector version, effective configuration and expected source fields before testing.
• Use an approved benign action or read-only snapshot appropriate to this type. For destructive, privileged or physical effects, use a reviewed fixture or existing authorized evidence instead of causing the effect.
• Verify the native source record locally and at the collector; compare timestamps, identity, object, action/result and the type-specific fields listed below. Save a redacted real capture separately from the synthetic example.
• Check a normal baseline and collector-loss case. Fixture parsing proves parser behavior only; it does not prove sensor coverage or malicious-behavior detection.

Primary sources

• Android logcat and access limits
• Android dumpsys
• Android runtime permission requests