Instrumented Android filesystem changes — Detection Telemetry

Collection and providers

Instrument the owned app sandbox or approved emulator image; capture before/after hashes and path without assuming system-wide stock-device access.

• Android logcat: Permitted logs from a consented test device/emulator; output depends on build, permissions and instrumentation.
• Android dumpsys: Point-in-time service/package state on an authorized development device.
• Instrumented test application: Own-app permission, API and state callbacks; not universal visibility into other apps.

Configuration

• Use a disposable emulator or owned development device with approved debugging. Record OS/API level, app version and instrumentation privileges.
• Collect only relevant logcat buffers/tags and service snapshots; add explicit own-app instrumentation for events absent from OS logs.
• Forward sanitized logs and compare before/after state. Remove test data and revoke debugging access after the lab session.

Synthetic event example

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "proposed-instrumented-android-filesystem-changes",
  "collector": "illustrative-lab-collector",
  "observation": {
    "package": "test.example.lab",
    "path": "files/demo.txt",
    "action": "modify",
    "scope": "own_app_sandbox"
  }
}

Visibility and validation

Android tooling does not imply iOS coverage. Standard mobile apps cannot observe all other apps or protected OS internals; MDM status is not full API, filesystem or content telemetry.

• Record the lab scope, collector version, effective configuration and expected source fields before testing.
• Use an approved benign action or read-only snapshot appropriate to this type. For destructive, privileged or physical effects, use a reviewed fixture or existing authorized evidence instead of causing the effect.
• Verify the native source record locally and at the collector; compare timestamps, identity, object, action/result and the type-specific fields listed below. Save a redacted real capture separately from the synthetic example.
• Check a normal baseline and collector-loss case. Fixture parsing proves parser behavior only; it does not prove sensor coverage or malicious-behavior detection.

Primary sources

• Android logcat and access limits
• Android dumpsys
• Android runtime permission requests