API calls utilized by an application that could indicate malicious activity
| Name | Channel |
|---|---|
| android:logcat | SELinux AVC related to execute_no_trans/execmem after decode/unpack activity by the same app UID |
| Application Vetting | None |
| iOS:unifiedlog | Repeated sandbox or policy violations by a single process or app bundle (for example, deny rules) followed by successful access to resources or APIs that normally require higher privileges |
| iOS:unifiedlog | mmap with PROT_EXEC and PROT_WRITE by sandboxed app |