auren-research/cyber-sec huggingface dataset:
type: attack-pattern
spec_version: 2.1
id: attack-pattern--693cdbff-ea73-49c6-ac3f-91e7285c31d1
created: 2022-03-30T13:59:50.479Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1623/001
external_id: T1623.001
source_name: Samsung Knox Mobile Threat Defense
description: Samsung Knox Partner Program. (n.d.). Knox for Mobile Threat Defense. Retrieved March 30, 2022.
url: https://partner.samsungknox.com/mtd
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:48:54.078Z
name: Unix Shell
description: Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the underlying command prompts on Android and iOS devices. Unix shells can control every aspect of a system, with certain commands requiring elevated privileges that are only accessible if the device has been rooted or jailbroken. 

Unix shells also support scripts that enable sequential execution of commands as well as other typical programming operations such as conditionals and loops. Common uses of shell scripts include long or repetitive tasks, or the need to run the same set of commands on multiple systems. 

Adversaries may abuse Unix shells to execute various commands or payloads. Interactive shells may be accessed through command and control channels or during lateral movement such as with SSH. Adversaries may also leverage shell scripts to deliver and execute multiple commands on victims or as part of payloads used for persistence. 

If the device has been rooted or jailbroken, adversaries may locate and invoke a superuser binary to elevate their privileges and interact with the system as the root user. This dangerous level of permissions allows the adversary to run special commands and modify protected system files. 
kill_chain_phases: kill_chain_name: mitre-mobile-attack
phase_name: execution
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
iOS
x_mitre_version: 1.2
x_mitre_tactic_type: Post-Adversary Device Access
type: attack-pattern
spec_version: 2.1
id: attack-pattern--6a3f6490-9c44-40de-b059-e5940f246673
created: 2017-10-25T14:48:33.158Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1437
external_id: T1437
source_name: NIST Mobile Threat Catalogue
url: https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-29.html
external_id: APP-29
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:48:54.576Z
name: Application Layer Protocol
description: Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the mobile device, and often the results of those commands, will be embedded within the protocol traffic between the mobile device and server. 

Adversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, or DNS.
kill_chain_phases: kill_chain_name: mitre-mobile-attack
phase_name: command-and-control
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
iOS
x_mitre_version: 1.2
x_mitre_tactic_type: Post-Adversary Device Access
type: attack-pattern
spec_version: 2.1
id: attack-pattern--6b846ad0-cc20-4db6-aa34-91561397c5e2
created: 2017-10-25T14:48:11.861Z
revoked: yes
external_references: source_name: mitre-mobile-attack
url: https://attack.mitre.org/techniques/T1431
external_id: T1431
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:48:55.097Z
name: App Delivered via Web Download
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_version: 1.0
type: attack-pattern
spec_version: 2.1
id: attack-pattern--6c49d50f-494d-4150-b774-a655022d20a6
created: 2017-10-25T14:48:14.460Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1407
external_id: T1407
source_name: FireEye-JSPatch
description: Jing Xie, Zhaofeng Chen, Jimmy Su. (2016, January 27). HOT OR NOT? THE BENEFITS AND RISKS OF IOS REMOTE HOT PATCHING. Retrieved December 9, 2016.
url: https://www.fireeye.com/blog/threat-research/2016/01/hot_or_not_the_bene.html
source_name: NIST Mobile Threat Catalogue
url: https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-20.html
external_id: APP-20
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:48:55.445Z
name: Download New Code at Runtime
description: Adversaries may download and execute dynamic code not included in the original application package after installation. This technique is primarily used to evade static analysis checks and pre-publication scans in official app stores. In some cases, more advanced dynamic or behavioral analysis techniques could detect this behavior. However, in conjunction with [Execution Guardrails](https://attack.mitre.org/techniques/T1627) techniques, detecting malicious code downloaded after installation could be difficult.

On Android, dynamic code could include native code, Dalvik code, or JavaScript code that utilizes Android WebView’s `JavascriptInterface` capability. 

On iOS, dynamic code could be downloaded and executed through 3rd party libraries such as JSPatch. (Citation: FireEye-JSPatch) 
kill_chain_phases: kill_chain_name: mitre-mobile-attack
phase_name: defense-evasion
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
iOS
x_mitre_version: 1.5
x_mitre_tactic_type: Post-Adversary Device Access
modified: 2025-02-27T22:56:19.681Z
name: Exploitation for Initial Access
description: Adversaries may exploit software vulnerabilities to gain initial access to a mobile device. 

This can be accomplished in a variety of ways. Vulnerabilities may be present in the applications, the services, the underlying operating system, or the kernel itself. Several well-known mobile device exploits exist, including FORCEDENTRY, StageFright, and BlueBorne. Furthermore, some exploits may be possible to exploit without any user interaction (i.e. zero-click exploits, see [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1658)), making them particularly dangerous. Mobile operating system vendors are typically very quick to patch such critical bugs, ensuring only a small window where they can be exploited. 
kill_chain_phases: kill_chain_name: mitre-mobile-attack
phase_name: initial-access
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: no
x_mitre_platforms: Android
iOS
x_mitre_version: 1.1
type: attack-pattern
spec_version: 2.1
id: attack-pattern--6ecbc2eb-e85a-440a-ab68-4d98f8d56fbe
created: 2023-12-05T22:14:54.813Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1664
external_id: T1664
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: attack-pattern
spec_version: 2.1
id: attack-pattern--6f86d346-f092-4abc-80df-8558a90c426a
created: 2017-10-25T14:48:21.023Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: yes
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1468
external_id: T1468
source_name: Krebs-Location
description: Brian Krebs. (2018, May 17). Tracking Firm LocationSmart Leaked Location Data for Customers of All Major U.S. Mobile Carriers Without Consent in Real Time Via Its Web Site. Retrieved November 8, 2018.
url: https://krebsonsecurity.com/2018/05/tracking-firm-locationsmart-leaked-location-data-for-customers-of-all-major-u-s-mobile-carriers-in-real-time-via-its-web-site/
source_name: NIST Mobile Threat Catalogue
url: https://pages.nist.gov/mobile-threat-catalogue/ecosystem-threats/ECO-5.html
external_id: ECO-5
source_name: NIST Mobile Threat Catalogue
url: https://pages.nist.gov/mobile-threat-catalogue/emm-threats/EMM-7.html
external_id: EMM-7
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:48:55.981Z
name: Remotely Track Device Without Authorization
description: An adversary who is able to obtain unauthorized access to or misuse authorized access to cloud services (e.g. Google's Android Device Manager or Apple iCloud's Find my iPhone) or to an enterprise mobility management (EMM) / mobile device management (MDM) server console could use that access to track mobile devices.(Citation: Krebs-Location)
kill_chain_phases: kill_chain_name: mitre-mobile-attack
phase_name: remote-service-effects
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
iOS
x_mitre_version: 1.1
x_mitre_tactic_type: Without Adversary Device Access
type: attack-pattern
spec_version: 2.1
id: attack-pattern--6ffad4be-bfe0-424f-abde-4d9a84a800ad
created: 2022-03-30T17:53:35.582Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1633/001
external_id: T1633.001
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:48:56.336Z
name: System Checks
description: Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behavior after checking for the presence of artifacts indicative of a virtual environment or sandbox. If the adversary detects a virtual environment, they may alter their malware’s behavior to disengage from the victim or conceal the core functions of the implant. They may also search for virtualization artifacts before dropping secondary or additional payloads. 

Checks could include generic system properties such as host/domain name and samples of network traffic. Adversaries may also check the network adapters addresses, CPU core count, and available memory/drive size. 

Hardware checks, such as the presence of motion sensors, could also be used to gather evidence that can be indicative a virtual environment. Adversaries may also query for specific readings from these devices. 
kill_chain_phases: kill_chain_name: mitre-mobile-attack
phase_name: defense-evasion
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
iOS
x_mitre_version: 1.1
x_mitre_tactic_type: Post-Adversary Device Access
type: attack-pattern
spec_version: 2.1
id: attack-pattern--702055ac-4e54-4ae9-9527-e23a38e0b160
created: 2017-10-25T14:48:15.402Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1409
external_id: T1409
source_name: SWB Exodus March 2019
description: Security Without Borders. (2019, March 29). Exodus: New Android Spyware Made in Italy. Retrieved November 17, 2024.
url: https://web.archive.org/web/20200314194610/https://securitywithoutborders.org/blog/2019/03/29/exodus.html
source_name: NIST Mobile Threat Catalogue
url: https://pages.nist.gov/mobile-threat-catalogue/authentication-threats/AUT-0.html
external_id: AUT-0
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:48:56.509Z
name: Stored Application Data
description: Adversaries may try to access and collect application data resident on the device. Adversaries often target popular applications, such as Facebook, WeChat, and Gmail.(Citation: SWB Exodus March 2019) 

 

Due to mobile OS sandboxing, this technique is only possible in three scenarios: 

 

* An application stores files in unprotected external storage 
* An application stores files in its internal storage directory with insecure permissions (e.g. 777) 
* The adversary gains root permissions on the device 
kill_chain_phases: kill_chain_name: mitre-mobile-attack
phase_name: collection
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
iOS
x_mitre_version: 3.1
x_mitre_tactic_type: Post-Adversary Device Access
type: attack-pattern
spec_version: 2.1
id: attack-pattern--73c26732-6422-4081-8b63-6d0ae93d449e
created: 2019-08-08T18:34:14.178Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1513
external_id: T1513
source_name: Android ScreenCap2 2019
description: Android Developers. (n.d.). Android Debug Bridge (adb). Retrieved August 8, 2019.
url: https://developer.android.com/studio/command-line/adb
source_name: Android ScreenCap1 2019
description: Android Developers. (n.d.). Android MediaProjectionManager. Retrieved August 8, 2019.
url: https://developer.android.com/reference/android/media/projection/MediaProjectionManager
source_name: Lookout-Monokle
description: Bauer A., Kumar A., Hebeisen C., et al. (2019, July). Monokle: The Mobile Surveillance Tooling of the Special Technology Center. Retrieved September 4, 2019.
url: https://www.lookout.com/documents/threat-reports/lookout-discovers-monokle-threat-report.pdf
source_name: Fortinet screencap July 2019
description: Dario Durando. (2019, July 3). BianLian: A New Wave Emerges. Retrieved September 4, 2019.
url: https://www.fortinet.com/blog/threat-research/new-wave-bianlian-malware.html
source_name: Trend Micro ScreenCap July 2015
description: Zhang, V. (2015, July 21). Hacking Team RCSAndroid Spying Tool Listens to Calls; Roots Devices to Get In. Retrieved August 8, 2019.
url: https://blog.trendmicro.com/trendlabs-security-intelligence/hacking-team-rcsandroid-spying-tool-listens-to-calls-roots-devices-to-get-in/
source_name: NIST Mobile Threat Catalogue
url: https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-40.html
external_id: APP-40
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:48:57.610Z
name: Screen Capture
description: Adversaries may use screen capture to collect additional information about a target device, such as applications running in the foreground, user data, credentials, or other sensitive information. Applications running in the background can capture screenshots or videos of another application running in the foreground by using the Android `MediaProjectionManager` (generally requires the device user to grant consent).(Citation: Fortinet screencap July 2019)(Citation: Android ScreenCap1 2019) Background applications can also use Android accessibility services to capture screen contents being displayed by a foreground application.(Citation: Lookout-Monokle) An adversary with root access or Android Debug Bridge (adb) access could call the Android `screencap` or `screenrecord` commands.(Citation: Android ScreenCap2 2019)(Citation: Trend Micro ScreenCap July 2015) 
kill_chain_phases: kill_chain_name: mitre-mobile-attack
phase_name: collection
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
x_mitre_version: 1.3
x_mitre_tactic_type: Post-Adversary Device Access
type: attack-pattern
spec_version: 2.1
id: attack-pattern--74e6003f-c7f4-4047-983b-708cc19b96b6
created: 2022-04-06T13:39:39.779Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1641/001
external_id: T1641.001
source_name: ESET Clipboard Modification February 2019
description: ESET. (2019, February 11). First clipper malware discovered on Google Play.. Retrieved July 26, 2019.
url: https://www.eset.com/uk/about/newsroom/press-releases/first-clipper-malware-discovered-on-google-play-1/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:48:57.794Z
name: Transmitted Data Manipulation
description: Adversaries may alter data en route to storage or other systems in order to manipulate external outcomes or hide activity. By manipulating transmitted data, adversaries may attempt to affect a business process, organizational understanding, or decision making.

Manipulation may be possible over a network connection or between system processes where there is an opportunity to deploy a tool that will intercept and change information. The type of modification and the impact it will have depends on the target transmission mechanism as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system, typically gained through a prolonged information gathering campaign, in order to have the desired impact.

One method to achieve [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1641/001) is by modifying the contents of the device clipboard. Malicious applications may monitor clipboard activity through the `ClipboardManager.OnPrimaryClipChangedListener` interface on Android to determine when clipboard contents have changed. Listening to clipboard activity, reading clipboard contents, and modifying clipboard contents requires no explicit application permissions and can be performed by applications running in the background. However, this behavior has changed with the release of Android 10.

Adversaries may use [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1641/001) to replace text prior to being pasted. For example, replacing a copied Bitcoin wallet address with a wallet address that is under adversarial control.

[Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1641/001) was seen within the Android/Clipper.C trojan. This sample was detected by ESET in an application distributed through the Google Play Store targeting cryptocurrency wallet numbers.(Citation: ESET Clipboard Modification February 2019)
kill_chain_phases: kill_chain_name: mitre-mobile-attack
phase_name: impact
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
x_mitre_version: 1.1
x_mitre_tactic_type: Post-Adversary Device Access
type: attack-pattern
spec_version: 2.1
id: attack-pattern--76c12fc8-a4eb-45d6-a3b7-e371a7248f69
created: 2017-10-25T14:48:07.460Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: yes
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1452
external_id: T1452
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-18T18:00:40.278Z
name: Manipulate App Store Rankings or Ratings
description: An adversary could use access to a compromised device's credentials to attempt to manipulate app store rankings or ratings by triggering application downloads or posting fake reviews of applications. This technique likely requires privileged access (a rooted or jailbroken device).
kill_chain_phases: kill_chain_name: mitre-mobile-attack
phase_name: impact
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
iOS
x_mitre_version: 1.0
x_mitre_tactic_type: Post-Adversary Device Access
type: attack-pattern
spec_version: 2.1
id: attack-pattern--77e30eee-fd48-40b4-99ec-73e97c158b58
created: 2017-10-25T14:48:32.008Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: yes
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1416
external_id: T1416
source_name: Trend Micro iOS URL Hijacking
description: L. Wu, Y. Zhou, M. Li. (2019, July 12). iOS URL Scheme Susceptible to Hijacking. Retrieved September 11, 2020.
url: https://blog.trendmicro.com/trendlabs-security-intelligence/ios-url-scheme-susceptible-to-hijacking/
source_name: IETF-PKCE
description: N. Sakimura, J. Bradley, and N. Agarwal. (2015, September). IETF RFC 7636: Proof Key for Code Exchange by OAuth Public Clients. Retrieved December 21, 2016.
url: https://tools.ietf.org/html/rfc7636
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:48:58.596Z
name: URI Hijacking
description: Adversaries may register Uniform Resource Identifiers (URIs) to intercept sensitive data.

Applications regularly register URIs with the operating system to act as a response handler for various actions, such as logging into an app using an external account via single sign-on. This allows redirections to that specific URI to be intercepted by the application. If a malicious application were to register for a URI that was already in use by a genuine application, the malicious application may be able to intercept data intended for the genuine application or perform a phishing attack against the genuine application. Intercepted data may include OAuth authorization codes or tokens that could be used by the malicious application to gain access to resources.(Citation: Trend Micro iOS URL Hijacking)(Citation: IETF-PKCE)
kill_chain_phases: kill_chain_name: mitre-mobile-attack
phase_name: credential-access
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
iOS
x_mitre_version: 2.0
x_mitre_tactic_type: Post-Adversary Device Access