auren-research/cyber-sec huggingface dataset:
type: attack-pattern
spec_version: 2.1
id: attack-pattern--0f4fb01b-d57a-4375-b7a2-342c9d3248f7
created: 2022-04-05T19:49:58.938Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1430/002
external_id: T1430.002
source_name: 3GPP-Security
description: 3GPP. (2000, January). A Guide to 3rd Generation Security. Retrieved December 19, 2016.
url: http://www.3gpp.org/ftp/tsg_sa/wg3_security/_specs/33900-120.pdf
source_name: CSRIC5-WG10-FinalReport
description: Communications Security, Reliability, Interoperability Council (CSRIC). (2017, March). Working Group 10 Legacy Systems Risk Reductions Final Report. Retrieved May 24, 2017.
url: https://web.archive.org/web/20200330012714/https://www.fcc.gov/files/csric5-wg10-finalreport031517pdf
source_name: CSRIC-WG1-FinalReport
description: CSRIC-WG1-FinalReport
source_name: Positive-SS7
description: Positive Technologies. (n.d.). SS7 Attack Discovery. Retrieved December 19, 2016.
url: https://www.ptsecurity.com/upload/ptcom/PT-SS7-AD-Data-Sheet-eng.pdf
source_name: Engel-SS7-2008
description: Tobias Engel. (2008, December). Locating Mobile Phones using SS7. Retrieved December 19, 2016.
url: https://www.youtube.com/watch?v=q0n5ySqbfdI
source_name: Engel-SS7
description: Tobias Engel. (2014, December). SS7: Locate. Track. Manipulate.. Retrieved December 19, 2016.
url: https://berlin.ccc.de/~tobias/31c3-ss7-locate-track-manipulate.pdf
source_name: NIST Mobile Threat Catalogue
url: https://pages.nist.gov/mobile-threat-catalogue/cellular-threats/CEL-38.html
external_id: CEL-38
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:48:24.309Z
name: Impersonate SS7 Nodes
description: Adversaries may exploit the lack of authentication in signaling system network nodes to track the location of mobile devices by impersonating a node.(Citation: Engel-SS7)(Citation: Engel-SS7-2008)(Citation: 3GPP-Security)(Citation: Positive-SS7)(Citation: CSRIC5-WG10-FinalReport) 

 

By providing the victim’s MSISDN (phone number) and impersonating network internal nodes to query subscriber information from other nodes, adversaries may use data collected from each hop to eventually determine the device’s geographical cell area or nearest cell tower.(Citation: Engel-SS7)
kill_chain_phases: kill_chain_name: mitre-mobile-attack
phase_name: collection
kill_chain_name: mitre-mobile-attack
phase_name: discovery
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
iOS
x_mitre_version: 1.1
type: attack-pattern
spec_version: 2.1
id: attack-pattern--114fed8b-7eed-4136-8b9c-411c5c7fff4b
created: 2023-07-12T20:45:14.704Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1655/001
external_id: T1655.001
source_name: NIST Mobile Threat Catalogue
url: https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-14.html
external_id: APP-14
source_name: NIST Mobile Threat Catalogue
url: https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-31.html
external_id: APP-31
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T21:21:44.590Z
name: Match Legitimate Name or Location
description: Adversaries may match or approximate the name or location of legitimate files or resources when naming/placing them. This is done for the sake of evading defenses and observation. This may be done by giving artifacts the name and icon of a legitimate, trusted application (i.e., Settings), or using a package name that matches legitimate, trusted applications (i.e., `com.google.android.gm`). 

Adversaries may also use the same icon of the file or application they are trying to mimic.

kill_chain_phases: kill_chain_name: mitre-mobile-attack
phase_name: defense-evasion
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Ford Qin, Trend Micro
Liran Ravich, CardinalOps
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
iOS
x_mitre_version: 1.0
type: attack-pattern
spec_version: 2.1
id: attack-pattern--11bd699b-f2c2-4e48-bf46-fb3f8acd9799
created: 2017-10-25T14:48:30.462Z
revoked: yes
external_references: source_name: mitre-mobile-attack
url: https://attack.mitre.org/techniques/T1425
external_id: T1425
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:48:25.548Z
name: Insecure Third-Party Libraries
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_version: 1.0
type: attack-pattern
spec_version: 2.1
id: attack-pattern--11c2c2b7-1fd4-408f-bc2e-fe772ef9df5e
created: 2022-04-01T12:36:41.507Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1636
external_id: T1636
source_name: NIST Mobile Threat Catalogue
url: https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-13.html
external_id: APP-13
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:48:25.642Z
name: Protected User Data
description: Adversaries may utilize standard operating system APIs to collect data from permission-backed data stores on a device, such as the calendar or contact list. These permissions need to be declared ahead of time. On Android, they must be included in the application’s manifest. On iOS, they must be included in the application’s `Info.plist` file. 

 

In almost all cases, the user is required to grant access to the data store that the application is trying to access. In recent OS versions, vendors have introduced additional privacy controls for users, such as the ability to grant permission to an application only while the application is being actively used by the user. 

 

If the device has been jailbroken or rooted, an adversary may be able to access [Protected User Data](https://attack.mitre.org/techniques/T1636) without the user’s knowledge or approval. 
kill_chain_phases: kill_chain_name: mitre-mobile-attack
phase_name: collection
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
iOS
x_mitre_version: 1.1
x_mitre_tactic_type: Post-Adversary Device Access
type: attack-pattern
spec_version: 2.1
id: attack-pattern--16d73b64-5681-4ea0-9af4-4ad86f7c96e8
created: 2022-04-05T20:15:43.636Z
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1521/002
external_id: T1521.002
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:48:26.898Z
name: Asymmetric Cryptography
description: Adversaries may employ a known asymmetric encryption algorithm to conceal command and control traffic, rather than relying on any inherent protections provided by a communication protocol. Asymmetric cryptography, also known as public key cryptography, uses a keypair per party: one public that can be freely distributed, and one private that should not be distributed. Due to how asymmetric algorithms work, the sender encrypts data with the receiver’s public key and the receiver decrypts the data with their private key. This ensures that only the intended recipient can read the encrypted data. Common public key encryption algorithms include RSA, ElGamal, and ECDSA.

For efficiency, many protocols (including SSL/TLS) use symmetric cryptography once a connection is established, but use asymmetric cryptography to establish or transmit a key. As such, these protocols are classified as [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1521/002).
kill_chain_phases: kill_chain_name: mitre-mobile-attack
phase_name: command-and-control
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
iOS
x_mitre_version: 1.0
x_mitre_tactic_type: Post-Adversary Device Access
type: attack-pattern
spec_version: 2.1
id: attack-pattern--198ce408-1470-45ee-b47f-7056050d4fc2
created: 2017-10-25T14:48:28.067Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1418
external_id: T1418
source_name: NIST Mobile Threat Catalogue
url: https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-12.html
external_id: APP-12
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:48:27.789Z
name: Software Discovery
description: Adversaries may attempt to get a listing of applications that are installed on a device. Adversaries may use the information from [Software Discovery](https://attack.mitre.org/techniques/T1418) during automated discovery to shape follow-on behaviors, including whether or not to fully infect the target and/or attempts specific actions. 

 

Adversaries may attempt to enumerate applications for a variety of reasons, such as figuring out what security measures are present or to identify the presence of target applications. 
kill_chain_phases: kill_chain_name: mitre-mobile-attack
phase_name: discovery
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
iOS
x_mitre_version: 2.1
x_mitre_tactic_type: Post-Adversary Device Access
type: attack-pattern
spec_version: 2.1
id: attack-pattern--1b51f5bc-b97a-498a-8dbd-bc6b1901bf19
created: 2017-10-25T14:48:33.926Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1424
external_id: T1424
source_name: Android-SELinuxChanges
description: Various. (2016, March 31). Overly restrictive SELinux filesystem permissions in Android N. Retrieved December 21, 2016.
url: https://code.google.com/p/android/issues/detail?id=205565
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:48:28.244Z
name: Process Discovery
description: Adversaries may attempt to get information about running processes on a device. Information obtained could be used to gain an understanding of common software/applications running on devices within a network. Adversaries may use the information from [Process Discovery](https://attack.mitre.org/techniques/T1424) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. 

 

Recent Android security enhancements have made it more difficult to obtain a list of running processes. On Android 7 and later, there is no way for an application to obtain the process list without abusing elevated privileges. This is due to the Android kernel utilizing the `hidepid` mount feature. Prior to Android 7, applications could utilize the `ps` command or examine the `/proc` directory on the device.(Citation: Android-SELinuxChanges) 

 

In iOS, applications have previously been able to use the `sysctl` command to obtain a list of running processes. This functionality has been removed in later iOS versions. 
kill_chain_phases: kill_chain_name: mitre-mobile-attack
phase_name: discovery
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
iOS
x_mitre_version: 2.1
x_mitre_tactic_type: Post-Adversary Device Access
type: attack-pattern
spec_version: 2.1
id: attack-pattern--1d1b1558-c833-482e-aabb-d07ef6eae63d
created: 2022-04-01T13:12:23.522Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1636/002
external_id: T1636.002
source_name: NIST Mobile Threat Catalogue
url: https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-13.html
external_id: APP-13
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:48:29.311Z
name: Call Log
description: Adversaries may utilize standard operating system APIs to gather call log data. On Android, this can be accomplished using the Call Log Content Provider. iOS provides no standard API to access the call log. 

 

If the device has been jailbroken or rooted, an adversary may be able to access the [Call Log](https://attack.mitre.org/techniques/T1636/002) without the user’s knowledge or approval. 
kill_chain_phases: kill_chain_name: mitre-mobile-attack
phase_name: collection
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
iOS
x_mitre_version: 1.1
x_mitre_tactic_type: Post-Adversary Device Access
type: attack-pattern
spec_version: 2.1
id: attack-pattern--1d44f529-6fe6-489f-8a01-6261ac43f05e
created: 2022-03-31T19:50:45.752Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1418/001
external_id: T1418.001
source_name: NIST Mobile Threat Catalogue
url: https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-12.html
external_id: APP-12
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:48:29.485Z
name: Security Software Discovery
description: Adversaries may attempt to get a listing of security applications and configurations that are installed on a device. This may include things such as mobile security products. Adversaries may use the information from [Security Software Discovery](https://attack.mitre.org/techniques/T1418/001) during automated discovery to shape follow-on behaviors, including whether or not to fully infect the target and/or attempt specific actions. 
kill_chain_phases: kill_chain_name: mitre-mobile-attack
phase_name: discovery
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
iOS
x_mitre_version: 1.1
x_mitre_tactic_type: Post-Adversary Device Access
type: attack-pattern
spec_version: 2.1
id: attack-pattern--1f96d624-8409-4472-ad8a-30618ee6b2e2
created: 2017-10-25T14:48:10.699Z
revoked: yes
external_references: source_name: mitre-mobile-attack
url: https://attack.mitre.org/techniques/T1434
external_id: T1434
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:48:30.211Z
name: App Delivered via Email Attachment
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_version: 1.0
type: attack-pattern
spec_version: 2.1
id: attack-pattern--1ff89c1b-7615-4fe8-b9cb-63aaf52e6dee
created: 2022-03-30T19:05:17.048Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1631/001
external_id: T1631.001
source_name: BH Linux Inject
description: Colgan, T. (2015, August 15). Linux-Inject. Retrieved February 21, 2020.
url: https://github.com/gaffe23/linux-inject/blob/master/slides_BHArsenal2015.pdf
source_name: Medium Ptrace JUL 2018
description: Jain, S. (2018, July 25). Code injection in running process using ptrace. Retrieved February 21, 2020.
url: https://medium.com/@jain.sm/code-injection-in-running-process-using-ptrace-d3ea7191a4be
source_name: PTRACE man
description: Kerrisk, M. (2020, February 9). PTRACE(2) - Linux Programmer's Manual. Retrieved February 21, 2020.
url: http://man7.org/linux/man-pages/man2/ptrace.2.html
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:48:30.394Z
name: Ptrace System Calls
description: Adversaries may inject malicious code into processes via ptrace (process trace) system calls in order to evade process-based defenses as well as possibly elevate privileges. Ptrace system call injection is a method of executing arbitrary code in the address space of a separate live process. 

Ptrace system call injection involves attaching to and modifying a running process. The ptrace system call enables a debugging process to observe and control another process (and each individual thread), including changing memory and register values.(Citation: PTRACE man) Ptrace system call injection is commonly performed by writing arbitrary code into a running process (e.g., by using `malloc`) then invoking that memory with `PTRACE_SETREGS` to set the register containing the next instruction to execute. Ptrace system call injection can also be done with `PTRACE_POKETEXT`/`PTRACE_POKEDATA`, which copy data to a specific address in the target process's memory (e.g., the current address of the next instruction).(Citation: PTRACE man)(Citation: Medium Ptrace JUL 2018) 

Ptrace system call injection may not be possible when targeting processes with high-privileges, and on some systems those that are non-child processes.(Citation: BH Linux Inject) 

Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via ptrace system call injection may also evade detection from security products since the execution is masked under a legitimate process.
kill_chain_phases: kill_chain_name: mitre-mobile-attack
phase_name: defense-evasion
kill_chain_name: mitre-mobile-attack
phase_name: privilege-escalation
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
iOS
x_mitre_version: 1.1
x_mitre_tactic_type: Post-Adversary Device Access
type: attack-pattern
spec_version: 2.1
id: attack-pattern--20b0931a-8952-42ca-975f-775bad295f1a
created: 2022-04-01T18:42:22.117Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1629
external_id: T1629
source_name: Samsung Knox Mobile Threat Defense
description: Samsung Knox Partner Program. (n.d.). Knox for Mobile Threat Defense. Retrieved March 30, 2022.
url: https://partner.samsungknox.com/mtd
source_name: NIST Mobile Threat Catalogue
url: https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-22.html
external_id: APP-22
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:48:30.589Z
name: Impair Defenses
description: Adversaries may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms. This not only involves impairing preventative defenses, such as anti-virus, but also detection capabilities that defenders can use to audit activity and identify malicious behavior. This may span both native defenses as well as supplemental capabilities installed by users or mobile endpoint administrators.
kill_chain_phases: kill_chain_name: mitre-mobile-attack
phase_name: defense-evasion
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
x_mitre_version: 1.1
x_mitre_tactic_type: Post-Adversary Device Access
type: attack-pattern
spec_version: 2.1
id: attack-pattern--2204c371-6100-4ae0-82f3-25c07c29772a
created: 2017-10-25T14:48:08.613Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1453
external_id: T1453
source_name: Google_AndroidAcsOverview
description: Google. (n.d.). Android accessibility overview. Retrieved April 17, 2025.
url: https://support.google.com/accessibility/android/answer/6006564?hl=en&ref_topic=6007234&sjid=9936713164149272548-NA
source_name: SahinSRLabs_FluBot_Dec2021
description: Şahin, Erdoğan Yağız. (2021, December 21). When your phone gets sick: FluBot abuses Accessibility features to steal data. Retrieved April 16, 2025.
url: https://www.srlabs.de/blog-post/flubot-abuses-accessibility-features-to-steal-data
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-27T17:12:01.143Z
name: Abuse Accessibility Features
description: Adversaries may abuse accessibility features in Android devices to steal sensitive data and to spread malware to other devices. Accessibility features in Android are designed to assist users with disabilities, performing a variety of tasks, such as using Action Blocks to control lightbulbs, and changing the device’s user interface, such as changing the font size and adjusting contract or colors.(Citation: Google_AndroidAcsOverview) 

One example of how adversaries abuse accessibility features is overlaying an HTML object mimicking a legitimate login screen. The user types their credentials in the overlay HTML object, which is then sent to the adversaries.(Citation: SahinSRLabs_FluBot_Dec2021) 

Another example is a malicious accessibility feature acting as a keylogger. The keylogger monitors changes on the EditText fields and sends it to the adversaries.(Citation: SahinSRLabs_FluBot_Dec2021) This method of attack is also described in [Keylogging](https://attack.mitre.org/techniques/T1417/001); whereas [Abuse Accessibility Features](https://attack.mitre.org/techniques/T1453) captures the overall abuse of accessibility features. 
kill_chain_phases: kill_chain_name: mitre-mobile-attack
phase_name: collection
kill_chain_name: mitre-mobile-attack
phase_name: credential-access
x_mitre_attack_spec_version: 3.3.0
x_mitre_contributors: Lukáš Štefanko, ESET
Liran Ravich, CardinalOps
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
x_mitre_version: 3.0