auren-research/cyber-sec huggingface dataset:
type: attack-pattern
spec_version: 2.1
id: attack-pattern--498e7b81-238d-404c-aa5e-332904d63286
created: 2022-03-30T20:31:16.624Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1627
external_id: T1627
source_name: SWB Exodus March 2019
description: Security Without Borders. (2019, March 29). Exodus: New Android Spyware Made in Italy. Retrieved November 17, 2024.
url: https://web.archive.org/web/20200314194610/https://securitywithoutborders.org/blog/2019/03/29/exodus.html
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:48:44.210Z
name: Execution Guardrails
description: Adversaries may use execution guardrails to constrain execution or actions based on adversary supplied and environment specific conditions that are expected to be present on the target. Guardrails ensure that a payload only executes against an intended target and reduces collateral damage from an adversary’s campaign. Values an adversary can provide about a target system or environment to use as guardrails may include environment information such as location.(Citation: SWB Exodus March 2019)

Guardrails can be used to prevent exposure of capabilities in environments that are not intended to be compromised or operated within. This use of guardrails is distinct from typical [System Checks](https://attack.mitre.org/techniques/T1633/001). While use of [System Checks](https://attack.mitre.org/techniques/T1633/001) may involve checking for known sandbox values and continuing with execution only if there is no match, the use of guardrails will involve checking for an expected target-specific value and only continuing with execution if there is such a match.
kill_chain_phases: kill_chain_name: mitre-mobile-attack
phase_name: defense-evasion
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
iOS
x_mitre_version: 1.1
x_mitre_tactic_type: Post-Adversary Device Access
type: attack-pattern
spec_version: 2.1
id: attack-pattern--4e6620ac-c30c-4f6d-918e-fa20cae7c1ce
created: 2017-10-25T14:48:11.535Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: yes
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1432
external_id: T1432
source_name: NIST Mobile Threat Catalogue
url: https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-13.html
external_id: APP-13
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:48:45.330Z
name: Access Contact List
description: An adversary could call standard operating system APIs from a malicious application to gather contact list (i.e., address book) data, or with escalated privileges could directly access files containing contact list data.
kill_chain_phases: kill_chain_name: mitre-mobile-attack
phase_name: collection
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
iOS
x_mitre_version: 1.0
x_mitre_tactic_type: Post-Adversary Device Access
type: attack-pattern
spec_version: 2.1
id: attack-pattern--4f14e30b-8b57-4a7b-9093-2c0778ea99cf
created: 2022-03-30T19:53:27.791Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1645
external_id: T1645
source_name: Android-VerifiedBoot
description: Android. (n.d.). Verified Boot. Retrieved December 21, 2016.
url: https://source.android.com/security/verifiedboot/
source_name: NIST Mobile Threat Catalogue
url: https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-27.html
external_id: APP-27
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:48:45.611Z
name: Compromise Client Software Binary
description: Adversaries may modify system software binaries to establish persistent access to devices. System software binaries are used by the underlying operating system and users over adb or terminal emulators. 

Adversaries may make modifications to client software binaries to carry out malicious tasks when those binaries are executed. For example, malware may come with a pre-compiled malicious binary intended to overwrite the genuine one on the device. Since these binaries may be routinely executed by the system or user, the adversary can leverage this for persistent access to the device. 
kill_chain_phases: kill_chain_name: mitre-mobile-attack
phase_name: persistence
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
iOS
x_mitre_version: 1.1
x_mitre_tactic_type: Post-Adversary Device Access
type: attack-pattern
spec_version: 2.1
id: attack-pattern--51636761-2e35-44bf-9e56-e337adf97174
created: 2022-03-30T19:20:37.864Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1406/002
external_id: T1406.002
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:48:46.514Z
name: Software Packing
description: Adversaries may perform software packing to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. 

Utilities used to perform software packing are called packers. An example packer is FTT. A more comprehensive list of known packers is available, but adversaries may create their own packing techniques that do not leave the same artifacts as well-known packers to evade defenses.
kill_chain_phases: kill_chain_name: mitre-mobile-attack
phase_name: defense-evasion
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: iOS
Android
x_mitre_version: 1.1
x_mitre_tactic_type: Post-Adversary Device Access
type: attack-pattern
spec_version: 2.1
id: attack-pattern--51aedbd6-2837-4d15-aeb0-cb09f2bf22ac
created: 2017-10-25T14:48:16.288Z
revoked: yes
external_references: source_name: mitre-mobile-attack
url: https://attack.mitre.org/techniques/T1445
external_id: T1445
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:48:46.777Z
name: Abuse of iOS Enterprise App Signing Key
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_version: 1.0
type: attack-pattern
spec_version: 2.1
id: attack-pattern--52651225-0b3a-482d-aa7e-10618fd063b5
created: 2017-10-25T14:48:09.864Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: yes
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1450
external_id: T1450
source_name: 3GPP-Security
description: 3GPP. (2000, January). A Guide to 3rd Generation Security. Retrieved December 19, 2016.
url: http://www.3gpp.org/ftp/tsg_sa/wg3_security/_specs/33900-120.pdf
source_name: CSRIC5-WG10-FinalReport
description: Communications Security, Reliability, Interoperability Council (CSRIC). (2017, March). Working Group 10 Legacy Systems Risk Reductions Final Report. Retrieved May 24, 2017.
url: https://www.fcc.gov/files/csric5-wg10-finalreport031517pdf
source_name: CSRIC-WG1-FinalReport
description: CSRIC-WG1-FinalReport
source_name: Positive-SS7
description: Positive Technologies. (n.d.). SS7 Attack Discovery. Retrieved December 19, 2016.
url: https://www.ptsecurity.com/upload/ptcom/PT-SS7-AD-Data-Sheet-eng.pdf
source_name: Engel-SS7-2008
description: Tobias Engel. (2008, December). Locating Mobile Phones using SS7. Retrieved December 19, 2016.
url: https://www.youtube.com/watch?v=q0n5ySqbfdI
source_name: Engel-SS7
description: Tobias Engel. (2014, December). SS7: Locate. Track. Manipulate.. Retrieved December 19, 2016.
url: https://berlin.ccc.de/~tobias/31c3-ss7-locate-track-manipulate.pdf
source_name: NIST Mobile Threat Catalogue
url: https://pages.nist.gov/mobile-threat-catalogue/cellular-threats/CEL-38.html
external_id: CEL-38
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:48:47.128Z
name: Exploit SS7 to Track Device Location
description: An adversary could exploit signaling system vulnerabilities to track the location of mobile devices. (Citation: Engel-SS7) (Citation: Engel-SS7-2008) (Citation: 3GPP-Security) (Citation: Positive-SS7) (Citation: CSRIC5-WG10-FinalReport)
kill_chain_phases: kill_chain_name: mitre-mobile-attack
phase_name: network-effects
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
iOS
x_mitre_version: 1.1
x_mitre_tactic_type: Without Adversary Device Access
type: attack-pattern
spec_version: 2.1
id: attack-pattern--52eff1c7-dd30-4121-b762-24ae6fa61bbb
created: 2020-04-28T14:35:37.309Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1575
external_id: T1575
source_name: Google NDK Getting Started
description: Google. (2019, December 27). Getting Started with the NDK. Retrieved April 28, 2020.
url: https://developer.android.com/ndk/guides
source_name: MITRE App Vetting Effectiveness
description: M. Peck, C. Northern. (2016, August 22). Analyzing the Effectiveness of App Vetting Tools in the Enterprise. Retrieved April 28, 2020.
url: https://www.mitre.org/sites/default/files/publications/pr-16-4772-analyzing-effectiveness-mobile-app-vetting-tools-report.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:48:47.482Z
name: Native API
description: Adversaries may use Android’s Native Development Kit (NDK) to write native functions that can achieve execution of binaries or functions. Like system calls on a traditional desktop operating system, native code achieves execution on a lower level than normal Android SDK calls.

The NDK allows developers to write native code in C or C++ that is compiled directly to machine code, avoiding all intermediate languages and steps in compilation that higher level languages, like Java, typically have. The Java Native Interface (JNI) is the component that allows Java functions in the Android app to call functions in a native library.(Citation: Google NDK Getting Started)

Adversaries may also choose to use native functions to execute malicious code since native actions are typically much more difficult to analyze than standard, non-native behaviors.(Citation: MITRE App Vetting Effectiveness)
kill_chain_phases: kill_chain_name: mitre-mobile-attack
phase_name: defense-evasion
kill_chain_name: mitre-mobile-attack
phase_name: execution
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
x_mitre_version: 2.0
x_mitre_tactic_type: Post-Adversary Device Access
type: attack-pattern
spec_version: 2.1
id: attack-pattern--537ea573-8a1c-468c-956b-d16d2ed9d067
created: 2017-10-25T14:48:07.827Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1469
external_id: T1469
source_name: Honan-Hacking
description: Mat Honan. (2012, August 6). How Apple and Amazon Security Flaws Led to My Epic Hacking. Retrieved December 29, 2016.
url: https://www.wired.com/2012/08/apple-amazon-mat-honan-hacking/
source_name: NIST Mobile Threat Catalogue
url: https://pages.nist.gov/mobile-threat-catalogue/ecosystem-threats/ECO-5.html
external_id: ECO-5
source_name: NIST Mobile Threat Catalogue
url: https://pages.nist.gov/mobile-threat-catalogue/emm-threats/EMM-7.html
external_id: EMM-7
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:48:47.844Z
name: Remotely Wipe Data Without Authorization
description: An adversary who is able to obtain unauthorized access to or misuse authorized access to cloud services (e.g. Google's Android Device Manager or Apple iCloud's Find my iPhone) or to an EMM console could use that access to wipe enrolled devices (Citation: Honan-Hacking).
kill_chain_phases: kill_chain_name: mitre-mobile-attack
phase_name: remote-service-effects
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: yes
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
iOS
x_mitre_version: 1.0
x_mitre_tactic_type: Without Adversary Device Access
modified: 2023-09-28T17:02:58.893Z
name: Exploitation for Client Execution
description: Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to insecure coding practices that can lead to unanticipated behavior. Adversaries may take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility. 

Adversaries may use device-based zero-click exploits for code execution. These exploits are powerful because there is no user interaction required for code execution. 

### SMS/iMessage Delivery 

SMS and iMessage in iOS are common targets through [Drive-By Compromise](https://attack.mitre.org/techniques/T1456), [Phishing](https://attack.mitre.org/techniques/T1660), etc. Adversaries may use embed malicious links, files, etc. in SMS messages or iMessages. Mobile devices may be compromised through one-click exploits, where the victim must interact with a text message, or zero-click exploits, where no user interaction is required. 

### AirDrop 

Unique to iOS, AirDrop is a network protocol that allows iOS users to transfer files between iOS devices. Before patches from Apple were released, on iOS 13.4 and earlier, adversaries may force the Apple Wireless Direct Link (AWDL) interface to activate, then exploit a buffer overflow to gain access to the device and run as root without interaction from the user. 
kill_chain_phases: kill_chain_name: mitre-mobile-attack
phase_name: execution
x_mitre_contributors: Giorgi Gurgenidze, ISAC
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: no
x_mitre_platforms: Android
iOS
x_mitre_version: 1.0
x_mitre_tactic_type: Post-Adversary Device Access
type: attack-pattern
spec_version: 2.1
id: attack-pattern--5abfc5e6-3c56-49e7-ad72-502d01acf28b
created: 2023-08-23T22:13:27.313Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1658
external_id: T1658
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: attack-pattern
spec_version: 2.1
id: attack-pattern--5ca3c7ec-55b2-4587-9376-cf6c96f8047a
created: 2020-11-30T14:26:07.728Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1604
external_id: T1604
source_name: Threat Fabric Exobot
description: Threat Fabric. (2017, February). Exobot - Android banking Trojan on the rise. Retrieved October 29, 2020.
url: https://www.threatfabric.com/blogs/exobot_android_banking_trojan_on_the_rise.html
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:48:50.301Z
name: Proxy Through Victim
description: Adversaries may use a compromised device as a proxy server to the Internet. By utilizing a proxy, adversaries hide the true IP address of their C2 server and associated infrastructure from the destination of the network traffic. This masquerades an adversary’s traffic as legitimate traffic originating from the compromised device, which can evade IP-based restrictions and alerts on certain services, such as bank accounts and social media websites.(Citation: Threat Fabric Exobot)

The most common type of proxy is a SOCKS proxy. It can typically be implemented using standard OS-level APIs and 3rd party libraries with no indication to the user. On Android, adversaries can use the `Proxy` API to programmatically establish a SOCKS proxy connection, or lower-level APIs to interact directly with raw sockets.
kill_chain_phases: kill_chain_name: mitre-mobile-attack
phase_name: defense-evasion
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
x_mitre_version: 1.1
x_mitre_tactic_type: Post-Adversary Device Access
type: attack-pattern
spec_version: 2.1
id: attack-pattern--60623164-ccd8-4508-a141-b5a34820b3de
created: 2019-09-23T13:11:43.694Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: yes
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1520
external_id: T1520
source_name: Data Driven Security DGA
description: Jacobs, J. (2014, October 2). Building a DGA Classifier: Part 2, Feature Engineering. Retrieved February 18, 2019.
url: https://datadrivensecurity.info/blog/posts/2014/Oct/dga-part2/
source_name: securelist rotexy 2018
description: T. Shishkova, L. Pikman. (2018, November 22). The Rotexy mobile Trojan – banker and ransomware. Retrieved September 23, 2019.
url: https://securelist.com/the-rotexy-mobile-trojan-banker-and-ransomware/88893/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:48:50.736Z
name: Domain Generation Algorithms
description: Adversaries may use [Domain Generation Algorithms](https://attack.mitre.org/techniques/T1520) (DGAs) to procedurally generate domain names for command and control communication, and other uses such as malicious application distribution.(Citation: securelist rotexy 2018)

DGAs increase the difficulty for defenders to block, track, or take over the command and control channel, as there potentially could be thousands of domains that malware can check for instructions.
kill_chain_phases: kill_chain_name: mitre-mobile-attack
phase_name: command-and-control
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
iOS
x_mitre_version: 1.0
x_mitre_tactic_type: Post-Adversary Device Access
type: attack-pattern
spec_version: 2.1
id: attack-pattern--62adb627-f647-498e-b4cc-41499361bacb
created: 2017-10-25T14:48:20.727Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: yes
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1435
external_id: T1435
source_name: NIST Mobile Threat Catalogue
url: https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-13.html
external_id: APP-13
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:48:51.462Z
name: Access Calendar Entries
description: An adversary could call standard operating system APIs from a malicious application to gather calendar entry data, or with escalated privileges could directly access files containing calendar data.
kill_chain_phases: kill_chain_name: mitre-mobile-attack
phase_name: collection
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
iOS
x_mitre_version: 1.0
x_mitre_tactic_type: Post-Adversary Device Access
type: attack-pattern
spec_version: 2.1
id: attack-pattern--633baf01-6de4-4963-bb54-ff6c6357bed3
created: 2017-10-25T14:48:21.354Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: yes
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1465
external_id: T1465
source_name: Kaspersky-DarkHotel
description: Alex Drozhzhin. (2014, November 10). Darkhotel: a spy campaign in luxury Asian hotels. Retrieved December 24, 2016.
url: https://blog.kaspersky.com/darkhotel-apt/6613/
source_name: NIST-SP800153
description: M. Souppaya and K. Scarfone. (2012, February). NIST SP 800-153 Guidelines for Securing Wireless Local Area Networks (WLANs). Retrieved December 24, 2016.
url: http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-153.pdf
source_name: NIST Mobile Threat Catalogue
url: https://pages.nist.gov/mobile-threat-catalogue/lan-pan-threats/LPN-0.html
external_id: LPN-0
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-18T18:00:39.717Z
name: Rogue Wi-Fi Access Points
description: An adversary could set up unauthorized Wi-Fi access points or compromise existing access points and, if the device connects to them, carry out network-based attacks such as eavesdropping on or modifying network communication(Citation: NIST-SP800153)(Citation: Kaspersky-DarkHotel).
kill_chain_phases: kill_chain_name: mitre-mobile-attack
phase_name: network-effects
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
iOS
x_mitre_version: 1.1
x_mitre_tactic_type: Without Adversary Device Access
type: attack-pattern
spec_version: 2.1
id: attack-pattern--670a4d75-103b-4b14-8a9e-4652fa795edd
created: 2022-03-30T14:49:18.650Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1625
external_id: T1625
source_name: NIST Mobile Threat Catalogue
url: https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-27.html
external_id: APP-27
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:48:53.101Z
name: Hijack Execution Flow
description: Adversaries may execute their own malicious payloads by hijacking the way operating systems run applications. Hijacking execution flow can be for the purposes of persistence since this hijacked execution may reoccur over time. 

There are many ways an adversary may hijack the flow of execution. A primary way is by manipulating how the operating system locates programs to be executed. How the operating system locates libraries to be used by a program can also be intercepted. Locations where the operating system looks for programs or resources, such as file directories, could also be poisoned to include malicious payloads.
kill_chain_phases: kill_chain_name: mitre-mobile-attack
phase_name: persistence
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
x_mitre_version: 1.1
x_mitre_tactic_type: Post-Adversary Device Access