auren-research/cyber-sec huggingface dataset:
type: attack-pattern
spec_version: 2.1
id: attack-pattern--7827ced0-95e7-4d05-bdcf-0d8f2d37a3d3
created: 2022-03-28T19:31:51.978Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1474/001
external_id: T1474.001
source_name: Grace-Advertisement
description: M. Grace et al. (2012, April 16-18). Unsafe exposure analysis of mobile in-app advertisements. Retrieved November 17, 2024.
url: https://dl.acm.org/doi/10.1145/2185448.2185464
source_name: NIST Mobile Threat Catalogue
url: https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-6.html
external_id: APP-6
source_name: NIST Mobile Threat Catalogue
url: https://pages.nist.gov/mobile-threat-catalogue/supply-chain-threats/SPC-0.html
external_id: SPC-0
source_name: NIST Mobile Threat Catalogue
url: https://pages.nist.gov/mobile-threat-catalogue/supply-chain-threats/SPC-3.html
external_id: SPC-3
source_name: NIST Mobile Threat Catalogue
url: https://pages.nist.gov/mobile-threat-catalogue/supply-chain-threats/SPC-9.html
external_id: SPC-9
source_name: NIST Mobile Threat Catalogue
url: https://pages.nist.gov/mobile-threat-catalogue/supply-chain-threats/SPC-10.html
external_id: SPC-10
source_name: NIST Mobile Threat Catalogue
url: https://pages.nist.gov/mobile-threat-catalogue/supply-chain-threats/SPC-15.html
external_id: SPC-15
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:48:58.857Z
name: Compromise Software Dependencies and Development Tools
description: Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise. Applications often depend on external software to function properly. Popular open source projects that are used as dependencies in many applications may be targeted as a means to add malicious code to users of the dependency.(Citation: Grace-Advertisement)
kill_chain_phases: kill_chain_name: mitre-mobile-attack
phase_name: initial-access
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
iOS
x_mitre_version: 1.1
x_mitre_tactic_type: Post-Adversary Device Access
type: attack-pattern
spec_version: 2.1
id: attack-pattern--789ef15a-34d9-4b32-a779-8cbbc9eb32f5
created: 2022-04-01T15:15:35.640Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1635/001
external_id: T1635.001
source_name: Android-AppLinks
description: Android. (n.d.). Handling App Links. Retrieved December 21, 2016.
url: https://developer.android.com/training/app-links/index.html
source_name: Trend Micro iOS URL Hijacking
description: L. Wu, Y. Zhou, M. Li. (2019, July 12). iOS URL Scheme Susceptible to Hijacking. Retrieved September 11, 2020.
url: https://web.archive.org/web/20211023221110/https://blog.trendmicro.com/trendlabs-security-intelligence/ios-url-scheme-susceptible-to-hijacking/
source_name: IETF-PKCE
description: N. Sakimura, J. Bradley, and N. Agarwal. (2015, September). IETF RFC 7636: Proof Key for Code Exchange by OAuth Public Clients. Retrieved December 21, 2016.
url: https://tools.ietf.org/html/rfc7636
source_name: IETF-OAuthNativeApps
description: W. Denniss and J. Bradley. (2017, October). IETF RFC 8252: OAuth 2.0 for Native Apps. Retrieved November 30, 2018.
url: https://tools.ietf.org/html/rfc8252
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:48:59.057Z
name: URI Hijacking
description: Adversaries may register Uniform Resource Identifiers (URIs) to intercept sensitive data. 

Applications regularly register URIs with the operating system to act as a response handler for various actions, such as logging into an app using an external account via single sign-on. This allows redirections to that specific URI to be intercepted by the application. If an adversary were to register for a URI that was already in use by a genuine application, the adversary may be able to intercept data intended for the genuine application or perform a phishing attack against the genuine application. Intercepted data may include OAuth authorization codes or tokens that could be used by the adversary to gain access to protected resources.(Citation: Trend Micro iOS URL Hijacking)(Citation: IETF-PKCE) 
kill_chain_phases: kill_chain_name: mitre-mobile-attack
phase_name: credential-access
x_mitre_attack_spec_version: 3.3.0
x_mitre_contributors: Leo Zhang, Trend Micro
Steven Du, Trend Micro
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
iOS
x_mitre_version: 1.1
x_mitre_tactic_type: Post-Adversary Device Access
type: attack-pattern
spec_version: 2.1
id: attack-pattern--79cb02f4-ac4e-4335-8b51-425c9573cce1
created: 2022-03-30T18:05:46.795Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1632
external_id: T1632
source_name: NIST Mobile Threat Catalogue
url: https://pages.nist.gov/mobile-threat-catalogue/stack-threats/STA-7.html
external_id: STA-7
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:48:59.522Z
name: Subvert Trust Controls
description: Adversaries may undermine security controls that will either warn users of untrusted activity or prevent execution of untrusted applications. Operating systems and security products may contain mechanisms to identify programs or websites as possessing some level of trust. Examples of such features include: an app being allowed to run because it is signed by a valid code signing certificate; an OS prompt alerting the user that an app came from an untrusted source; or getting an indication that you are about to connect to an untrusted site. The method adversaries use will depend on the specific mechanism they seek to subvert. 
kill_chain_phases: kill_chain_name: mitre-mobile-attack
phase_name: defense-evasion
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
iOS
x_mitre_version: 1.1
x_mitre_tactic_type: Post-Adversary Device Access
type: attack-pattern
spec_version: 2.1
id: attack-pattern--79eec66a-9bd0-4a3f-ac82-19159e94bd44
created: 2017-10-25T14:48:11.116Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: yes
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1433
external_id: T1433
source_name: NIST Mobile Threat Catalogue
url: https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-13.html
external_id: APP-13
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:48:59.691Z
name: Access Call Log
description: On Android, an adversary could call standard operating system APIs from a malicious application to gather call log data, or with escalated privileges could directly access files containing call log data.

On iOS, applications do not have access to the call log, so privilege escalation would be required in order to access the data.
kill_chain_phases: kill_chain_name: mitre-mobile-attack
phase_name: collection
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
iOS
x_mitre_version: 1.1
x_mitre_tactic_type: Post-Adversary Device Access
type: attack-pattern
spec_version: 2.1
id: attack-pattern--82f04b1e-5371-4a6f-be06-411f0f43b483
created: 2017-10-25T14:48:29.774Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: yes
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1401
external_id: T1401
source_name: Android DeviceAdminInfo
description: Google. (n.d.). DeviceAdminInfo. Retrieved November 20, 2020.
url: https://developer.android.com/reference/android/app/admin/DeviceAdminInfo
source_name: NIST Mobile Threat Catalogue
url: https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-22.html
external_id: APP-22
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:49:02.729Z
name: Device Administrator Permissions
description: Adversaries may request device administrator permissions to perform malicious actions.

By abusing the device administration API, adversaries can perform several nefarious actions, such as resetting the device’s password for [Device Lockout](https://attack.mitre.org/techniques/T1446), factory resetting the device to [Delete Device Data](https://attack.mitre.org/techniques/T1447) and any traces of the malware, disabling all of the device’s cameras, or make it more difficult to uninstall the app.(Citation: Android DeviceAdminInfo)

Device administrators must be approved by the user at runtime, with a system popup showing which of the actions have been requested by the app. In conjunction with other techniques, such as [Input Injection](https://attack.mitre.org/techniques/T1516), an app can programmatically grant itself administrator permissions without any user input.
kill_chain_phases: kill_chain_name: mitre-mobile-attack
phase_name: privilege-escalation
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
x_mitre_version: 2.0
x_mitre_tactic_type: Post-Adversary Device Access
type: attack-pattern
spec_version: 2.1
id: attack-pattern--831e3269-da49-48ac-94dc-948008e8fd16
created: 2017-10-25T14:48:34.830Z
revoked: yes
external_references: source_name: mitre-mobile-attack
url: https://attack.mitre.org/techniques/T1443
external_id: T1443
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:49:02.916Z
name: Remotely Install Application
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_version: 1.0
type: attack-pattern
spec_version: 2.1
id: attack-pattern--8605a0ec-b44a-4e98-a7fc-87d4bd3acb66
created: 2022-04-01T15:01:32.169Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1634/001
external_id: T1634.001
source_name: Apple Keychain Services
description: Apple, Inc.. (n.d.). Keychain Services. Retrieved June 24, 2020.
url: https://developer.apple.com/documentation/security/keychain_services
source_name: Elcomsoft Decrypt Keychain
description: V. Katalov. (2018, December 18). Six Ways to Decrypt iPhone Passwords from the Keychain. Retrieved June 24, 2020.
url: https://blog.elcomsoft.com/2018/12/six-ways-to-decrypt-iphone-passwords-from-the-keychain/
source_name: NIST Mobile Threat Catalogue
url: https://pages.nist.gov/mobile-threat-catalogue/authentication-threats/AUT-11.html
external_id: AUT-11
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:49:03.949Z
name: Keychain
description: Adversaries may collect keychain data from an iOS device to acquire credentials. Keychains are the built-in way for iOS to keep track of users' passwords and credentials for many services and features such as Wi-Fi passwords, websites, secure notes, certificates, private keys, and VPN credentials. 

On the device, the keychain database is stored outside of application sandboxes to prevent unauthorized access to the raw data. Standard iOS APIs allow applications access to their own keychain contained within the database. By utilizing a privilege escalation exploit or existing root access, adversaries can access the entire encrypted database.(Citation: Apple Keychain Services)(Citation: Elcomsoft Decrypt Keychain) 
kill_chain_phases: kill_chain_name: mitre-mobile-attack
phase_name: credential-access
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: iOS
x_mitre_version: 1.1
x_mitre_tactic_type: Post-Adversary Device Access
type: attack-pattern
spec_version: 2.1
id: attack-pattern--88932a8c-3a17-406f-9431-1da3ff19f6d6
created: 2017-10-25T14:48:29.092Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1403
external_id: T1403
source_name: Sabanal-ART
description: Paul Sabanal. (2015). Hiding Behind ART. Retrieved December 21, 2016.
url: https://www.blackhat.com/docs/asia-15/materials/asia-15-Sabanal-Hiding-Behind-ART-wp.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:49:04.473Z
name: Modify Cached Executable Code
description: ART (the Android Runtime) compiles optimized code on the device itself to improve performance. An adversary may be able to use escalated privileges to modify the cached code in order to hide malicious behavior. Since the code is compiled on the device, it may not receive the same level of integrity checks that are provided to code running in the system partition.(Citation: Sabanal-ART)
kill_chain_phases: kill_chain_name: mitre-mobile-attack
phase_name: persistence
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: yes
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
x_mitre_version: 1.1
x_mitre_tactic_type: Post-Adversary Device Access
type: attack-pattern
spec_version: 2.1
id: attack-pattern--89fcd02f-62dc-40b9-a54b-9ac4b1baef05
created: 2017-10-25T14:48:28.456Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: yes
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1419
external_id: T1419
source_name: Android-Build
description: Android. (n.d.). Build. Retrieved December 21, 2016.
url: https://developer.android.com/reference/android/os/Build
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-09-08T16:32:57.531Z
name: Device Type Discovery
description: On Android, device type information is accessible to apps through the android.os.Build class (Citation: Android-Build). Device information could be used to target privilege escalation exploits.
kill_chain_phases: kill_chain_name: mitre-mobile-attack
phase_name: discovery
x_mitre_attack_spec_version: 3.3.0
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
x_mitre_version: 1.0
x_mitre_tactic_type: Post-Adversary Device Access
type: attack-pattern
spec_version: 2.1
id: attack-pattern--8c7862ff-3449-4ac6-b0fd-ac1298a822a5
created: 2020-05-04T13:49:34.706Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: yes
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1576
external_id: T1576
source_name: NIST Mobile Threat Catalogue
url: https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-43.html
external_id: APP-43
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-18T18:00:41.929Z
name: Uninstall Malicious Application
description: Adversaries may include functionality in malware that uninstalls the malicious application from the device. This can be achieved by:

* Abusing device owner permissions to perform silent uninstallation using device owner API calls.
* Abusing root permissions to delete files from the filesystem.
* Abusing the accessibility service. This requires an intent be sent to the system to request uninstallation, and then abusing the accessibility service to click the proper places on the screen to confirm uninstallation.
kill_chain_phases: kill_chain_name: mitre-mobile-attack
phase_name: defense-evasion
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
x_mitre_version: 1.0
x_mitre_tactic_type: Post-Adversary Device Access
modified: 2025-03-14T17:56:26.095Z
name: Virtualization Solution
description: Adversaries may carry out malicious operations using virtualization solutions to escape from Android sandboxes and to avoid detection. Android uses sandboxes to separate resources and code execution between applications and the operating system.(Citation: Android Application Sandbox) There are a few virtualization solutions available on Android, such as the Android Virtualization Framework (AVF).(Citation: Android AVF Overview) 

 

Through virtualization solutions, adversaries may execute malicious operations without user knowledge. For example, adversaries may mimic a legitimate banking application’s functionalities in a virtual environment, thanks to the virtualization solution, while malicious code captures credentials. 
kill_chain_phases: kill_chain_name: mitre-mobile-attack
phase_name: defense-evasion
x_mitre_contributors: Liran Ravich, CardinalOps
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: no
x_mitre_platforms: Android
x_mitre_version: 1.0
type: attack-pattern
spec_version: 2.1
id: attack-pattern--8e097ec5-1755-41d6-807c-3882442b818a
created: 2025-03-14T17:56:26.095Z
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1670
external_id: T1670
source_name: Android AVF Overview
description: Android Open Source Project. (n.d.). Android Virtualization Framework (AVF) overview. Retrieved February 26, 2025.
url: https://source.android.com/docs/core/virtualization
source_name: Android Application Sandbox
description: Android Open Source Project. (n.d.). Application Sandbox. Retrieved February 26, 2025.
url: https://source.android.com/docs/security/app-sandbox
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: attack-pattern
spec_version: 2.1
id: attack-pattern--8e27551a-5080-4148-a584-c64348212e4f
created: 2017-10-25T14:48:31.694Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: yes
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1447
external_id: T1447
source_name: Android DevicePolicyManager 2019
description: Android Developers. (n.d.). DevicePolicyManager. Retrieved September 22, 2019.
url: https://developer.android.com/reference/android/app/admin/DevicePolicyManager.html
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:49:05.463Z
name: Delete Device Data
description: Adversaries may wipe a device or delete individual files in order to manipulate external outcomes or hide activity. An application must have administrator access to fully wipe the device, while individual files may not require special permissions to delete depending on their storage location. (Citation: Android DevicePolicyManager 2019)

Stored data could include a variety of file formats, such as Office files, databases, stored emails, and custom file formats. The impact file deletion will have depends on the type of data as well as the goals and objectives of the adversary, but can include deleting update files to evade detection or deleting attacker-specified files for impact.
kill_chain_phases: kill_chain_name: mitre-mobile-attack
phase_name: impact
kill_chain_name: mitre-mobile-attack
phase_name: defense-evasion
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
x_mitre_version: 2.1
x_mitre_tactic_type: Post-Adversary Device Access
type: attack-pattern
spec_version: 2.1
id: attack-pattern--8f0e39c6-82c9-41ec-9f93-5696c0f2e274
created: 2017-10-25T14:48:09.082Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: yes
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1448
external_id: T1448
source_name: Google Bread
description: A. Guertin, V. Kotov, Android Security & Privacy Team. (2020, January 9). PHA Family Highlights: Bread (and Friends) . Retrieved April 27, 2020.
url: https://security.googleblog.com/2020/01/pha-family-highlights-bread-and-friends.html
source_name: AndroidSecurity2014
description: Google. (2014). Android Security 2014 Year in Review. Retrieved December 12, 2016.
url: https://static.googleusercontent.com/media/source.android.com/en//security/reports/Google_Android_Security_2014_Report_Final.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:49:05.648Z
name: Carrier Billing Fraud
description: A malicious app may trigger fraudulent charges on a victim’s carrier billing statement in several different ways, including SMS toll fraud and SMS shortcodes that make purchases.

Performing SMS fraud relies heavily upon the fact that, when making SMS purchases, the carriers perform device verification but not user verification. This allows adversaries to make purchases on behalf of the user, with little or no user interaction.(Citation: Google Bread)

Malicious applications may also perform toll billing, which occurs when carriers provide payment endpoints over a web page. The application connects to the web page over cellular data so the carrier can directly verify the number, or the application must retrieve a code sent via SMS and enter it into the web page.(Citation: Google Bread)

On iOS, apps cannot send SMS messages.

On Android, apps must hold the `SEND_SMS` permission to send SMS messages. Additionally, Android version 4.2 and above has mitigations against this threat by requiring user consent before allowing SMS messages to be sent to premium numbers (Citation: AndroidSecurity2014).
kill_chain_phases: kill_chain_name: mitre-mobile-attack
phase_name: impact
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
x_mitre_version: 2.0
x_mitre_tactic_type: Post-Adversary Device Access