auren-research/cyber-sec huggingface dataset:
type: attack-pattern
spec_version: 2.1
id: attack-pattern--fc53309d-ebd5-4573-9242-57024ebdad4f
created: 2022-03-30T20:00:12.654Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1628
external_id: T1628
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:49:39.161Z
name: Hide Artifacts
description: Adversaries may attempt to hide artifacts associated with their behaviors to evade detection. Mobile operating systems have features and developer APIs to hide various artifacts, such as an application’s launcher icon. These APIs have legitimate usages, such as hiding an icon to avoid application drawer clutter when an application does not have a usable interface. Adversaries may abuse these features and APIs to hide artifacts from the user to evade detection.
kill_chain_phases: kill_chain_name: mitre-mobile-attack
phase_name: defense-evasion
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
x_mitre_version: 1.1
x_mitre_tactic_type: Post-Adversary Device Access
type: attack-pattern
spec_version: 2.1
id: attack-pattern--fcb11f06-ce0e-490b-bcc1-04a1623579f0
created: 2022-03-30T18:13:26.003Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1632/001
external_id: T1632.001
source_name: NIST Mobile Threat Catalogue
url: https://pages.nist.gov/mobile-threat-catalogue/stack-threats/STA-7.html
external_id: STA-7
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:49:39.422Z
name: Code Signing Policy Modification
description: Adversaries may modify code signing policies to enable execution of applications signed with unofficial or unknown keys. Code signing provides a level of authenticity on an app from a developer, guaranteeing that the program has not been tampered with and comes from an official source. Security controls can include enforcement mechanisms to ensure that only valid, signed code can be run on a device. 

Mobile devices generally enable these security controls by default, such as preventing the installation of unknown applications on Android. Adversaries may modify these policies in a number of ways, including [Input Injection](https://attack.mitre.org/techniques/T1516) or malicious configuration profiles.
kill_chain_phases: kill_chain_name: mitre-mobile-attack
phase_name: defense-evasion
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
iOS
x_mitre_version: 1.1
x_mitre_tactic_type: Post-Adversary Device Access
type: attack-pattern
spec_version: 2.1
id: attack-pattern--fd211238-f767-4599-8c0d-9dca36624626
created: 2022-04-05T19:59:03.161Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1637/001
external_id: T1637.001
source_name: Data Driven Security DGA
description: Jacobs, J. (2014, October 2). Building a DGA Classifier: Part 2, Feature Engineering. Retrieved February 18, 2019.
url: https://datadrivensecurity.info/blog/posts/2014/Oct/dga-part2/
source_name: securelist rotexy 2018
description: T. Shishkova, L. Pikman. (2018, November 22). The Rotexy mobile Trojan – banker and ransomware. Retrieved September 23, 2019.
url: https://securelist.com/the-rotexy-mobile-trojan-banker-and-ransomware/88893/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:49:39.530Z
name: Domain Generation Algorithms
description: Adversaries may use [Domain Generation Algorithms](https://attack.mitre.org/techniques/T1637/001) (DGAs) to procedurally generate domain names for uses such as command and control communication or malicious application distribution.(Citation: securelist rotexy 2018)

DGAs increase the difficulty for defenders to block, track, or take over the command and control channel, as there could potentially be thousands of domains that malware can check for instructions.
kill_chain_phases: kill_chain_name: mitre-mobile-attack
phase_name: command-and-control
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
iOS
x_mitre_version: 1.1
x_mitre_tactic_type: Post-Adversary Device Access
type: attack-pattern
spec_version: 2.1
id: attack-pattern--fd658820-cbba-4c95-8ac9-0fac6b1099e2
created: 2019-07-11T18:09:42.039Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: yes
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1508
external_id: T1508
source_name: sunny-stolen-credentials
description: Lukáš Štefanko. (2017, February 22). Sunny with a chance of stolen credentials: Malicious weather app found on Google Play. Retrieved July 11, 2019.
url: https://www.welivesecurity.com/2017/02/22/sunny-chance-stolen-credentials-malicious-weather-app-found-google-play/
source_name: android-trojan-steals-paypal-2fa
description: Lukáš Štefanko. (2018, December 11). Android Trojan steals money from PayPal accounts even with 2FA on. Retrieved July 11, 2019.
url: https://www.welivesecurity.com/2018/12/11/android-trojan-steals-money-paypal-accounts-2fa/
source_name: bankbot-spybanker
description: NJCCIC. (2017, March 2). BankBot/Spy Banker. Retrieved July 11, 2019.
url: https://www.cyber.nj.gov/threat-profiles/android-malware-variants/bankbot-spybanker
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:49:39.785Z
name: Suppress Application Icon
description: A malicious application could suppress its icon from being displayed to the user in the application launcher to hide the fact that it is installed, and to make it more difficult for the user to uninstall the application. Hiding the application's icon programmatically does not require any special permissions.

This behavior has been seen in the BankBot/Spy Banker family of malware.(Citation: android-trojan-steals-paypal-2fa)(Citation: sunny-stolen-credentials)(Citation: bankbot-spybanker)
kill_chain_phases: kill_chain_name: mitre-mobile-attack
phase_name: defense-evasion
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
x_mitre_version: 1.1
x_mitre_tactic_type: Post-Adversary Device Access
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--56c2b384-77f8-461f-a71a-76f7888ebfb6
created: 2023-03-13T20:48:14.540Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0118
external_id: DC0118
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:10:28.402Z
name: System Settings
description: Settings visible to the user on the device
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: User Interface
channel: None
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962
created: 2023-03-13T19:59:14.491Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0112
external_id: DC0112
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:10:28.402Z
name: API Calls
description: API calls utilized by an application that could indicate malicious activity
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: Application Vetting
channel: None
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--613788f2-ad72-43f5-b5f7-a93e2adc70fa
created: 2024-03-29T14:59:30.164Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0119
external_id: DC0119
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:10:28.402Z
name: Application Assets
description: Additional assets included with an application
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: Application Vetting
channel: None
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--6c62144a-cd5c-401c-ada9-58c4c74cd9d2
created: 2023-03-13T20:00:38.029Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0115
external_id: DC0115
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:10:28.402Z
name: Protected Configuration
description: Device configuration options that are not typically utilized by benign applications
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: Application Vetting
channel: None
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--764ee29e-48d6-4934-8e6b-7a606aaaafc0
created: 2023-03-13T19:59:42.141Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0113
external_id: DC0113
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:10:28.402Z
name: Network Communication
description: Network requests made by an application or domains contacted
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: Application Vetting
channel: None
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43
created: 2023-03-13T20:00:08.487Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0114
external_id: DC0114
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:10:28.402Z
name: Permissions Requests
description: Permissions declared in an application's manifest or property list file
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: Application Vetting
channel: None
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--bf0ff551-a5a7-40e5-bff9-f9405011b1f4
created: 2023-03-13T20:47:52.557Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0117
external_id: DC0117
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:10:28.402Z
name: System Notifications
description: Notifications generated by the OS
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: User Interface
channel: None
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--e2f72131-14d1-411f-8e8c-aa3453dd5456
created: 2023-03-13T20:47:24.038Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0116
external_id: DC0116
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:10:28.402Z
name: Permissions Request
description: System prompts triggered when an application requests new or additional permissions
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: User Interface
channel: None
type: x-mitre-data-source
spec_version: 2.1
id: x-mitre-data-source--55ba7d30-887f-42c1-a24e-c4e90aff24b8
created: 2023-03-13T19:36:25.108Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datasources/DS0042
external_id: DS0042
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:10:28.402Z
name: User Interface
description: Visual activity on the device that could alert the user to potentially malicious behavior.
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
iOS
x_mitre_deprecated: yes
x_mitre_domains: mobile-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_collection_layers: Device
type: x-mitre-data-source
spec_version: 2.1
id: x-mitre-data-source--e156f007-c5bf-45cc-8dd5-d442ffb0d203
created: 2023-03-13T19:30:41.131Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datasources/DS0041
external_id: DS0041
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:10:28.402Z
name: Application Vetting
description: Application vetting report generated by an external cloud service.
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
iOS
x_mitre_deprecated: yes
x_mitre_domains: mobile-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_collection_layers: Report
modified: 2025-03-28T15:23:16.915Z
name: Operation Triangulation
description: [Operation Triangulation](https://attack.mitre.org/campaigns/C0054) is a mobile campaign targeting iOS devices.(Citation: SecureList OpTriangulation 01Jun2023) The unidentified actors used zero-click exploits in iMessage attachments to gain [Initial Access](https://attack.mitre.org/tactics/TA0027), then executed exploits and validators, such as [Binary Validator](https://attack.mitre.org/software/S1215) before finally executing the [TriangleDB](https://attack.mitre.org/software/S1216) implant. 
aliases: Operation Triangulation
first_seen: 2019-01-01T08:00:00.000Z
last_seen: 2023-06-01T07:00:00.000Z
x_mitre_first_seen_citation: (Citation: SecureList OpTriangulation 01Jun2023)
x_mitre_last_seen_citation: (Citation: SecureList OpTriangulation 01Jun2023)
x_mitre_deprecated: no
x_mitre_version: 1.0
type: campaign
spec_version: 2.1
id: campaign--d0695b5f-b761-49e0-b3e3-2e5307f8def3
created: 2025-03-28T14:45:30.132Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/campaigns/C0054
external_id: C0054
source_name: SecureList OpTriangulation 01Jun2023
description: Kuznetsov, I., et al. (2023, June 1). Operation Triangulation: iOS devices targeted with previously unknown malware. Retrieved April 18, 2024.
url: https://securelist.com/operation-triangulation/109842/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_domains: mobile-attack
type: intrusion-set
spec_version: 2.1
id: intrusion-set--049cef3b-22d5-4be6-b50c-9839c7a34fdd
created: 2020-01-27T16:55:39.688Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0097
external_id: G0097
source_name: Trend Micro Bouncing Golf 2019
description: E. Xu, G. Guo. (2019, June 28). Mobile Cyberespionage Campaign ‘Bouncing Golf’ Affects Middle East. Retrieved January 27, 2020.
url: https://blog.trendmicro.com/trendlabs-security-intelligence/mobile-cyberespionage-campaign-bouncing-golf-affects-middle-east/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:41:32.241Z
name: Bouncing Golf
description: [Bouncing Golf](https://attack.mitre.org/groups/G0097) is a cyberespionage campaign targeting Middle Eastern countries.(Citation: Trend Micro Bouncing Golf 2019)
aliases: Bouncing Golf
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
modified: 2024-04-02T18:58:54.885Z
name: UNC788
description: [UNC788](https://attack.mitre.org/groups/G1029) is a group of hackers from Iran that has targeted people in the Middle East.(Citation: Meta Adversarial Threat Report 2022)
aliases: UNC788
x_mitre_deprecated: no
x_mitre_version: 1.0
x_mitre_contributors: Denise Tan
type: intrusion-set
spec_version: 2.1
id: intrusion-set--1f322d74-4822-4d60-8f64-414eea8a9258
created: 2024-04-02T18:58:36.186Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G1029
external_id: G1029
source_name: Meta Adversarial Threat Report 2022
description: Agranovich, D., et al. (2022, April). Adversarial Threat Report. Retrieved April 2, 2024.
url: https://about.fb.com/wp-content/uploads/2022/04/Meta-Quarterly-Adversarial-Threat-Report_Q1-2022.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_domains: mobile-attack
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: 2024-04-19T19:35:15.637Z
name: PROMETHIUM
description: [PROMETHIUM](https://attack.mitre.org/groups/G0056) is an activity group focused on espionage that has been active since at least 2012. The group has conducted operations globally with a heavy emphasis on Turkish targets. [PROMETHIUM](https://attack.mitre.org/groups/G0056) has demonstrated similarity to another activity group called [NEODYMIUM](https://attack.mitre.org/groups/G0055) due to overlapping victim and campaign characteristics.(Citation: Microsoft NEODYMIUM Dec 2016)(Citation: Microsoft SIR Vol 21)(Citation: Talos Promethium June 2020)
aliases: PROMETHIUM
StrongPity
x_mitre_deprecated: no
x_mitre_version: 2.1
type: intrusion-set
spec_version: 2.1
id: intrusion-set--efed95ba-d7e8-47ff-8c53-99c42426ee7c
created: 2018-01-16T16:13:52.465Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0056
external_id: G0056
source_name: PROMETHIUM
description: (Citation: Microsoft NEODYMIUM Dec 2016) (Citation: Microsoft SIR Vol 21)
source_name: Microsoft SIR Vol 21
description: Anthe, C. et al. (2016, December 14). Microsoft Security Intelligence Report Volume 21. Retrieved November 27, 2017.
url: http://download.microsoft.com/download/E/B/0/EB0F50CC-989C-4B66-B7F6-68CD3DC90DE3/Microsoft_Security_Intelligence_Report_Volume_21_English.pdf
source_name: Talos Promethium June 2020
description: Mercer, W. et al. (2020, June 29). PROMETHIUM extends global reach with StrongPity3 APT. Retrieved July 20, 2020.
url: https://blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html
source_name: Microsoft NEODYMIUM Dec 2016
description: Microsoft. (2016, December 14). Twin zero-day attacks: PROMETHIUM and NEODYMIUM target individuals in Europe. Retrieved November 27, 2017.
url: https://blogs.technet.microsoft.com/mmpc/2016/12/14/twin-zero-day-attacks-promethium-and-neodymium-target-individuals-in-europe/
source_name: StrongPity
description: The name StrongPity has also been used to describe the group and the malware used by the group.(Citation: Bitdefender StrongPity June 2020)(Citation: Talos Promethium June 2020)
source_name: Bitdefender StrongPity June 2020
description: Tudorica, R. et al. (2020, June 30). StrongPity APT - Revealing Trojanized Tools, Working Hours and Infrastructure. Retrieved July 20, 2020.
url: https://www.bitdefender.com/files/News/CaseStudies/study/353/Bitdefender-Whitepaper-StrongPity-APT.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_domains: mobile-attack
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: course-of-action
spec_version: 2.1
id: course-of-action--059ba11e-e3dc-49aa-84ca-88197f40d4ea
created: 2019-06-11T17:06:56.230Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/mitigations/M0948
external_id: M0948
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T21:26:25.920Z
name: Application Isolation and Sandboxing
description: Restrict the execution of code to a virtual environment on or in-transit to an endpoint system.
labels: IEC 62443-3-3:2013 - SR 5.4
IEC 62443-4-2:2019 - CR 5.4
NIST SP 800-53 Rev. 5 - SI-3
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: ics-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0