auren-research/cyber-sec huggingface dataset:
type: attack-pattern
spec_version: 2.1
id: attack-pattern--a5de0540-73e7-4c67-96da-4143afedc7ed
created: 2017-10-25T14:48:22.296Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: yes
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1467
external_id: T1467
source_name: Computerworld-Femtocell
description: Jaikumar Vijayan. (2013, August 1). Researchers exploit cellular tech flaws to intercept phone calls. Retrieved December 24, 2016.
url: http://www.computerworld.com/article/2484538/cybercrime-hacking/researchers-exploit-cellular-tech-flaws-to-intercept-phone-calls.html
source_name: NIST Mobile Threat Catalogue
url: https://pages.nist.gov/mobile-threat-catalogue/cellular-threats/CEL-7.html
external_id: CEL-7
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-18T18:00:43.216Z
name: Rogue Cellular Base Station
description: An adversary could set up a rogue cellular base station and then use it to eavesdrop on or manipulate cellular device communication. A compromised cellular femtocell could be used to carry out this technique(Citation: Computerworld-Femtocell).
kill_chain_phases: kill_chain_name: mitre-mobile-attack
phase_name: network-effects
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
iOS
x_mitre_version: 1.1
x_mitre_tactic_type: Without Adversary Device Access
modified: 2025-02-12T16:26:38.632Z
name: SIM Card Swap
description: Adversaries may gain access to mobile devices through transfers or swaps from victims’ phone numbers to adversary-controlled SIM cards and mobile devices.(Citation: ATT SIM Swap Scams)(Citation: Verizon SIM Swapping) 

The typical process is as follows: 

1. Adversaries will first gather information about victims through [Phishing](https://attack.mitre.org/techniques/T1660), social engineering, data breaches, or other avenues. 
2. Adversaries will then impersonate victims as they contact mobile carriers to request for the SIM swaps. For example, adversaries would provide victims’ name and address to mobile carriers; once authenticated, adversaries would request for victims’ phone numbers to be transferred to adversary-controlled SIM cards. 
3. Once completed, victims will lose mobile data, such as text messages and phone calls, on their mobile devices. In turn, adversaries will receive mobile data that was intended for the victims. 

Adversaries may use the intercepted SMS messages to log into online accounts that use SMS-based authentication. Specifically, adversaries may use SMS-based authentication to log into banking and/or cryptocurrency accounts, then transfer funds to adversary-controlled wallets. 
kill_chain_phases: kill_chain_name: mitre-mobile-attack
phase_name: initial-access
x_mitre_contributors: Karim Hasanen, @_karimhasanen
Jennifer Kim Roman
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: no
x_mitre_platforms: Android
iOS
x_mitre_version: 2.0
x_mitre_tactic_type: Without Adversary Device Access
type: attack-pattern
spec_version: 2.1
id: attack-pattern--a64a820a-cb21-471f-920c-506a2ff04fa5
created: 2017-10-25T14:48:20.329Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1451
external_id: T1451
source_name: ATT SIM Swap Scams
description: AT&T. (n.d.). UPDATE: Secure Your Number to Reduce SIM Swap Scams. Retrieved January 27, 2025.
url: https://www.research.att.com/sites/cyberaware/ni/blog/sim_swap.html
source_name: Verizon SIM Swapping
description: Verizon. (n.d.). SIM Swapping. Retrieved January 27, 2025.
url: https://www.verizon.com/about/account-security/sim-swapping
source_name: NIST Mobile Threat Catalogue
url: https://pages.nist.gov/mobile-threat-catalogue/stack-threats/STA-22.html
external_id: STA-22
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: attack-pattern
spec_version: 2.1
id: attack-pattern--a8c31121-852b-46bd-9ba4-674ae5afe7ad
created: 2017-10-25T14:48:27.660Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1417
external_id: T1417
source_name: NIST Mobile Threat Catalogue
url: https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-31.html
external_id: APP-31
source_name: NIST Mobile Threat Catalogue
url: https://pages.nist.gov/mobile-threat-catalogue/authentication-threats/AUT-13.html
external_id: AUT-13
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:49:11.864Z
name: Input Capture
description: Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal device usage, users often provide credentials to various locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. [Keylogging](https://attack.mitre.org/techniques/T1417/001)) or rely on deceiving the user into providing input into what they believe to be a genuine application prompt (e.g. [GUI Input Capture](https://attack.mitre.org/techniques/T1417/002)).
kill_chain_phases: kill_chain_name: mitre-mobile-attack
phase_name: collection
kill_chain_name: mitre-mobile-attack
phase_name: credential-access
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
iOS
x_mitre_version: 2.3
x_mitre_tactic_type: Post-Adversary Device Access
type: attack-pattern
spec_version: 2.1
id: attack-pattern--a8e971b8-8dc7-4514-8249-ae95427ec467
created: 2022-04-06T13:55:14.390Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1643
external_id: T1643
source_name: NIST Mobile Threat Catalogue
url: https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-16.html
external_id: APP-16
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:49:12.043Z
name: Generate Traffic from Victim
description: Adversaries may generate outbound traffic from devices. This is typically performed to manipulate external outcomes, such as to achieve carrier billing fraud or to manipulate app store rankings or ratings. Outbound traffic is typically generated as SMS messages or general web traffic, but may take other forms as well.

If done via SMS messages, Android apps must hold the `SEND_SMS` permission. Additionally, sending an SMS message requires user consent if the recipient is a premium number. Applications cannot send SMS messages on iOS
kill_chain_phases: kill_chain_name: mitre-mobile-attack
phase_name: impact
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
iOS
x_mitre_version: 1.1
x_mitre_tactic_type: Post-Adversary Device Access
type: attack-pattern
spec_version: 2.1
id: attack-pattern--a91262d5-b9ff-463f-b8d2-12e4ea1eb3c9
created: 2022-04-08T16:29:30.087Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1630/003
external_id: T1630.003
source_name: Brodie
description: Daniel Brodie. (2016). Practical Attacks against Mobile Device Management (MDM). Retrieved December 21, 2016.
url: https://media.blackhat.com/eu-13/briefings/Brodie/bh-eu-13-lacoon-attacks-mdm-brodie-wp.pdf
source_name: Rastogi
description: Vaibhav Rastogi, Yan Chen, and Xuxian Jiang. (2013, May). DroidChameleon: Evaluating Android Anti-malware against Transformation Attacks. Retrieved December 9, 2016.
url: http://pages.cs.wisc.edu/~vrastogi/static/papers/rcj13b.pdf
source_name: Tan
description: Vincent Tan. (2016, August). BAD FOR ENTERPRISE: ATTACKING BYOD ENTERPRISE MOBILE SECURITY SOLUTIONS. Retrieved February 4, 2017.
url: http://www.blackhat.com/us-16/briefings.html#bad-for-enterprise-attacking-byod-enterprise-mobile-security-solutions
source_name: NIST Mobile Threat Catalogue
url: https://pages.nist.gov/mobile-threat-catalogue/emm-threats/EMM-5.html
external_id: EMM-5
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:49:12.130Z
name: Disguise Root/Jailbreak Indicators
description: An adversary could use knowledge of the techniques used by security software to evade detection.(Citation: Brodie)(Citation: Tan) For example, some mobile security products perform compromised device detection by searching for particular artifacts such as an installed "su" binary, but that check could be evaded by naming the binary something else. Similarly, polymorphic code techniques could be used to evade signature-based detection.(Citation: Rastogi)
kill_chain_phases: kill_chain_name: mitre-mobile-attack
phase_name: defense-evasion
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
iOS
x_mitre_version: 1.1
x_mitre_tactic_type: Post-Adversary Device Access
type: attack-pattern
spec_version: 2.1
id: attack-pattern--a93ccb8f-3996-42e2-b7c7-bb599d4e205f
created: 2017-10-25T14:48:35.247Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1444
external_id: T1444
source_name: Palo Alto HenBox
description: A. Hinchliffe, M. Harbison, J. Miller-Osborn, et al. (2018, March 13). HenBox: The Chickens Come Home to Roost. Retrieved September 9, 2019.
url: https://unit42.paloaltonetworks.com/unit42-henbox-chickens-come-home-roost/
source_name: Zhou
description: Yajin Zhou and Xuxian Jiang. (2012, May). Dissecting Android Malware: Characterization and Evolution. Retrieved December 9, 2016.
url: http://ieeexplore.ieee.org/document/6234407
source_name: NIST Mobile Threat Catalogue
url: https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-31.html
external_id: APP-31
source_name: NIST Mobile Threat Catalogue
url: https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-14.html
external_id: APP-14
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:49:12.301Z
name: Masquerade as Legitimate Application
description: An adversary could distribute developed malware by masquerading the malware as a legitimate application. This can be done in two different ways: by embedding the malware in a legitimate application, or by pretending to be a legitimate application.

Embedding the malware in a legitimate application is done by downloading the application, disassembling it, adding the malicious code, and then re-assembling it.(Citation: Zhou) The app would appear to be the original app, but would contain additional malicious functionality. The adversary could then publish the malicious application to app stores or use another delivery method.

Pretending to be a legitimate application relies heavily on lack of scrutinization by the user. Typically, a malicious app pretending to be a legitimate one will have many similar details as the legitimate one, such as name, icon, and description.(Citation: Palo Alto HenBox)

Malicious applications may also masquerade as legitimate applications when requesting access to the accessibility service in order to appear as legitimate to the user, increasing the likelihood that the access will be granted.
kill_chain_phases: kill_chain_name: mitre-mobile-attack
phase_name: initial-access
kill_chain_name: mitre-mobile-attack
phase_name: defense-evasion
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Alex Hinchliffe, Palo Alto Networks
x_mitre_deprecated: yes
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
iOS
x_mitre_version: 2.1
x_mitre_tactic_type: Post-Adversary Device Access
type: attack-pattern
spec_version: 2.1
id: attack-pattern--a9cab8f6-4c94-4c9b-9e7d-9d863ff53431
created: 2017-10-25T14:48:19.682Z
revoked: yes
external_references: source_name: mitre-mobile-attack
url: https://attack.mitre.org/techniques/T1457
external_id: T1457
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:49:12.390Z
name: Malicious Media Content
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_version: 1.0
type: attack-pattern
spec_version: 2.1
id: attack-pattern--a9fa0d30-a8ff-45bf-922e-7720da0b7922
created: 2022-04-01T12:48:27.021Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1636/001
external_id: T1636.001
source_name: NIST Mobile Threat Catalogue
url: https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-13.html
external_id: APP-13
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:49:12.650Z
name: Calendar Entries
description: Adversaries may utilize standard operating system APIs to gather calendar entry data. On Android, this can be accomplished using the Calendar Content Provider. On iOS, this can be accomplished using the `EventKit` framework. 

 

If the device has been jailbroken or rooted, an adversary may be able to access [Calendar Entries](https://attack.mitre.org/techniques/T1636/001) without the user’s knowledge or approval. 
kill_chain_phases: kill_chain_name: mitre-mobile-attack
phase_name: collection
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
iOS
x_mitre_version: 1.1
type: attack-pattern
spec_version: 2.1
id: attack-pattern--ab7400b7-3476-4776-9545-ef3fa373de63
created: 2022-03-30T19:36:09.691Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1630/002
external_id: T1630.002
source_name: Android DevicePolicyManager 2019
description: Android Developers. (n.d.). DevicePolicyManager. Retrieved September 22, 2019.
url: https://developer.android.com/reference/android/app/admin/DevicePolicyManager.html
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:49:12.849Z
name: File Deletion
description: Adversaries may wipe a device or delete individual files in order to manipulate external outcomes or hide activity. An application must have administrator access to fully wipe the device, while individual files may not require special permissions to delete depending on their storage location.(Citation: Android DevicePolicyManager 2019) 

Stored data could include a variety of file formats, such as Office files, databases, stored emails, and custom file formats. The impact file deletion will have depends on the type of data as well as the goals and objectives of the adversary, but can include deleting update files to evade detection or deleting attacker-specified files for impact.
kill_chain_phases: kill_chain_name: mitre-mobile-attack
phase_name: defense-evasion
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
x_mitre_version: 1.1
x_mitre_tactic_type: Post-Adversary Device Access
type: attack-pattern
spec_version: 2.1
id: attack-pattern--acf8fd2a-dc98-43b4-8d37-64e10728e591
created: 2022-04-01T18:49:03.892Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1629/002
external_id: T1629.002
source_name: Microsoft MalLockerB
description: D. Venkatesan. (2020, October 8). Sophisticated new Android malware marks the latest evolution of mobile ransomware . Retrieved October 29, 2020.
url: https://www.microsoft.com/security/blog/2020/10/08/sophisticated-new-android-malware-marks-the-latest-evolution-of-mobile-ransomware/
source_name: Android resetPassword
description: Google. (n.d.). DevicePolicyManager. Retrieved October 1, 2019.
url: https://developer.android.com/reference/android/app/admin/DevicePolicyManager.html#resetPassword(java.lang.String,%20int)
source_name: securelist rotexy 2018
description: T. Shishkova, L. Pikman. (2018, November 22). The Rotexy mobile Trojan – banker and ransomware. Retrieved September 23, 2019.
url: https://securelist.com/the-rotexy-mobile-trojan-banker-and-ransomware/88893/
source_name: Talos GPlayed
description: V. Ventura. (2018, October 11). GPlayed Trojan - .Net playing with Google Market . Retrieved November 24, 2020.
url: https://blog.talosintelligence.com/2018/10/gplayedtrojan.html
source_name: NIST Mobile Threat Catalogue
url: https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-22.html
external_id: APP-22
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:49:13.285Z
name: Device Lockout
description: An adversary may seek to inhibit user interaction by locking the legitimate user out of the device. This is typically accomplished by requesting device administrator permissions and then locking the screen using `DevicePolicyManager.lockNow()`. Other novel techniques for locking the user out of the device have been observed, such as showing a persistent overlay, using carefully crafted “call” notification screens, and locking HTML pages in the foreground. These techniques can be very difficult to get around, and typically require booting the device into safe mode to uninstall the malware.(Citation: Microsoft MalLockerB)(Citation: Talos GPlayed)(Citation: securelist rotexy 2018)

Prior to Android 7, device administrators were able to reset the device lock passcode to prevent the user from unlocking the device. The release of Android 7 introduced updates that only allow device or profile owners (e.g. MDMs) to reset the device’s passcode.(Citation: Android resetPassword)
kill_chain_phases: kill_chain_name: mitre-mobile-attack
phase_name: defense-evasion
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
x_mitre_version: 1.1
x_mitre_tactic_type: Post-Adversary Device Access
type: attack-pattern
spec_version: 2.1
id: attack-pattern--b1c95426-2550-4621-8028-ceebf28b3a47
created: 2022-04-05T19:45:03.000Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1417/001
external_id: T1417.001
source_name: Zeltser-Keyboard
description: Lenny Zeltser. (2016, July 30). Security of Third-Party Keyboard Apps on Mobile Devices. Retrieved December 21, 2016.
url: https://zeltser.com/third-party-keyboards-security/
source_name: NIST Mobile Threat Catalogue
url: https://pages.nist.gov/mobile-threat-catalogue/authentication-threats/AUT-13.html
external_id: AUT-13
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:49:14.276Z
name: Keylogging
description: Adversaries may log user keystrokes to intercept credentials or other information from the user as the user types them.

Some methods of keylogging include:

* Masquerading as a legitimate third-party keyboard to record user keystrokes.(Citation: Zeltser-Keyboard) On both Android and iOS, users must explicitly authorize the use of third-party keyboard apps. Users should be advised to use extreme caution before granting this authorization when it is requested.
* Abusing accessibility features. On Android, adversaries may abuse accessibility features to record keystrokes by registering an `AccessibilityService` class, overriding the `onAccessibilityEvent` method, and listening for the `AccessibilityEvent.TYPE_VIEW_TEXT_CHANGED` event type. The event object passed into the function will contain the data that the user typed. 
*Additional methods of keylogging may be possible if root access is available. 

kill_chain_phases: kill_chain_name: mitre-mobile-attack
phase_name: collection
kill_chain_name: mitre-mobile-attack
phase_name: credential-access
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
iOS
x_mitre_version: 1.1
x_mitre_tactic_type: Post-Adversary Device Access
type: attack-pattern
spec_version: 2.1
id: attack-pattern--b327a9c0-e709-495c-aa6e-00b042136e2b
created: 2020-09-11T15:14:33.730Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1582
external_id: T1582
source_name: Android SmsProvider
description: Google. (n.d.). SmsProvider.java. Retrieved September 11, 2020.
url: https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/7e7c274/src/com/android/providers/telephony/SmsProvider.java
source_name: SMS KitKat
description: S.Main, D. Braun. (2013, October 14). Getting Your SMS Apps Ready for KitKat. Retrieved September 11, 2020.
url: https://android-developers.googleblog.com/2013/10/getting-your-sms-apps-ready-for-kitkat.html
source_name: NIST Mobile Threat Catalogue
url: https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-16.html
external_id: APP-16
source_name: NIST Mobile Threat Catalogue
url: https://pages.nist.gov/mobile-threat-catalogue/cellular-threats/CEL-41.html
external_id: CEL-41
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:49:15.008Z
name: SMS Control
description: Adversaries may delete, alter, or send SMS messages without user authorization. This could be used to hide C2 SMS messages, spread malware, or various external effects.

This can be accomplished by requesting the `RECEIVE_SMS` or `SEND_SMS` permissions depending on what the malware is attempting to do. If the app is set as the default SMS handler on the device, the `SMS_DELIVER` broadcast intent can be registered, which allows the app to write to the SMS content provider. The content provider directly modifies the messaging database on the device, which could allow malicious applications with this ability to insert, modify, or delete arbitrary messages on the device.(Citation: SMS KitKat)(Citation: Android SmsProvider)
kill_chain_phases: kill_chain_name: mitre-mobile-attack
phase_name: impact
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
x_mitre_version: 1.1
x_mitre_tactic_type: Post-Adversary Device Access