CyberStrikeus/CyberStrike - الصفحة ٨٧

t1516-input-injection

A malicious application can inject input to the user interface to mimic user interaction through the abuse of Android's accessibility APIs.

لغة النص الأصلي: الإنجليزية

t1541-foreground-persistence

Adversaries may abuse Android's `startForeground()` API method to maintain continuous sensor access.

لغة النص الأصلي: الإنجليزية

t1575-native-api

Adversaries may use Android’s Native Development Kit (NDK) to write native functions that can achieve execution of binaries or functions.

لغة النص الأصلي: الإنجليزية

t1604-proxy-through-victim

Adversaries may use a compromised device as a proxy server to the Internet.

لغة النص الأصلي: الإنجليزية

t1617-hooking

Adversaries may utilize hooking to hide the presence of artifacts associated with their behaviors to evade detection.

لغة النص الأصلي: الإنجليزية

t1627-001-geofencing

Adversaries may use a device’s geographical location to limit certain malicious behaviors.

لغة النص الأصلي: الإنجليزية

t1627-execution-guardrails

Adversaries may use execution guardrails to constrain execution or actions based on adversary supplied and environment specific conditions that are expected to be present on the target.

لغة النص الأصلي: الإنجليزية

t1628-001-suppress-application-icon

A malicious application could suppress its icon from being displayed to the user in the application launcher.

لغة النص الأصلي: الإنجليزية

t1628-002-user-evasion

Adversaries may attempt to avoid detection by hiding malicious behavior from the user.

لغة النص الأصلي: الإنجليزية

t1628-003-conceal-multimedia-files

Adversaries may attempt to hide multimedia files from the user.

لغة النص الأصلي: الإنجليزية

t1628-hide-artifacts

Adversaries may attempt to hide artifacts associated with their behaviors to evade detection.

لغة النص الأصلي: الإنجليزية

t1629-001-prevent-application-removal

Adversaries may abuse the Android device administration API to prevent the user from uninstalling a target application.

لغة النص الأصلي: الإنجليزية

t1629-002-device-lockout

An adversary may seek to inhibit user interaction by locking the legitimate user out of the device.

لغة النص الأصلي: الإنجليزية

t1629-003-disable-or-modify-tools

Adversaries may disable security tools to avoid potential detection of their tools and activities.

لغة النص الأصلي: الإنجليزية

t1629-impair-defenses

Adversaries may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms.

لغة النص الأصلي: الإنجليزية

t1630-001-uninstall-malicious-application

Adversaries may include functionality in malware that uninstalls the malicious application from the device.

لغة النص الأصلي: الإنجليزية

t1630-002-file-deletion

Adversaries may wipe a device or delete individual files in order to manipulate external outcomes or hide activity.

لغة النص الأصلي: الإنجليزية

t1630-003-disguise-rootjailbreak-indicators

An adversary could use knowledge of the techniques used by security software to evade detection.

لغة النص الأصلي: الإنجليزية

t1630-indicator-removal-on-host

Adversaries may delete, alter, or hide generated artifacts on a device, including files, jailbreak status, or the malicious application itself.

لغة النص الأصلي: الإنجليزية

t1631-001-ptrace-system-calls

Adversaries may inject malicious code into processes via ptrace (process trace) system calls in order to evade process-based defenses as well as possibly elevate privileges.

لغة النص الأصلي: الإنجليزية

t1631-process-injection

Adversaries may inject code into processes in order to evade process-based defenses or even elevate privileges.

لغة النص الأصلي: الإنجليزية

t1632-001-code-signing-policy-modification

Adversaries may modify code signing policies to enable execution of applications signed with unofficial or unknown keys.

لغة النص الأصلي: الإنجليزية

t1632-subvert-trust-controls

Adversaries may undermine security controls that will either warn users of untrusted activity or prevent execution of untrusted applications.

لغة النص الأصلي: الإنجليزية

t1633-001-system-checks

Adversaries may employ various system checks to detect and avoid virtualization and analysis environments.

لغة النص الأصلي: الإنجليزية

t1633-virtualizationsandbox-evasion

Adversaries may employ various means to detect and avoid virtualization and analysis environments.

لغة النص الأصلي: الإنجليزية

t1655-001-match-legitimate-name-or-location

Adversaries may match or approximate the name or location of legitimate files or resources when naming/placing them.

لغة النص الأصلي: الإنجليزية

t1655-masquerading

Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools.

لغة النص الأصلي: الإنجليزية

t1670-virtualization-solution

Adversaries may carry out malicious operations using virtualization solutions to escape from Android sandboxes and to avoid detection.

لغة النص الأصلي: الإنجليزية

t1417-002-gui-input-capture

Adversaries may mimic common operating system GUI components to prompt users for sensitive information with a seemingly legitimate prompt.

لغة النص الأصلي: الإنجليزية

t1634-001-keychain

Adversaries may collect keychain data from an iOS device to acquire credentials.

لغة النص الأصلي: الإنجليزية

t1634-credentials-from-password-store

Adversaries may search common password storage locations to obtain user credentials.

لغة النص الأصلي: الإنجليزية

t1635-001-uri-hijacking

Adversaries may register Uniform Resource Identifiers (URIs) to intercept sensitive data.

لغة النص الأصلي: الإنجليزية

t1635-steal-application-access-token

Adversaries can steal user application access tokens as a means of acquiring credentials to access remote systems and resources.

لغة النص الأصلي: الإنجليزية

t1418-001-security-software-discovery

Adversaries may attempt to get a listing of security applications and configurations that are installed on a device.

لغة النص الأصلي: الإنجليزية

t1418-software-discovery

Adversaries may attempt to get a listing of applications that are installed on a device.

لغة النص الأصلي: الإنجليزية

t1420-file-and-directory-discovery

Adversaries may enumerate files and directories or search in specific device locations for desired information within a filesystem.

لغة النص الأصلي: الإنجليزية

t1421-system-network-connections-discovery

Adversaries may attempt to get a listing of network connections to or from the compromised device they are currently accessing or from remote systems by querying for information over the network.

لغة النص الأصلي: الإنجليزية

t1422-001-internet-connection-discovery

Adversaries may check for Internet connectivity on compromised systems.

لغة النص الأصلي: الإنجليزية

t1422-002-wi-fi-discovery

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

لغة النص الأصلي: الإنجليزية

t1422-system-network-configuration-discovery

Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of devices they access or through information discovery of remote systems.

لغة النص الأصلي: الإنجليزية