CyberStrikeus/CyberStrike - Page 87

t1516-input-injection

A malicious application can inject input to the user interface to mimic user interaction through the abuse of Android's accessibility APIs.

t1541-foreground-persistence

Adversaries may abuse Android's `startForeground()` API method to maintain continuous sensor access.

t1575-native-api

Adversaries may use Android’s Native Development Kit (NDK) to write native functions that can achieve execution of binaries or functions.

t1604-proxy-through-victim

Adversaries may use a compromised device as a proxy server to the Internet.

t1617-hooking

Adversaries may utilize hooking to hide the presence of artifacts associated with their behaviors to evade detection.

t1627-001-geofencing

Adversaries may use a device’s geographical location to limit certain malicious behaviors.

t1627-execution-guardrails

Adversaries may use execution guardrails to constrain execution or actions based on adversary supplied and environment specific conditions that are expected to be present on the target.

t1628-001-suppress-application-icon

A malicious application could suppress its icon from being displayed to the user in the application launcher.

t1628-002-user-evasion

Adversaries may attempt to avoid detection by hiding malicious behavior from the user.

t1628-003-conceal-multimedia-files

Adversaries may attempt to hide multimedia files from the user.

t1628-hide-artifacts

Adversaries may attempt to hide artifacts associated with their behaviors to evade detection.

t1629-001-prevent-application-removal

Adversaries may abuse the Android device administration API to prevent the user from uninstalling a target application.

t1629-002-device-lockout

An adversary may seek to inhibit user interaction by locking the legitimate user out of the device.

t1629-003-disable-or-modify-tools

Adversaries may disable security tools to avoid potential detection of their tools and activities.

t1629-impair-defenses

Adversaries may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms.

t1630-001-uninstall-malicious-application

Adversaries may include functionality in malware that uninstalls the malicious application from the device.

t1630-002-file-deletion

Adversaries may wipe a device or delete individual files in order to manipulate external outcomes or hide activity.

t1630-003-disguise-rootjailbreak-indicators

An adversary could use knowledge of the techniques used by security software to evade detection.

t1630-indicator-removal-on-host

Adversaries may delete, alter, or hide generated artifacts on a device, including files, jailbreak status, or the malicious application itself.

t1631-001-ptrace-system-calls

Adversaries may inject malicious code into processes via ptrace (process trace) system calls in order to evade process-based defenses as well as possibly elevate privileges.

t1631-process-injection

Adversaries may inject code into processes in order to evade process-based defenses or even elevate privileges.

t1632-001-code-signing-policy-modification

Adversaries may modify code signing policies to enable execution of applications signed with unofficial or unknown keys.

t1632-subvert-trust-controls

Adversaries may undermine security controls that will either warn users of untrusted activity or prevent execution of untrusted applications.

t1633-001-system-checks

Adversaries may employ various system checks to detect and avoid virtualization and analysis environments.

t1633-virtualizationsandbox-evasion

Adversaries may employ various means to detect and avoid virtualization and analysis environments.

t1655-001-match-legitimate-name-or-location

Adversaries may match or approximate the name or location of legitimate files or resources when naming/placing them.

t1655-masquerading

Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools.

t1670-virtualization-solution

Adversaries may carry out malicious operations using virtualization solutions to escape from Android sandboxes and to avoid detection.

t1417-002-gui-input-capture

Adversaries may mimic common operating system GUI components to prompt users for sensitive information with a seemingly legitimate prompt.

t1634-001-keychain

Adversaries may collect keychain data from an iOS device to acquire credentials.

t1634-credentials-from-password-store

Adversaries may search common password storage locations to obtain user credentials.

t1635-001-uri-hijacking

Adversaries may register Uniform Resource Identifiers (URIs) to intercept sensitive data.

t1635-steal-application-access-token

Adversaries can steal user application access tokens as a means of acquiring credentials to access remote systems and resources.

t1418-001-security-software-discovery

Adversaries may attempt to get a listing of security applications and configurations that are installed on a device.

t1418-software-discovery

Adversaries may attempt to get a listing of applications that are installed on a device.

t1420-file-and-directory-discovery

Adversaries may enumerate files and directories or search in specific device locations for desired information within a filesystem.

t1421-system-network-connections-discovery

Adversaries may attempt to get a listing of network connections to or from the compromised device they are currently accessing or from remote systems by querying for information over the network.

t1422-001-internet-connection-discovery

Adversaries may check for Internet connectivity on compromised systems.

t1422-002-wi-fi-discovery

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

t1422-system-network-configuration-discovery

Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of devices they access or through information discovery of remote systems.