CyberStrikeus/CyberStrike - Página 87

t1516-input-injection

A malicious application can inject input to the user interface to mimic user interaction through the abuse of Android's accessibility APIs.

Idioma del texto original: inglés

t1541-foreground-persistence

Adversaries may abuse Android's `startForeground()` API method to maintain continuous sensor access.

Idioma del texto original: inglés

t1575-native-api

Adversaries may use Android’s Native Development Kit (NDK) to write native functions that can achieve execution of binaries or functions.

Idioma del texto original: inglés

t1604-proxy-through-victim

Adversaries may use a compromised device as a proxy server to the Internet.

Idioma del texto original: inglés

t1617-hooking

Adversaries may utilize hooking to hide the presence of artifacts associated with their behaviors to evade detection.

Idioma del texto original: inglés

t1627-001-geofencing

Adversaries may use a device’s geographical location to limit certain malicious behaviors.

Idioma del texto original: inglés

t1627-execution-guardrails

Adversaries may use execution guardrails to constrain execution or actions based on adversary supplied and environment specific conditions that are expected to be present on the target.

Idioma del texto original: inglés

t1628-001-suppress-application-icon

A malicious application could suppress its icon from being displayed to the user in the application launcher.

Idioma del texto original: inglés

t1628-002-user-evasion

Adversaries may attempt to avoid detection by hiding malicious behavior from the user.

Idioma del texto original: inglés

t1628-003-conceal-multimedia-files

Adversaries may attempt to hide multimedia files from the user.

Idioma del texto original: inglés

t1628-hide-artifacts

Adversaries may attempt to hide artifacts associated with their behaviors to evade detection.

Idioma del texto original: inglés

t1629-001-prevent-application-removal

Adversaries may abuse the Android device administration API to prevent the user from uninstalling a target application.

Idioma del texto original: inglés

t1629-002-device-lockout

An adversary may seek to inhibit user interaction by locking the legitimate user out of the device.

Idioma del texto original: inglés

t1629-003-disable-or-modify-tools

Adversaries may disable security tools to avoid potential detection of their tools and activities.

Idioma del texto original: inglés

t1629-impair-defenses

Adversaries may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms.

Idioma del texto original: inglés

t1630-001-uninstall-malicious-application

Adversaries may include functionality in malware that uninstalls the malicious application from the device.

Idioma del texto original: inglés

t1630-002-file-deletion

Adversaries may wipe a device or delete individual files in order to manipulate external outcomes or hide activity.

Idioma del texto original: inglés

t1630-003-disguise-rootjailbreak-indicators

An adversary could use knowledge of the techniques used by security software to evade detection.

Idioma del texto original: inglés

t1630-indicator-removal-on-host

Adversaries may delete, alter, or hide generated artifacts on a device, including files, jailbreak status, or the malicious application itself.

Idioma del texto original: inglés

t1631-001-ptrace-system-calls

Adversaries may inject malicious code into processes via ptrace (process trace) system calls in order to evade process-based defenses as well as possibly elevate privileges.

Idioma del texto original: inglés

t1631-process-injection

Adversaries may inject code into processes in order to evade process-based defenses or even elevate privileges.

Idioma del texto original: inglés

t1632-001-code-signing-policy-modification

Adversaries may modify code signing policies to enable execution of applications signed with unofficial or unknown keys.

Idioma del texto original: inglés

t1632-subvert-trust-controls

Adversaries may undermine security controls that will either warn users of untrusted activity or prevent execution of untrusted applications.

Idioma del texto original: inglés

t1633-001-system-checks

Adversaries may employ various system checks to detect and avoid virtualization and analysis environments.

Idioma del texto original: inglés

t1633-virtualizationsandbox-evasion

Adversaries may employ various means to detect and avoid virtualization and analysis environments.

Idioma del texto original: inglés

t1655-001-match-legitimate-name-or-location

Adversaries may match or approximate the name or location of legitimate files or resources when naming/placing them.

Idioma del texto original: inglés

t1655-masquerading

Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools.

Idioma del texto original: inglés

t1670-virtualization-solution

Adversaries may carry out malicious operations using virtualization solutions to escape from Android sandboxes and to avoid detection.

Idioma del texto original: inglés

t1417-002-gui-input-capture

Adversaries may mimic common operating system GUI components to prompt users for sensitive information with a seemingly legitimate prompt.

Idioma del texto original: inglés

t1634-001-keychain

Adversaries may collect keychain data from an iOS device to acquire credentials.

Idioma del texto original: inglés

t1634-credentials-from-password-store

Adversaries may search common password storage locations to obtain user credentials.

Idioma del texto original: inglés

t1635-001-uri-hijacking

Adversaries may register Uniform Resource Identifiers (URIs) to intercept sensitive data.

Idioma del texto original: inglés

t1635-steal-application-access-token

Adversaries can steal user application access tokens as a means of acquiring credentials to access remote systems and resources.

Idioma del texto original: inglés

t1418-001-security-software-discovery

Adversaries may attempt to get a listing of security applications and configurations that are installed on a device.

Idioma del texto original: inglés

t1418-software-discovery

Adversaries may attempt to get a listing of applications that are installed on a device.

Idioma del texto original: inglés

t1420-file-and-directory-discovery

Adversaries may enumerate files and directories or search in specific device locations for desired information within a filesystem.

Idioma del texto original: inglés

t1421-system-network-connections-discovery

Adversaries may attempt to get a listing of network connections to or from the compromised device they are currently accessing or from remote systems by querying for information over the network.

Idioma del texto original: inglés

t1422-001-internet-connection-discovery

Adversaries may check for Internet connectivity on compromised systems.

Idioma del texto original: inglés

t1422-002-wi-fi-discovery

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

Idioma del texto original: inglés

t1422-system-network-configuration-discovery

Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of devices they access or through information discovery of remote systems.

Idioma del texto original: inglés