CyberStrikeus/CyberStrike - Page 87

t1516-input-injection

A malicious application can inject input to the user interface to mimic user interaction through the abuse of Android's accessibility APIs.

Langue du texte source : anglais

t1541-foreground-persistence

Adversaries may abuse Android's `startForeground()` API method to maintain continuous sensor access.

Langue du texte source : anglais

t1575-native-api

Adversaries may use Android’s Native Development Kit (NDK) to write native functions that can achieve execution of binaries or functions.

Langue du texte source : anglais

t1604-proxy-through-victim

Adversaries may use a compromised device as a proxy server to the Internet.

Langue du texte source : anglais

t1617-hooking

Adversaries may utilize hooking to hide the presence of artifacts associated with their behaviors to evade detection.

Langue du texte source : anglais

t1627-001-geofencing

Adversaries may use a device’s geographical location to limit certain malicious behaviors.

Langue du texte source : anglais

t1627-execution-guardrails

Adversaries may use execution guardrails to constrain execution or actions based on adversary supplied and environment specific conditions that are expected to be present on the target.

Langue du texte source : anglais

t1628-001-suppress-application-icon

A malicious application could suppress its icon from being displayed to the user in the application launcher.

Langue du texte source : anglais

t1628-002-user-evasion

Adversaries may attempt to avoid detection by hiding malicious behavior from the user.

Langue du texte source : anglais

t1628-003-conceal-multimedia-files

Adversaries may attempt to hide multimedia files from the user.

Langue du texte source : anglais

t1628-hide-artifacts

Adversaries may attempt to hide artifacts associated with their behaviors to evade detection.

Langue du texte source : anglais

t1629-001-prevent-application-removal

Adversaries may abuse the Android device administration API to prevent the user from uninstalling a target application.

Langue du texte source : anglais

t1629-002-device-lockout

An adversary may seek to inhibit user interaction by locking the legitimate user out of the device.

Langue du texte source : anglais

t1629-003-disable-or-modify-tools

Adversaries may disable security tools to avoid potential detection of their tools and activities.

Langue du texte source : anglais

t1629-impair-defenses

Adversaries may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms.

Langue du texte source : anglais

t1630-001-uninstall-malicious-application

Adversaries may include functionality in malware that uninstalls the malicious application from the device.

Langue du texte source : anglais

t1630-002-file-deletion

Adversaries may wipe a device or delete individual files in order to manipulate external outcomes or hide activity.

Langue du texte source : anglais

t1630-003-disguise-rootjailbreak-indicators

An adversary could use knowledge of the techniques used by security software to evade detection.

Langue du texte source : anglais

t1630-indicator-removal-on-host

Adversaries may delete, alter, or hide generated artifacts on a device, including files, jailbreak status, or the malicious application itself.

Langue du texte source : anglais

t1631-001-ptrace-system-calls

Adversaries may inject malicious code into processes via ptrace (process trace) system calls in order to evade process-based defenses as well as possibly elevate privileges.

Langue du texte source : anglais

t1631-process-injection

Adversaries may inject code into processes in order to evade process-based defenses or even elevate privileges.

Langue du texte source : anglais

t1632-001-code-signing-policy-modification

Adversaries may modify code signing policies to enable execution of applications signed with unofficial or unknown keys.

Langue du texte source : anglais

t1632-subvert-trust-controls

Adversaries may undermine security controls that will either warn users of untrusted activity or prevent execution of untrusted applications.

Langue du texte source : anglais

t1633-001-system-checks

Adversaries may employ various system checks to detect and avoid virtualization and analysis environments.

Langue du texte source : anglais

t1633-virtualizationsandbox-evasion

Adversaries may employ various means to detect and avoid virtualization and analysis environments.

Langue du texte source : anglais

t1655-001-match-legitimate-name-or-location

Adversaries may match or approximate the name or location of legitimate files or resources when naming/placing them.

Langue du texte source : anglais

t1655-masquerading

Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools.

Langue du texte source : anglais

t1670-virtualization-solution

Adversaries may carry out malicious operations using virtualization solutions to escape from Android sandboxes and to avoid detection.

Langue du texte source : anglais

t1417-002-gui-input-capture

Adversaries may mimic common operating system GUI components to prompt users for sensitive information with a seemingly legitimate prompt.

Langue du texte source : anglais

t1634-001-keychain

Adversaries may collect keychain data from an iOS device to acquire credentials.

Langue du texte source : anglais

t1634-credentials-from-password-store

Adversaries may search common password storage locations to obtain user credentials.

Langue du texte source : anglais

t1635-001-uri-hijacking

Adversaries may register Uniform Resource Identifiers (URIs) to intercept sensitive data.

Langue du texte source : anglais

t1635-steal-application-access-token

Adversaries can steal user application access tokens as a means of acquiring credentials to access remote systems and resources.

Langue du texte source : anglais

t1418-001-security-software-discovery

Adversaries may attempt to get a listing of security applications and configurations that are installed on a device.

Langue du texte source : anglais

t1418-software-discovery

Adversaries may attempt to get a listing of applications that are installed on a device.

Langue du texte source : anglais

t1420-file-and-directory-discovery

Adversaries may enumerate files and directories or search in specific device locations for desired information within a filesystem.

Langue du texte source : anglais

t1421-system-network-connections-discovery

Adversaries may attempt to get a listing of network connections to or from the compromised device they are currently accessing or from remote systems by querying for information over the network.

Langue du texte source : anglais

t1422-001-internet-connection-discovery

Adversaries may check for Internet connectivity on compromised systems.

Langue du texte source : anglais

t1422-002-wi-fi-discovery

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

Langue du texte source : anglais

t1422-system-network-configuration-discovery

Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of devices they access or through information discovery of remote systems.

Langue du texte source : anglais