MITRE ATT&CK Mobile x Bidda =========================== 142 ATT&CK for Mobile Devices (Android, iOS) entries across 14 tactics, each linked to its Bidda compliance node. Last updated: 2026-07-19 | Source: https://bidda.com/mitre-mobile Tactics: Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact, Network Effects, other [initial-access] Initial Access - T1456 Drive-By Compromise Adversary exploitation of victim browsers and WebViews via malicious web content to gain initial mobile access. Mobile browser zero-days (Operation Triangulation 2023, NSO Group exploits) and malicious WebView abuse in mobile apps are... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1456-drive-by-compromise - T1458 Replication Through Removable Media An ATT&CK for Mobile Initial Access and Lateral Movement technique. Adversaries may move onto devices by exploiting or copying malware to devices connected via USB. In the case of Lateral Movement, adversaries may utilize the physical... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1458-replication-through-removable-media - T1461 Lockscreen Bypass An ATT&CK for Mobile Initial Access technique. An adversary with physical access to a mobile device may seek to bypass the device's lockscreen. Several methods exist to accomplish this, including: * Biometric spoofing: If biometric... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1461-lockscreen-bypass - T1474 Supply Chain Compromise Adversary compromise of mobile applications through the software supply chain - malicious code injected into Google Play / Apple App Store apps, sideloaded APK distribution, third-party SDK compromise, and tampered firmware. Pegasus... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1474-supply-chain-compromise - T1474.001 Compromise Software Dependencies and Development Tools An ATT&CK for Mobile Initial Access sub-technique of T1474 (Supply Chain Compromise). Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise.... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1474-001-compromise-software-dependencies-and-development-tools - T1474.002 Compromise Hardware Supply Chain An ATT&CK for Mobile Initial Access sub-technique of T1474 (Supply Chain Compromise). Adversaries may manipulate hardware components in products prior to receipt by a final consumer for the purpose of data or system compromise. By... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1474-002-compromise-hardware-supply-chain - T1474.003 Compromise Software Supply Chain An ATT&CK for Mobile Initial Access sub-technique of T1474 (Supply Chain Compromise). Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1474-003-compromise-software-supply-chain - T1660 Phishing An ATT&CK for Mobile Initial Access technique. Adversaries may send malicious content to users in order to gain access to their mobile devices. All forms of phishing are electronically delivered social engineering. Adversaries can... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1660-phishing - T1661 Application Versioning An ATT&CK for Mobile Initial Access and Defense Evasion technique. An adversary may push an update to a previously benign application to add malicious code. This can be accomplished by pushing an initially benign, functional application... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1661-application-versioning - T1664 Exploitation for Initial Access An ATT&CK for Mobile Initial Access technique. Adversaries may exploit software vulnerabilities to gain initial access to a mobile device. This can be accomplished in a variety of ways. Vulnerabilities may be present in applications,... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1664-exploitation-for-initial-access [execution] Execution - T1575 Native API An ATT&CK for Mobile Defense Evasion and Execution technique. Adversaries may use Android's Native Development Kit (NDK) to write native functions that can achieve execution of binaries or functions. Like system calls on a traditional... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1575-native-api - T1603 Scheduled Task/Job An ATT&CK for Mobile Execution and Persistence technique. Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. On Android and iOS, APIs and libraries exist to facilitate... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1603-scheduled-task-job - T1623 Command and Scripting Interpreter Adversary use of mobile-native command interpreters and scripting environments (Unix Shell on rooted Android, JavaScript injection in WebView, mobile remote-management tools) to execute malicious code. Pegasus, Predator, and most... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1623-command-and-scripting-interpreter - T1623.001 Unix Shell An ATT&CK for Mobile Execution sub-technique of T1623 (Command and Scripting Interpreter). Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the underlying command prompts on Android and iOS devices.... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1623-001-unix-shell - T1658 Exploitation for Client Execution An ATT&CK for Mobile Execution technique. Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to insecure coding practices that can lead to unanticipated... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1658-exploitation-for-client-execution [persistence] Persistence - T1398 Boot or Logon Initialization Scripts An ATT&CK for Mobile Persistence technique. Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence. Initialization scripts are part of the underlying operating system and are not... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1398-boot-or-logon-initialization-scripts - T1541 Foreground Persistence An ATT&CK for Mobile Defense Evasion and Persistence technique. Adversaries may abuse Android's startForeground() API method to maintain continuous sensor access. Beginning in Android 9, idle applications running in the background no... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1541-foreground-persistence - T1577 Compromise Application Executable Adversary modification of legitimate mobile application binaries to add malicious code while preserving original functionality. Re-signed APKs distributed via sideloading, third-party app stores, and supply-chain compromise are the... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1577-compromise-application-executable - T1603 Scheduled Task/Job An ATT&CK for Mobile Execution and Persistence technique. Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. On Android and iOS, APIs and libraries exist to facilitate... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1603-scheduled-task-job - T1624 Event Triggered Execution An ATT&CK for Mobile Persistence technique. Adversaries may establish persistence using system mechanisms that trigger execution based on specific events. Mobile operating systems have means to subscribe to events such as receiving an... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1624-event-triggered-execution - T1624.001 Broadcast Receivers An ATT&CK for Mobile Persistence sub-technique of T1624 (Event Triggered Execution). Adversaries may establish persistence using system mechanisms that trigger execution based on specific events. Mobile operating systems have means to... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1624-001-broadcast-receivers - T1625 Hijack Execution Flow An ATT&CK for Mobile Persistence technique. Adversaries may execute their own malicious payloads by hijacking the way operating systems run applications. Hijacking execution flow can be for the purposes of persistence since this... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1625-hijack-execution-flow - T1625.001 System Runtime API Hijacking An ATT&CK for Mobile Persistence sub-technique of T1625 (Hijack Execution Flow). Adversaries may execute their own malicious payloads by hijacking the way an operating system runs applications. Hijacking execution flow can be for the... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1625-001-system-runtime-api-hijacking - T1645 Compromise Client Software Binary An ATT&CK for Mobile Persistence technique. Adversaries may modify system software binaries to establish persistent access to devices. System software binaries are used by the underlying operating system and users over adb or terminal... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1645-compromise-client-software-binary [privilege-escalation] Privilege Escalation - T1404 Exploitation for Privilege Escalation An ATT&CK for Mobile Privilege Escalation technique. Adversaries may exploit software vulnerabilities in order to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1404-exploitation-for-privilege-escalation - T1626 Abuse Elevation Control Mechanism Adversary bypass of OS permission controls to gain elevated privileges. Includes root-jailbreak exploitation (CheckRain, unc0ver, Magisk-based) and Device Administration API abuse on Android. Modern attacks chain... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1626-abuse-elevation-control-mechanism - T1626.001 Device Administrator Permissions An ATT&CK for Mobile Privilege Escalation sub-technique of T1626 (Abuse Elevation Control Mechanism). Adversaries may abuse Android's device administration API to obtain a higher degree of control over the device. By abusing the API,... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1626-001-device-administrator-permissions - T1631 Process Injection An ATT&CK for Mobile Defense Evasion and Privilege Escalation technique. Adversaries may inject code into processes in order to evade process-based defenses or even elevate privileges. Process injection is a method of executing... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1631-process-injection - T1631.001 Ptrace System Calls An ATT&CK for Mobile Defense Evasion and Privilege Escalation sub-technique of T1631 (Process Injection). Adversaries may inject malicious code into processes via ptrace (process trace) system calls in order to evade process-based... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1631-001-ptrace-system-calls [defense-evasion] Defense Evasion - T1406 Obfuscated Files or Information An ATT&CK for Mobile Defense Evasion technique. Adversaries may attempt to make a payload or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the device or in transit. This is... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1406-obfuscated-files-or-information - T1406.001 Steganography An ATT&CK for Mobile Defense Evasion sub-technique of T1406 (Obfuscated Files or Information). Adversaries may use steganography techniques in order to prevent the detection of hidden information. Steganographic techniques can be used... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1406-001-steganography - T1406.002 Software Packing An ATT&CK for Mobile Defense Evasion sub-technique of T1406 (Obfuscated Files or Information). Adversaries may perform software packing to conceal their code. Software packing is a method of compressing or encrypting an executable.... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1406-002-software-packing - T1407 Download New Code at Runtime An ATT&CK for Mobile Defense Evasion technique. Adversaries may download and execute dynamic code not included in the original application package after installation. This technique is primarily used to evade static analysis checks and... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1407-download-new-code-at-runtime - T1516 Input Injection An ATT&CK for Mobile Defense Evasion and Impact technique. A malicious application can inject input to the user interface to mimic user interaction through the abuse of Android's accessibility APIs. Input Injection can be achieved using... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1516-input-injection - T1541 Foreground Persistence An ATT&CK for Mobile Defense Evasion and Persistence technique. Adversaries may abuse Android's startForeground() API method to maintain continuous sensor access. Beginning in Android 9, idle applications running in the background no... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1541-foreground-persistence - T1575 Native API An ATT&CK for Mobile Defense Evasion and Execution technique. Adversaries may use Android's Native Development Kit (NDK) to write native functions that can achieve execution of binaries or functions. Like system calls on a traditional... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1575-native-api - T1604 Proxy Through Victim An ATT&CK for Mobile Defense Evasion technique. Adversaries may use a compromised device as a proxy server to the Internet. By utilizing a proxy, adversaries hide the true IP address of their C2 server and associated infrastructure from... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1604-proxy-through-victim - T1617 Hooking An ATT&CK for Mobile Defense Evasion technique. Adversaries may utilize hooking to hide the presence of artifacts associated with their behaviors to evade detection. Hooking can be used to modify return values or data structures of... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1617-hooking - T1627 Execution Guardrails An ATT&CK for Mobile Defense Evasion technique. Adversaries may use execution guardrails to constrain execution or actions based on adversary supplied and environment specific conditions that are expected to be present on the target.... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1627-execution-guardrails - T1627.001 Geofencing An ATT&CK for Mobile Defense Evasion sub-technique of T1627 (Execution Guardrails). Adversaries may use a device's geographical location to limit certain malicious behaviors. For example, malware operators may limit the distribution of... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1627-001-geofencing - T1628 Hide Artifacts An ATT&CK for Mobile Defense Evasion technique. Adversaries may attempt to hide artifacts associated with their behaviors to evade detection. Mobile operating systems have features and developer APIs to hide various artifacts, such as... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1628-hide-artifacts - T1628.001 Suppress Application Icon An ATT&CK for Mobile Defense Evasion sub-technique of T1628 (Hide Artifacts). A malicious application could suppress its icon from being displayed to the user in the application launcher. This hides the fact that it is installed, and... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1628-001-suppress-application-icon - T1628.002 User Evasion An ATT&CK for Mobile Defense Evasion sub-technique of T1628 (Hide Artifacts). Adversaries may attempt to avoid detection by hiding malicious behavior from the user. By doing this, an adversary's modifications would most likely remain... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1628-002-user-evasion - T1628.003 Conceal Multimedia Files An ATT&CK for Mobile Defense Evasion sub-technique of T1628 (Hide Artifacts). Adversaries may attempt to hide multimedia files from the user. By doing so, adversaries may conceal captured files, such as pictures, videos and/or... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1628-003-conceal-multimedia-files - T1629 Impair Defenses An ATT&CK for Mobile Defense Evasion technique. Adversaries may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms. This not only involves impairing preventative defenses, such as... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1629-impair-defenses - T1629.001 Prevent Application Removal An ATT&CK for Mobile Defense Evasion sub-technique of T1629 (Impair Defenses). Adversaries may abuse the Android device administration API to prevent the user from uninstalling a target application. In earlier versions of Android,... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1629-001-prevent-application-removal - T1629.002 Device Lockout An ATT&CK for Mobile Defense Evasion sub-technique of T1629 (Impair Defenses). An adversary may seek to inhibit user interaction by locking the legitimate user out of the device. This is typically accomplished by requesting device... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1629-002-device-lockout - T1629.003 Disable or Modify Tools An ATT&CK for Mobile Defense Evasion sub-technique of T1629 (Impair Defenses). Adversaries may disable security tools to avoid potential detection of their tools and activities. This can take the form of disabling security software,... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1629-003-disable-or-modify-tools - T1630 Indicator Removal on Host An ATT&CK for Mobile Defense Evasion technique. Adversaries may delete, alter, or hide generated artifacts on a device, including files, jailbreak status, or the malicious application itself. These actions may interfere with event... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1630-indicator-removal-on-host - T1630.001 Uninstall Malicious Application An ATT&CK for Mobile Defense Evasion sub-technique of T1630 (Indicator Removal on Host). Adversaries may include functionality in malware that uninstalls the malicious application from the device. This can be achieved by: * Abusing... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1630-001-uninstall-malicious-application - T1630.002 File Deletion An ATT&CK for Mobile Defense Evasion sub-technique of T1630 (Indicator Removal on Host). Adversaries may wipe a device or delete individual files in order to manipulate external outcomes or hide activity. An application must have... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1630-002-file-deletion - T1630.003 Disguise Root/Jailbreak Indicators An ATT&CK for Mobile Defense Evasion sub-technique of T1630 (Indicator Removal on Host). An adversary could use knowledge of the techniques used by security software to evade detection. For example, some mobile security products perform... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1630-003-disguise-root-jailbreak-indicators - T1631 Process Injection An ATT&CK for Mobile Defense Evasion and Privilege Escalation technique. Adversaries may inject code into processes in order to evade process-based defenses or even elevate privileges. Process injection is a method of executing... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1631-process-injection - T1631.001 Ptrace System Calls An ATT&CK for Mobile Defense Evasion and Privilege Escalation sub-technique of T1631 (Process Injection). Adversaries may inject malicious code into processes via ptrace (process trace) system calls in order to evade process-based... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1631-001-ptrace-system-calls - T1632 Subvert Trust Controls An ATT&CK for Mobile Defense Evasion technique. Adversaries may undermine security controls that will either warn users of untrusted activity or prevent execution of untrusted applications. Operating systems and security products may... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1632-subvert-trust-controls - T1632.001 Code Signing Policy Modification An ATT&CK for Mobile Defense Evasion sub-technique of T1632 (Subvert Trust Controls). Adversaries may modify code signing policies to enable execution of applications signed with unofficial or unknown keys. Code signing provides a level... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1632-001-code-signing-policy-modification - T1633 Virtualization/Sandbox Evasion An ATT&CK for Mobile Defense Evasion technique. Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors after checking for the presence of artifacts... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1633-virtualization-sandbox-evasion - T1633.001 System Checks An ATT&CK for Mobile Defense Evasion sub-technique of T1633 (Virtualization/Sandbox Evasion). Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behavior... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1633-001-system-checks - T1655 Masquerading An ATT&CK for Mobile Defense Evasion technique. Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name, location, or... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1655-masquerading - T1655.001 Match Legitimate Name or Location An ATT&CK for Mobile Defense Evasion sub-technique of T1655 (Masquerading). Adversaries may match or approximate the name or location of legitimate files or resources when naming/placing them. This is done for the sake of evading... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1655-001-match-legitimate-name-or-location - T1661 Application Versioning An ATT&CK for Mobile Initial Access and Defense Evasion technique. An adversary may push an update to a previously benign application to add malicious code. This can be accomplished by pushing an initially benign, functional application... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1661-application-versioning [credential-access] Credential Access - T1414 Clipboard Data An ATT&CK for Mobile Collection and Credential Access technique. Adversaries may abuse clipboard manager APIs to obtain sensitive information copied to the device clipboard. For example, passwords being copied and pasted from a password... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1414-clipboard-data - T1417 Input Capture Adversary capture of user input via keylogging, accessibility-service abuse, overlay attacks, or screenshot interception. Cerberus, BRATA, ERMAC, and Hook Android bankers abuse accessibility services to read PIN entry. iOS variants... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1417-input-capture - T1417.001 Keylogging An ATT&CK for Mobile Collection and Credential Access sub-technique of T1417 (Input Capture). Adversaries may log user keystrokes to intercept credentials or other information from the user as the user types them. Some methods of... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1417-001-keylogging - T1417.002 GUI Input Capture An ATT&CK for Mobile Credential Access and Collection sub-technique of T1417 (Input Capture). Adversaries may mimic common operating system GUI components to prompt users for sensitive information with a seemingly legitimate prompt. The... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1417-002-gui-input-capture - T1517 Access Notifications An ATT&CK for Mobile Collection and Credential Access technique. Adversaries may collect data within notifications sent by the operating system or other applications. Notifications may contain sensitive data such as one-time... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1517-access-notifications - T1634 Credentials from Password Store An ATT&CK for Mobile Credential Access technique. Adversaries may search common password storage locations to obtain user credentials. Passwords can be stored in several places on a device, depending on the operating system or... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1634-credentials-from-password-store - T1634.001 Keychain An ATT&CK for Mobile Credential Access sub-technique of T1634 (Credentials from Password Store). Adversaries may collect keychain data from an iOS device to acquire credentials. Keychains are the built-in way for iOS to keep track of... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1634-001-keychain - T1635 Steal Application Access Token An ATT&CK for Mobile Credential Access technique. Adversaries can steal user application access tokens as a means of acquiring credentials to access remote systems and resources. This can occur through social engineering or URI... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1635-steal-application-access-token - T1635.001 URI Hijacking An ATT&CK for Mobile Credential Access sub-technique of T1635 (Steal Application Access Token). Adversaries may register Uniform Resource Identifiers (URIs) to intercept sensitive data. Applications regularly register URIs with the... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1635-001-uri-hijacking [discovery] Discovery - T1418 Software Discovery Adversary enumeration of installed applications on a mobile device to identify target apps, security tools, and exploitation opportunities. Modern Android malware (Joker, FluBot, Cerberus) and iOS spyware enumerate banking apps, MDM... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1418-software-discovery - T1418.001 Security Software Discovery An ATT&CK for Mobile Discovery sub-technique of T1418 (Software Discovery). Adversaries may attempt to get a listing of security applications and configurations that are installed on a device. This may include things such as mobile... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1418-001-security-software-discovery - T1420 File and Directory Discovery An ATT&CK for Mobile Discovery technique. Adversaries may enumerate files and directories or search in specific device locations for desired information within a filesystem. Adversaries may use the information from File and Directory... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1420-file-and-directory-discovery - T1421 System Network Connections Discovery An ATT&CK for Mobile Discovery technique. Adversaries may attempt to get a listing of network connections to or from the compromised device they are currently accessing or from remote systems by querying for information over the... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1421-system-network-connections-discovery - T1422 System Network Configuration Discovery An ATT&CK for Mobile Discovery technique. Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of devices they access or through information discovery of remote systems.... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1422-system-network-configuration-discovery - T1422.001 Internet Connection Discovery An ATT&CK for Mobile Discovery sub-technique of T1422 (System Network Configuration Discovery). Adversaries may check for Internet connectivity on compromised systems. This may be performed during automated discovery and can be... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1422-001-internet-connection-discovery - T1422.002 Wi-Fi Discovery An ATT&CK for Mobile Discovery sub-technique of T1422 (System Network Configuration Discovery). Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems. Adversaries may... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1422-002-wi-fi-discovery - T1423 Network Service Scanning An ATT&CK for Mobile Discovery technique. Adversaries may attempt to get a listing of services running on remote hosts, including those that may be vulnerable to remote software exploitation. Methods to acquire this information include... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1423-network-service-scanning - T1424 Process Discovery An ATT&CK for Mobile Discovery technique. Adversaries may attempt to get information about running processes on a device. Information obtained could be used to gain an understanding of common software/applications running on devices... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1424-process-discovery - T1426 System Information Discovery An ATT&CK for Mobile Discovery technique. Adversaries may attempt to get detailed information about a device's operating system and hardware, including versions, patches, and architecture. Adversaries may use the information from System... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1426-system-information-discovery - T1430 Location Tracking Adversary access to a victim devices geolocation - GPS, cellular tower triangulation, Wi-Fi positioning, IP geolocation. Pegasus, Predator, FinSpy, and most commercial spyware exfiltrate location data continuously. Compliance: NIST SP... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1430-location-tracking - T1430.001 Remote Device Management Services An ATT&CK for Mobile Collection and Discovery sub-technique of T1430 (Location Tracking). An adversary may use access to cloud services (e.g. Google's Android Device Manager or Apple iCloud's Find my iPhone) or to an enterprise mobility... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1430-001-remote-device-management-services - T1430.002 Impersonate SS7 Nodes An ATT&CK for Mobile Collection and Discovery sub-technique of T1430 (Location Tracking). Adversaries may exploit the lack of authentication in signaling system network nodes to track the to track the location of mobile devices by... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1430-002-impersonate-ss7-nodes [lateral-movement] Lateral Movement - T1428 Exploitation of Remote Services An ATT&CK for Mobile Lateral Movement technique. Adversaries may exploit remote services of enterprise servers, workstations, or other resources to gain unauthorized access to internal systems once inside of a network. Adversaries may... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1428-exploitation-of-remote-services - T1458 Replication Through Removable Media An ATT&CK for Mobile Initial Access and Lateral Movement technique. Adversaries may move onto devices by exploiting or copying malware to devices connected via USB. In the case of Lateral Movement, adversaries may utilize the physical... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1458-replication-through-removable-media [collection] Collection - T1409 Stored Application Data Adversary access to data stored in mobile app private storage, shared storage, or cloud-backed app data. Banking trojans, infostealers (Lumma Mobile, Vidar Mobile), and commercial spyware target stored credentials, session tokens,... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1409-stored-application-data - T1414 Clipboard Data An ATT&CK for Mobile Collection and Credential Access technique. Adversaries may abuse clipboard manager APIs to obtain sensitive information copied to the device clipboard. For example, passwords being copied and pasted from a password... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1414-clipboard-data - T1417 Input Capture Adversary capture of user input via keylogging, accessibility-service abuse, overlay attacks, or screenshot interception. Cerberus, BRATA, ERMAC, and Hook Android bankers abuse accessibility services to read PIN entry. iOS variants... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1417-input-capture - T1417.001 Keylogging An ATT&CK for Mobile Collection and Credential Access sub-technique of T1417 (Input Capture). Adversaries may log user keystrokes to intercept credentials or other information from the user as the user types them. Some methods of... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1417-001-keylogging - T1417.002 GUI Input Capture An ATT&CK for Mobile Credential Access and Collection sub-technique of T1417 (Input Capture). Adversaries may mimic common operating system GUI components to prompt users for sensitive information with a seemingly legitimate prompt. The... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1417-002-gui-input-capture - T1429 Audio Capture Adversary capture of audio via the device microphone for surveillance. Pegasus, Predator, FinSpy, ToothPicker all include mic-capture capability. Modern Android variants abuse foreground-service to record continuously. Compliance: NIST... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1429-audio-capture - T1430 Location Tracking Adversary access to a victim devices geolocation - GPS, cellular tower triangulation, Wi-Fi positioning, IP geolocation. Pegasus, Predator, FinSpy, and most commercial spyware exfiltrate location data continuously. Compliance: NIST SP... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1430-location-tracking - T1430.001 Remote Device Management Services An ATT&CK for Mobile Collection and Discovery sub-technique of T1430 (Location Tracking). An adversary may use access to cloud services (e.g. Google's Android Device Manager or Apple iCloud's Find my iPhone) or to an enterprise mobility... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1430-001-remote-device-management-services - T1430.002 Impersonate SS7 Nodes An ATT&CK for Mobile Collection and Discovery sub-technique of T1430 (Location Tracking). Adversaries may exploit the lack of authentication in signaling system network nodes to track the to track the location of mobile devices by... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1430-002-impersonate-ss7-nodes - T1512 Video Capture An ATT&CK for Mobile Collection technique. An adversary can leverage a device's cameras to gather information by capturing video recordings. Images may also be captured, potentially in specified intervals, in lieu of video files.... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1512-video-capture - T1513 Screen Capture An ATT&CK for Mobile Collection technique. Adversaries may use screen capture to collect additional information about a target device, such as applications running in the foreground, user data, credentials, or other sensitive... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1513-screen-capture - T1517 Access Notifications An ATT&CK for Mobile Collection and Credential Access technique. Adversaries may collect data within notifications sent by the operating system or other applications. Notifications may contain sensitive data such as one-time... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1517-access-notifications - T1532 Archive Collected Data Adversary archiving and compression of collected data on a mobile device before exfiltration to reduce transfer size and evade detection. Pegasus, Predator, and most modern mobile spyware compress stolen data into ZIP, TAR, or... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1532-archive-collected-data - T1533 Data from Local System An ATT&CK for Mobile Collection technique. Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to exfiltration. Access to local system data, which... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1533-data-from-local-system - T1616 Call Control An ATT&CK for Mobile Collection and Impact and Command and Control technique. Adversaries may make, forward, or block phone calls without user authorization. This could be used for adversary goals such as audio surveillance, blocking or... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1616-call-control - T1636 Protected User Data An ATT&CK for Mobile Collection technique. Adversaries may utilize standard operating system APIs to collect data from permission-backed data stores on a device, such as the calendar or contact list. These permissions need to be... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1636-protected-user-data - T1636.001 Calendar Entries An ATT&CK for Mobile Collection sub-technique of T1636 (Protected User Data). Adversaries may utilize standard operating system APIs to gather calendar entry data. On Android, this can be accomplished using the Calendar Content... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1636-001-calendar-entries - T1636.002 Call Log An ATT&CK for Mobile Collection sub-technique of T1636 (Protected User Data). Adversaries may utilize standard operating system APIs to gather call log data. On Android, this can be accomplished using the Call Log Content Provider. iOS... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1636-002-call-log - T1636.003 Contact List An ATT&CK for Mobile Collection sub-technique of T1636 (Protected User Data). Adversaries may utilize standard operating system APIs to gather contact list data. On Android, this can be accomplished using the Contacts Content Provider.... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1636-003-contact-list - T1636.004 SMS Messages An ATT&CK for Mobile Collection sub-technique of T1636 (Protected User Data). Adversaries may utilize standard operating system APIs to gather SMS messages. On Android, this can be accomplished using the SMS Content Provider. iOS... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1636-004-sms-messages - T1636.005 Protected User Data An Mobile Collection technique. Adversaries may utilize standard operating system APIs to gather account data. On Android, this can be accomplished by using the AccountManager API. For example, adversaries may use the `getAccounts()`... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1636-005-accounts - T1638 Adversary-in-the-Middle An ATT&CK for Mobile Collection technique. Adversaries may attempt to position themselves between two or more networked devices to support follow-on behaviors such as Transmitted Data Manipulation or Endpoint Denial of Service.... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1638-adversary-in-the-middle [command-and-control] Command and Control - T1437 Application Layer Protocol Adversary use of standard application-layer protocols (HTTP, HTTPS, DNS, mail, messaging) for command-and-control communication blending malicious traffic with legitimate enterprise SaaS use. Mobile C2 increasingly leverages legitimate... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1437-application-layer-protocol - T1437.001 Web Protocols An ATT&CK for Mobile Command and Control sub-technique of T1437 (Application Layer Protocol). Adversaries may communicate using application layer protocols associated with web protocols traffic to avoid detection/network filtering by... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1437-001-web-protocols - T1481 Web Service An ATT&CK for Mobile Command and Control technique. Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media, acting as a mechanism for... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1481-web-service - T1481.001 Dead Drop Resolver An ATT&CK for Mobile Command and Control sub-technique of T1481 (Web Service). Adversaries may use an existing, legitimate external Web service to host information that points to additional command and control (C2) infrastructure.... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1481-001-dead-drop-resolver - T1481.002 Bidirectional Communication An ATT&CK for Mobile Command and Control sub-technique of T1481 (Web Service). Adversaries may use an existing, legitimate external Web service channel as a means for sending commands to and receiving output from a compromised system.... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1481-002-bidirectional-communication - T1481.003 One-Way Communication An ATT&CK for Mobile Command and Control sub-technique of T1481 (Web Service). Adversaries may use an existing, legitimate external Web service channel as a means for sending commands to a compromised system without receiving return... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1481-003-one-way-communication - T1509 Non-Standard Port An ATT&CK for Mobile Command and Control technique. Adversaries may generate network traffic using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088 or port 587 as opposed to the... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1509-non-standard-port - T1521 Encrypted Channel Adversary use of TLS, symmetric, or asymmetric encrypted channels for mobile command-and-control communication. Pegasus, Predator, FinSpy, BRATA Android banker, and most modern mobile commercial spyware use encrypted C2 to evade network... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1521-encrypted-channel - T1521.001 Symmetric Cryptography An ATT&CK for Mobile Command and Control sub-technique of T1521 (Encrypted Channel). Adversaries may employ a known symmetric encryption algorithm to conceal command and control traffic, rather than relying on any inherent protections... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1521-001-symmetric-cryptography - T1521.002 Asymmetric Cryptography An ATT&CK for Mobile Command and Control sub-technique of T1521 (Encrypted Channel). Adversaries may employ a known asymmetric encryption algorithm to conceal command and control traffic, rather than relying on any inherent protections... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1521-002-asymmetric-cryptography - T1521.003 SSL Pinning An ATT&CK for Mobile Command and Control sub-technique of T1521 (Encrypted Channel). Adversaries may use SSL Pinning to protect the C2 traffic from being intercepted and analyzed. SSL Pinning is a technique commonly utilized by... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1521-003-ssl-pinning - T1544 Ingress Tool Transfer An ATT&CK for Mobile Command and Control technique. Adversaries may transfer tools or other files from an external system onto a compromised device to facilitate follow-on actions. Files may be copied from an external... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1544-ingress-tool-transfer - T1616 Call Control An ATT&CK for Mobile Collection and Impact and Command and Control technique. Adversaries may make, forward, or block phone calls without user authorization. This could be used for adversary goals such as audio surveillance, blocking or... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1616-call-control - T1637 Dynamic Resolution An ATT&CK for Mobile Command and Control technique. Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations. This may be achieved by using malware that shares a... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1637-dynamic-resolution - T1637.001 Domain Generation Algorithms An ATT&CK for Mobile Command and Control sub-technique of T1637 (Dynamic Resolution). Adversaries may use Domain Generation Algorithms (DGAs) to procedurally generate domain names for uses such as command and control communication or... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1637-001-domain-generation-algorithms - T1644 Out of Band Data An ATT&CK for Mobile Command and Control technique. Adversaries may communicate with compromised devices using out of band data streams. This could be done for a variety of reasons, including evading network traffic monitoring, as a... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1644-out-of-band-data - T1663 Remote Access Software An ATT&CK for Mobile Command and Control technique. Adversaries may use legitimate remote access software, such as VNC, TeamViewer, AirDroid, AirMirror, etc., to establish an interactive command and control channel to target mobile... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1663-remote-access-software [exfiltration] Exfiltration - T1639 Exfiltration Over Alternative Protocol An ATT&CK for Mobile Exfiltration technique. Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1639-exfiltration-over-alternative-protocol - T1639.001 Exfiltration Over Unencrypted Non-C2 Protocol An ATT&CK for Mobile Exfiltration sub-technique of T1639 (Exfiltration Over Alternative Protocol). Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1639-001-exfiltration-over-unencrypted-non-c2-protocol - T1646 Exfiltration Over C2 Channel An ATT&CK for Mobile Exfiltration technique. Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1646-exfiltration-over-c2-channel [impact] Impact - T1464 Network Denial of Service An ATT&CK for Mobile Impact technique. Adversaries may perform Network Denial of Service (DoS) attacks to degrade or block the availability of targeted resources to users. Network DoS can be performed by exhausting the network bandwidth... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1464-network-denial-of-service - T1471 Data Encrypted for Impact Mobile-specific ransomware that encrypts user data and demands payment. Notable mobile ransomware families include Charger, Lockerpin, DoubleLocker, Filecoder.C, and SLocker. Mobile ransomware impact extends beyond personal devices into... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1471-data-encrypted-for-impact - T1516 Input Injection An ATT&CK for Mobile Defense Evasion and Impact technique. A malicious application can inject input to the user interface to mimic user interaction through the abuse of Android's accessibility APIs. Input Injection can be achieved using... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1516-input-injection - T1582 SMS Control Adversary control over the SMS subsystem to intercept, send, or delete messages on a mobile device. Common with banking trojans (Cerberus, Anubis, FluBot) that intercept OTP codes for fraud. Compliance: NIST SP 800-124 Rev 2, PCI MPoC... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1582-sms-control - T1616 Call Control An ATT&CK for Mobile Collection and Impact and Command and Control technique. Adversaries may make, forward, or block phone calls without user authorization. This could be used for adversary goals such as audio surveillance, blocking or... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1616-call-control - T1640 Account Access Removal An ATT&CK for Mobile Impact technique. Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex:... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1640-account-access-removal - T1641 Data Manipulation An ATT&CK for Mobile Impact technique. Adversaries may insert, delete, or alter data in order to manipulate external outcomes or hide activity. By manipulating data, adversaries may attempt to affect a business process, organizational... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1641-data-manipulation - T1641.001 Transmitted Data Manipulation An ATT&CK for Mobile Impact sub-technique of T1641 (Data Manipulation). Adversaries may alter data en route to storage or other systems in order to manipulate external outcomes or hide activity. By manipulating transmitted data,... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1641-001-transmitted-data-manipulation - T1642 Endpoint Denial of Service An ATT&CK for Mobile Impact technique. Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users. On Android versions prior to 7, apps can abuse Device Administrator... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1642-endpoint-denial-of-service - T1643 Generate Traffic from Victim An ATT&CK for Mobile Impact technique. Adversaries may generate outbound traffic from devices. This is typically performed to manipulate external outcomes, such as to achieve carrier billing fraud or to manipulate app store rankings or... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1643-generate-traffic-from-victim - T1662 Data Destruction An ATT&CK for Mobile Impact technique. Adversaries may destroy data and files on specific devices or in large numbers to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1662-data-destruction [network-effects] Network Effects - T1451 SIM Card Swap An Mobile Initial Access technique. Adversaries may gain access to mobile devices through transfers or swaps from victims’ phone numbers to adversary-controlled SIM cards and mobile devices. The typical process is as follows: 1.... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1451-sim-card-swap [other] other - T1453 T1453 An Mobile Collection, Credential Access technique. Adversaries may abuse accessibility features in Android devices to steal sensitive data and to spread malware to other devices. Accessibility features in Android are designed to assist... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1453-abuse-accessibility-features - T1670 T1670 An Mobile Defense Evasion technique. Adversaries may carry out malicious operations using virtualization solutions to escape from Android sandboxes and to avoid detection. Android uses sandboxes to separate resources and code execution... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1670-virtualization-solution - T1676 T1676 An Mobile Collection, Persistence technique. Adversaries may abuse the “linked devices” feature on messaging applications, such as Signal and WhatsApp, to register the user’s account to an adversary-controlled device. By abusing the... Bidda node: https://bidda.com/intelligence/mitre-attack-mobile-t1676-linked-devices Full interactive matrix: https://bidda.com/mitre-mobile MITRE source: https://attack.mitre.org/matrices/mobile/