{"source_checked_on":"2026-10-19","schema_version":1,"key":"mobile/T1644","id":"T1644","name":"Out of Band Data","domain":"mobile","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1644","source_file":{"file":"mobile.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/mobile-attack/mobile-attack-20.0.json","sha256":"824f7d8a37e7893b29e4c6ca6d87b5fbbf3b228ec6384f1a69ee20d523ff59e5","bytes":6095145},"source_object_sha256":"33b52337733fc83ef66aed2acc08e5d51a2019a25209f759199f465174d9a559","description":"Adversaries may communicate with compromised devices using out of band data streams. This could be done for a variety of reasons, including evading network traffic monitoring, as a backup method of command and control, or for data exfiltration if the device is not connected to any Internet-providing networks (i.e. cellular or Wi-Fi). Several out of band data streams exist, such as SMS messages, NFC, and Bluetooth. \n\n \n\nOn Android, applications can read push notifications to capture content from SMS messages, or other out of band data streams. This requires that the user manually grant notification access to the application via the settings menu. However, the application could launch an Intent to take the user directly there. \n\n \n\nOn iOS, there is no way to programmatically read push notifications. ","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1644","external_id":"T1644"}],"platforms":["Android","iOS"],"environments":["mobile"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0112","name":"API Calls","page":"telemetry/DC0112/","kind":"attack_component","category":"Mobile lab instrumentation","description":"Instrumented mobile API calls and results relevant to an application behavior.","collection_focus":"Instrument selected APIs in the owned test app or approved research build; log caller, API, sanitized argument class and return status.","providers":[{"name":"Android logcat","scope":"Permitted logs from a consented test device/emulator; output depends on build, permissions and instrumentation.","source_id":"android_logs"},{"name":"Android dumpsys","scope":"Point-in-time service/package state on an authorized development device.","source_id":"android_state"},{"name":"Instrumented test application","scope":"Own-app permission, API and state callbacks; not universal visibility into other apps.","source_id":"android_permissions"}],"configuration":["Use a disposable emulator or owned development device with approved debugging. Record OS/API level, app version and instrumentation privileges.","Collect only relevant logcat buffers/tags and service snapshots; add explicit own-app instrumentation for events absent from OS logs.","Forward sanitized logs and compare before/after state. Remove test data and revoke debugging access after the lab session."],"configuration_example":null,"required_fields":["package","api","result","thread"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0112","collector":"illustrative-lab-collector","observation":{"package":"test.example.lab","api":"android.hardware.camera2.CameraManager.openCamera","result":"permission_denied","thread":"main"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Android tooling does not imply iOS coverage. Standard mobile apps cannot observe all other apps or protected OS internals; MDM status is not full API, filesystem or content telemetry.","sources":[{"id":"android_logs","title":"Android logcat and access limits","url":"https://developer.android.com/tools/logcat"},{"id":"android_state","title":"Android dumpsys","url":"https://developer.android.com/tools/dumpsys"},{"id":"android_permissions","title":"Android runtime permission requests","url":"https://developer.android.com/training/permissions/requesting"}],"association":"attack_component","anomaly_design":"Per owned device, app version and permission state: unexpected API/permission changes, background activity and network destinations. OS privacy restrictions and emulator differences limit observability."},{"id":"DC0114","name":"Application Permission","page":"telemetry/DC0114/","kind":"attack_component","category":"Mobile lab instrumentation","description":"Declared or granted permissions of a mobile application.","collection_focus":"Compare manifest declarations with runtime granted state using authorized package inspection and own-app permission checks.","providers":[{"name":"Android logcat","scope":"Permitted logs from a consented test device/emulator; output depends on build, permissions and instrumentation.","source_id":"android_logs"},{"name":"Android dumpsys","scope":"Point-in-time service/package state on an authorized development device.","source_id":"android_state"},{"name":"Instrumented test application","scope":"Own-app permission, API and state callbacks; not universal visibility into other apps.","source_id":"android_permissions"}],"configuration":["Use a disposable emulator or owned development device with approved debugging. Record OS/API level, app version and instrumentation privileges.","Collect only relevant logcat buffers/tags and service snapshots; add explicit own-app instrumentation for events absent from OS logs.","Forward sanitized logs and compare before/after state. Remove test data and revoke debugging access after the lab session."],"configuration_example":{"label":"Inspect the owned Android lab application","language":"shell","source_id":"android_state","content":"adb shell dumpsys package test.example.lab","note":"Read-only snapshot on a consented debug device. Replace the example package with your owned test app. Output and access vary by Android build; this is not a permission-request event stream."},"required_fields":["package","permission","declared","granted"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0114","collector":"illustrative-lab-collector","observation":{"package":"test.example.lab","permission":"android.permission.CAMERA","declared":true,"granted":false}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Android tooling does not imply iOS coverage. Standard mobile apps cannot observe all other apps or protected OS internals; MDM status is not full API, filesystem or content telemetry.","sources":[{"id":"android_logs","title":"Android logcat and access limits","url":"https://developer.android.com/tools/logcat"},{"id":"android_state","title":"Android dumpsys","url":"https://developer.android.com/tools/dumpsys"},{"id":"android_permissions","title":"Android runtime permission requests","url":"https://developer.android.com/training/permissions/requesting"}],"association":"attack_component","anomaly_design":"Per owned device, app version and permission state: unexpected API/permission changes, background activity and network destinations. OS privacy restrictions and emulator differences limit observability."},{"id":"DC0085","name":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component","category":"Network and protocol telemetry","description":"Packet or decoded application-protocol content visible at a network sensor.","collection_focus":"Scope approved packet capture/protocol content collection to the lab flow; retain capture provenance and truncation indicators.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["flow_id","protocol","method","path","payload_excerpt"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0078","name":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component","category":"Network and protocol telemetry","description":"Connection/flow summaries such as endpoints, duration, byte counts and transport.","collection_focus":"Collect Zeek conn.log, Suricata flow events or exporter equivalents, including observation point and sampling settings.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"},{"name":"AWS VPC Flow Logs","scope":"IP traffic metadata alternative; no packet payload or DNS answer history, and some traffic is not logged.","source_id":"flow"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["source_ip","destination_ip","destination_port","protocol","bytes_sent","bytes_received"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"},{"id":"flow","title":"AWS VPC Flow Logs","url":"https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0115","name":"Protected Configuration","page":"telemetry/DC0115/","kind":"attack_component","category":"Mobile lab instrumentation","description":"State or changes affecting security-sensitive device configuration.","collection_focus":"Use approved device-management/research-build interfaces to snapshot the specific protected setting; document privileges and unsupported fields.","providers":[{"name":"Android logcat","scope":"Permitted logs from a consented test device/emulator; output depends on build, permissions and instrumentation.","source_id":"android_logs"},{"name":"Android dumpsys","scope":"Point-in-time service/package state on an authorized development device.","source_id":"android_state"},{"name":"Instrumented test application","scope":"Own-app permission, API and state callbacks; not universal visibility into other apps.","source_id":"android_permissions"}],"configuration":["Use a disposable emulator or owned development device with approved debugging. Record OS/API level, app version and instrumentation privileges.","Collect only relevant logcat buffers/tags and service snapshots; add explicit own-app instrumentation for events absent from OS logs.","Forward sanitized logs and compare before/after state. Remove test data and revoke debugging access after the lab session."],"configuration_example":null,"required_fields":["device_id","setting","before","after"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0115","collector":"illustrative-lab-collector","observation":{"device_id":"android-lab-1","setting":"usb_debugging_enabled","before":false,"after":true}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Android tooling does not imply iOS coverage. Standard mobile apps cannot observe all other apps or protected OS internals; MDM status is not full API, filesystem or content telemetry.","sources":[{"id":"android_logs","title":"Android logcat and access limits","url":"https://developer.android.com/tools/logcat"},{"id":"android_state","title":"Android dumpsys","url":"https://developer.android.com/tools/dumpsys"},{"id":"android_permissions","title":"Android runtime permission requests","url":"https://developer.android.com/training/permissions/requesting"}],"association":"attack_component","anomaly_design":"Per owned device, app version and permission state: unexpected API/permission changes, background activity and network destinations. OS privacy restrictions and emulator differences limit observability."},{"id":"DC0117","name":"System Notifications","page":"telemetry/DC0117/","kind":"attack_component","category":"Mobile lab instrumentation","description":"Operating-system notifications about device state, application actions or security events.","collection_focus":"Use consented system debugging or supported notification monitoring; collect metadata rather than notification contents unless explicitly approved.","providers":[{"name":"Android logcat","scope":"Permitted logs from a consented test device/emulator; output depends on build, permissions and instrumentation.","source_id":"android_logs"},{"name":"Android dumpsys","scope":"Point-in-time service/package state on an authorized development device.","source_id":"android_state"},{"name":"Instrumented test application","scope":"Own-app permission, API and state callbacks; not universal visibility into other apps.","source_id":"android_permissions"}],"configuration":["Use a disposable emulator or owned development device with approved debugging. Record OS/API level, app version and instrumentation privileges.","Collect only relevant logcat buffers/tags and service snapshots; add explicit own-app instrumentation for events absent from OS logs.","Forward sanitized logs and compare before/after state. Remove test data and revoke debugging access after the lab session."],"configuration_example":null,"required_fields":["device_id","notification_type","source","content_collected"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0117","collector":"illustrative-lab-collector","observation":{"device_id":"android-lab-1","notification_type":"usb_connection","source":"system","content_collected":false}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Android tooling does not imply iOS coverage. Standard mobile apps cannot observe all other apps or protected OS internals; MDM status is not full API, filesystem or content telemetry.","sources":[{"id":"android_logs","title":"Android logcat and access limits","url":"https://developer.android.com/tools/logcat"},{"id":"android_state","title":"Android dumpsys","url":"https://developer.android.com/tools/dumpsys"},{"id":"android_permissions","title":"Android runtime permission requests","url":"https://developer.android.com/training/permissions/requesting"}],"association":"attack_component","anomaly_design":"Per owned device, app version and permission state: unexpected API/permission changes, background activity and network destinations. OS privacy restrictions and emulator differences limit observability."}],"detection":{"key":"mobile/T1644","id":"T1644","name":"Out of Band Data","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"source_url":"https://attack.mitre.org/techniques/T1644","technique_page":"techniques/mobile/T1644/","page":"detections/mobile/T1644/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0688","name":"Detection of Out of Band Data","url":"https://attack.mitre.org/detectionstrategies/DET0688","stix_id":"x-mitre-detection-strategy--d9ca9fb7-01dd-465c-86a1-a48b6812b1c5","relationship_id":"relationship--1a5d49ae-de04-4b05-98d2-73f6afdda0ae","description":"","analytics":[{"id":"AN1798","name":"Analytic 1798","guidance":"For Android, detect Out of Band Data by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: NotificationListenerService.onNotificationPosted() receiving notifications from source_app IN $HighValueNotifApps$ by listener NOT IN $NotificationAllowList$]; Network Traffic Content via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed]; System Notifications via Android Enterprise / Managed App Telemetry [Documented DPC/admin callbacks or managed-app generated event telemetry]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.","url":"https://attack.mitre.org/detectionstrategies/DET0688#AN1798","platforms":["Android"],"tuning":[{"field":"NotificationAllowList","description":"Approved companion/wearable apps. Minimal. Derive from MDM catalog."},{"field":"HighValueNotifApps","description":"Banking, auth, enterprise SSO, SMS/messaging app packages."},{"field":"AppCDNList","description":"Per-app CDN. Derive by measurement."},{"field":"NotifExfilWindow","description":"Default 30s — OTP codes expire quickly; transmission is immediate."}],"log_sources":[{"component_id":"DC0112","component":"API Calls","name":"mobile:DynamicAnalysis","channel":"Dynamic API/runtime trace: NotificationListenerService.onNotificationPosted() receiving notifications from source_app IN $HighValueNotifApps$ by listener NOT IN $NotificationAllowList$","platforms":["Android"],"analytic_id":"AN1798","source_url":"https://attack.mitre.org/detectionstrategies/DET0688#AN1798","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0112/"},{"component_id":"DC0085","component":"Network Traffic Content","name":"webproxy:applog","channel":"DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed","platforms":["Android"],"analytic_id":"AN1798","source_url":"https://attack.mitre.org/detectionstrategies/DET0688#AN1798","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"},{"component_id":"DC0117","component":"System Notifications","name":"android:ManagedAppLog","channel":"Documented DPC/admin callbacks or managed-app generated event telemetry","platforms":["Android"],"analytic_id":"AN1798","source_url":"https://attack.mitre.org/detectionstrategies/DET0688#AN1798","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0117/"}]},{"id":"AN1799","name":"Analytic 1799","guidance":"For iOS, detect Out of Band Data by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]; Network Traffic Flow via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]; Protected Configuration via Apple MDM [DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.","url":"https://attack.mitre.org/detectionstrategies/DET0688#AN1799","platforms":["iOS"],"tuning":[{"field":"MDMApprovedCatalog","description":"MDM-managed app list."},{"field":"APNSAllowList","description":"Enterprise Apple Team IDs for deployed apps."},{"field":"AppBaselineDomains","description":"Per-device CDN baseline, 30-day."},{"field":"BeaconVarianceThreshold","description":"Default 15% interval variance."}],"log_sources":[{"component_id":"DC0114","component":"Application Permission","name":"mobile:ApplicationVetting","channel":"Code-signing entitlements and Info.plist privacy usage-description keys","platforms":["iOS"],"analytic_id":"AN1799","source_url":"https://attack.mitre.org/detectionstrategies/DET0688#AN1799","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0114/"},{"component_id":"DC0078","component":"Network Traffic Flow","name":"iOS:NetworkExtension","channel":"NEFilterFlow / per-app VPN / secure-web-gateway flow metadata","platforms":["iOS"],"analytic_id":"AN1799","source_url":"https://attack.mitre.org/detectionstrategies/DET0688#AN1799","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"},{"component_id":"DC0115","component":"Protected Configuration","name":"iOS:MDM","channel":"DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries","platforms":["iOS"],"analytic_id":"AN1799","source_url":"https://attack.mitre.org/detectionstrategies/DET0688#AN1799","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0115/"}]}]}],"telemetry_references":[{"id":"DC0112","name":"API Calls","tag":"API Calls","page":"telemetry/DC0112/","kind":"attack_component"},{"id":"DC0114","name":"Application Permission","tag":"Application Permission","page":"telemetry/DC0114/","kind":"attack_component"},{"id":"DC0085","name":"Network Traffic Content","tag":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component"},{"id":"DC0078","name":"Network Traffic Flow","tag":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component"},{"id":"DC0115","name":"Protected Configuration","tag":"Protected Configuration","page":"telemetry/DC0115/","kind":"attack_component"},{"id":"DC0117","name":"System Notifications","tag":"System Notifications","page":"telemetry/DC0117/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S0289","name":"Pegasus for iOS","url":"https://attack.mitre.org/software/S0289","kind":"malware","description":"[Pegasus for iOS](https://attack.mitre.org/software/S0289) uses SMS for command and control.(Citation: Lookout-Pegasus)","relationship_id":"relationship--4f2ae057-ef0b-4995-b24d-348a76a74a4f","references":[{"source_name":"Lookout-Pegasus","description":"Lookout. (2016). Technical Analysis of Pegasus Spyware. Retrieved December 12, 2016.","url":"https://info.lookout.com/rs/051-ESQ-475/images/lookout-pegasus-technical-analysis.pdf"}]},{"id":"S0295","name":"RCSAndroid","url":"https://attack.mitre.org/software/S0295","kind":"malware","description":"[RCSAndroid](https://attack.mitre.org/software/S0295) can use SMS for command and control.(Citation: TrendMicro-RCSAndroid)","relationship_id":"relationship--8cb42e3d-69f4-4b0d-98c9-0bb7560947c1","references":[{"source_name":"TrendMicro-RCSAndroid","description":"Veo Zhang. (2015, July 21). Hacking Team RCSAndroid Spying Tool Listens to Calls; Roots Devices to Get In. Retrieved December 22, 2016.","url":"http://blog.trendmicro.com/trendlabs-security-intelligence/hacking-team-rcsandroid-spying-tool-listens-to-calls-roots-devices-to-get-in/"}]},{"id":"S0304","name":"Android/Chuli.A","url":"https://attack.mitre.org/software/S0304","kind":"malware","description":"[Android/Chuli.A](https://attack.mitre.org/software/S0304) used SMS to receive command and control messages.(Citation: Kaspersky-WUC)","relationship_id":"relationship--c83c84e8-a556-4efe-ae24-75970ee8ad4b","references":[{"source_name":"Kaspersky-WUC","description":"Costin Raiu, Denis Maslennikov, Kurt Baumgartner. (2013, March 26). Android Trojan Found in Targeted Attack. Retrieved December 23, 2016.","url":"https://securelist.com/android-trojan-found-in-targeted-attack-58/35552/"}]},{"id":"S0316","name":"Pegasus for Android","url":"https://attack.mitre.org/software/S0316","kind":"malware","description":"[Pegasus for Android](https://attack.mitre.org/software/S0316) uses SMS for command and control.(Citation: Lookout-PegasusAndroid)","relationship_id":"relationship--f6098dca-3a9e-4991-8d51-1310b12161b6","references":[{"source_name":"Lookout-PegasusAndroid","description":"Mike Murray. (2017, April 3). Pegasus for Android: the other side of the story emerges. Retrieved April 16, 2017.","url":"https://blog.lookout.com/blog/2017/04/03/pegasus-android/"}]},{"id":"S0324","name":"SpyDealer","url":"https://attack.mitre.org/software/S0324","kind":"malware","description":"[SpyDealer](https://attack.mitre.org/software/S0324) enables remote control of the victim through SMS channels.(Citation: PaloAlto-SpyDealer)","relationship_id":"relationship--935fd3e3-dd47-4c43-bdd8-1668af26395f","references":[{"source_name":"PaloAlto-SpyDealer","description":"Wenjun Hu, Cong Zheng and Zhi Xu. (2017, July 6). SpyDealer: Android Trojan Spying on More Than 40 Apps. Retrieved September 18, 2018.","url":"https://researchcenter.paloaltonetworks.com/2017/07/unit42-spydealer-android-trojan-spying-40-apps/"}]},{"id":"S0327","name":"Skygofree","url":"https://attack.mitre.org/software/S0327","kind":"malware","description":"[Skygofree](https://attack.mitre.org/software/S0327) can be controlled via binary SMS.(Citation: Kaspersky-Skygofree)","relationship_id":"relationship--bc0d2cbb-30fa-40e6-a250-bf6e5d8f9005","references":[{"source_name":"Kaspersky-Skygofree","description":"Nikita Buchka and Alexey Firsh. (2018, January 16). Skygofree: Following in the footsteps of HackingTeam. Retrieved September 24, 2018.","url":"https://securelist.com/skygofree-following-in-the-footsteps-of-hackingteam/83603/"}]},{"id":"S0328","name":"Stealth Mango","url":"https://attack.mitre.org/software/S0328","kind":"malware","description":"[Stealth Mango](https://attack.mitre.org/software/S0328) uses commands received from text messages for C2.(Citation: Lookout-StealthMango)","relationship_id":"relationship--5a7295a2-ad95-4362-8b2c-9265ad5c73b0","references":[{"source_name":"Lookout-StealthMango","description":"Lookout. (n.d.). Stealth Mango & Tangelo. Retrieved September 27, 2018.","url":"https://info.lookout.com/rs/051-ESQ-475/images/lookout-stealth-mango-srr-us.pdf"}]},{"id":"S0406","name":"Gustuff","url":"https://attack.mitre.org/software/S0406","kind":"malware","description":" [Gustuff](https://attack.mitre.org/software/S0406) can use SMS for command and control from a defined admin phone number.(Citation: Talos Gustuff Apr 2019) ","relationship_id":"relationship--96569099-db95-4f3c-8ded-6d9cf023e55e","references":[{"source_name":"Talos Gustuff Apr 2019","description":"Vitor Ventura. (2019, April 9).  Gustuff banking botnet targets Australia . Retrieved September 3, 2019.","url":"https://blog.talosintelligence.com/2019/04/gustuff-targets-australia.html"}]},{"id":"S0407","name":"Monokle","url":"https://attack.mitre.org/software/S0407","kind":"malware","description":"[Monokle](https://attack.mitre.org/software/S0407) can be controlled via email and SMS from a set of \"control phones.\"(Citation: Lookout-Monokle)","relationship_id":"relationship--069b2328-442b-491e-962d-d3fe01f0549e","references":[{"source_name":"Lookout-Monokle","description":"Bauer A., Kumar A., Hebeisen C., et al. (2019, July). Monokle: The Mobile Surveillance Tooling of the Special Technology Center. Retrieved September 4, 2019.","url":"https://www.lookout.com/documents/threat-reports/lookout-discovers-monokle-threat-report.pdf"}]},{"id":"S0411","name":"Rotexy","url":"https://attack.mitre.org/software/S0411","kind":"malware","description":"[Rotexy](https://attack.mitre.org/software/S0411) can be controlled through SMS messages.(Citation: securelist rotexy 2018)","relationship_id":"relationship--3272111a-f31d-47d5-a266-1749255b5016","references":[{"source_name":"securelist rotexy 2018","description":"T. Shishkova, L. Pikman. (2018, November 22).  The Rotexy mobile Trojan – banker and ransomware. Retrieved September 23, 2019.","url":"https://securelist.com/the-rotexy-mobile-trojan-banker-and-ransomware/88893/"}]},{"id":"S0427","name":"TrickMo","url":"https://attack.mitre.org/software/S0427","kind":"malware","description":"[TrickMo](https://attack.mitre.org/software/S0427) can be controlled via encrypted SMS message.(Citation: SecurityIntelligence TrickMo)","relationship_id":"relationship--7defdb15-65d1-40ca-a9da-5c0484892484","references":[{"source_name":"SecurityIntelligence TrickMo","description":"P. Asinovsky. (2020, March 24). TrickBot Pushing a 2FA Bypass App to Bank Customers in Germany. Retrieved April 24, 2020.","url":"https://securityintelligence.com/posts/trickbot-pushing-a-2fa-bypass-app-to-bank-customers-in-germany/"}]},{"id":"S0505","name":"Desert Scorpion","url":"https://attack.mitre.org/software/S0505","kind":"malware","description":"[Desert Scorpion](https://attack.mitre.org/software/S0505) can be controlled using SMS messages.(Citation: Lookout Desert Scorpion)","relationship_id":"relationship--05243ccb-0aeb-4db4-bb03-51a65fb715ab","references":[{"source_name":"Lookout Desert Scorpion","description":"A. Blaich, M. Flossman. (2018, April 16). Lookout finds new surveillanceware in Google Play with ties to known threat actor targeting the Middle East. Retrieved September 11, 2020.","url":"https://blog.lookout.com/desert-scorpion-google-play"}]},{"id":"S0529","name":"CarbonSteal","url":"https://attack.mitre.org/software/S0529","kind":"malware","description":"[CarbonSteal](https://attack.mitre.org/software/S0529) has used specially crafted SMS messages to control the target device.(Citation: Lookout Uyghur Campaign) ","relationship_id":"relationship--e33106e1-16ef-41b8-8d47-78c9f2b4dceb","references":[{"source_name":"Lookout Uyghur Campaign","description":"A. Kumar, K. Del Rosso, J. Albrecht, C. Hebeisen. (2020, June 1). Mobile APT Surveillance Campaigns Targeting Uyghurs - A collection of long-running Android tooling connected to a Chinese mAPT actor. Retrieved November 10, 2020.","url":"https://www.lookout.com/documents/threat-reports/us/lookout-uyghur-malware-tr-us.pdf"}]},{"id":"S0655","name":"BusyGasper","url":"https://attack.mitre.org/software/S0655","kind":"malware","description":"[BusyGasper](https://attack.mitre.org/software/S0655) can perform actions when one of two hardcoded magic SMS strings is received.(Citation: SecureList BusyGasper)","relationship_id":"relationship--d1318f71-7f70-4820-a3fc-0d05af038733","references":[{"source_name":"SecureList BusyGasper","description":"Alexey Firsh. (2018, August 29). BusyGasper – the unfriendly spy. Retrieved October 1, 2021.","url":"https://securelist.com/busygasper-the-unfriendly-spy/87627/"}]},{"id":"S1055","name":"SharkBot","url":"https://attack.mitre.org/software/S1055","kind":"malware","description":"[SharkBot](https://attack.mitre.org/software/S1055) can use the “Direct Reply” feature of Android to automatically reply to notifications with a message provided by C2.(Citation: nccgroup_sharkbot_0322)","relationship_id":"relationship--0e8607f6-daab-44df-b167-105403a4ef41","references":[{"source_name":"nccgroup_sharkbot_0322","description":"RIFT: Research and Intelligence Fusion Team. (2022, March 3). SharkBot: a “new” generation Android banking Trojan being distributed on Google Play Store. Retrieved January 18, 2023.","url":"https://research.nccgroup.com/2022/03/03/sharkbot-a-new-generation-android-banking-trojan-being-distributed-on-google-play-store/"}]},{"id":"S1079","name":"BOULDSPY","url":"https://attack.mitre.org/software/S1079","kind":"malware","description":"[BOULDSPY](https://attack.mitre.org/software/S1079) can use SMS to send C2 commands.(Citation: lookout_bouldspy_0423)","relationship_id":"relationship--b22addc1-6a23-4657-8164-3705e12bb95b","references":[{"source_name":"lookout_bouldspy_0423","description":"Kyle Schmittle, Alemdar Islamoglu, Paul Shunk, Justin Albrecht. (2023, April 27). Lookout Discovers Android Spyware Tied to Iranian Police Targeting Minorities: BouldSpy. Retrieved July 21, 2023.","url":"https://www.lookout.com/blog/iranian-spyware-bouldspy"}]},{"id":"S1195","name":"SpyC23","url":"https://attack.mitre.org/software/S1195","kind":"malware","description":"[SpyC23](https://attack.mitre.org/software/S1195) can receive Command and Control commands from SMS messages.(Citation: welivesecurity_apt-c-23)","relationship_id":"relationship--aa490344-f7e0-4e5a-abb1-af9209f15ce4","references":[{"source_name":"welivesecurity_apt-c-23","description":"Stefanko, L. (2020, September 30). APT‑C‑23 group evolves its Android spyware. Retrieved March 4, 2024.","url":"https://web.archive.org/web/20201123042131/www.welivesecurity.com/2020/09/30/aptc23-group-evolves-its-android-spyware/"}]},{"id":"S1216","name":"TriangleDB","url":"https://attack.mitre.org/software/S1216","kind":"malware","description":"[TriangleDB](https://attack.mitre.org/software/S1216) has used the Protobuf library for command and control communication.(Citation: SecureList OpTriangulation 21Jun2023) ","relationship_id":"relationship--0cd58f68-2c93-4ecc-a7fb-b4aad483d14a","references":[{"source_name":"SecureList OpTriangulation 21Jun2023","description":"Kucherin, G., et al. (2023, June 21). Dissecting TriangleDB, a Triangulation spyware implant. Retrieved April 18, 2024.","url":"https://securelist.com/triangledb-triangulation-implant/110050/"}]},{"id":"S9040","name":"NGate","url":"https://attack.mitre.org/software/S9040","kind":"malware","description":"[NGate](https://attack.mitre.org/software/S9040) has used NFC to send the victim's card information through a server to an adversary-controlled device.(Citation: ESETStefankoOsmani_NGate_Aug2024)(Citation: CERTPL_NGate_Nov2025)(Citation: ESETStefanko_NGateVariant_Apr2026)","relationship_id":"relationship--f7cd4065-0649-4159-b45d-f6b585f45727","references":[{"source_name":"CERTPL_NGate_Nov2025","description":"Ratajczak, K. (2025, November 3). Analysis of NGate malware campaign (NFC relay). Retrieved November 10, 2025.","url":"https://cert.pl/en/posts/2025/11/analiza-ngate/"},{"source_name":"ESETStefanko_NGateVariant_Apr2026","description":"Stefanko, L. (2026, April 21). New NGate variant hides in a trojanized NFC payment app. Retrieved May 6, 2026.","url":"https://www.welivesecurity.com/en/eset-research/new-ngate-variant-hides-in-a-trojanized-nfc-payment-app/"},{"source_name":"ESETStefankoOsmani_NGate_Aug2024","description":"Stefanko, L., Osmani, J. (2024, August 22). NGate Android malware relays NFC traffic to steal cash. Retrieved November 10, 2025.","url":"https://www.welivesecurity.com/en/eset-research/ngate-android-malware-relays-nfc-traffic-to-steal-cash/"}]}],"actors":[],"mitigations":[{"id":"M1011","name":"User Guidance","url":"https://attack.mitre.org/mitigations/M1011","kind":"course-of-action","description":"Users should be instructed to not grant applications unexpected or unnecessary permissions. ","relationship_id":"relationship--4220ec84-3c30-462b-9bad-4fb4de42cfd4","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use owned test devices or emulators, disposable app accounts and test data. Verify platform/version instrumentation; desktop test procedures do not establish mobile coverage.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1644":"/ttp-simulation/techniques/mobile/T1644/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"mobile/T1644","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0112","collector":"illustrative-lab-collector","observation":{"package":"test.example.lab","api":"android.hardware.camera2.CameraManager.openCamera","result":"permission_denied","thread":"main"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0114","collector":"illustrative-lab-collector","observation":{"package":"test.example.lab","permission":"android.permission.CAMERA","declared":true,"granted":false}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0115","collector":"illustrative-lab-collector","observation":{"device_id":"android-lab-1","setting":"usb_debugging_enabled","before":false,"after":true}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0117","collector":"illustrative-lab-collector","observation":{"device_id":"android-lab-1","notification_type":"usb_connection","source":"system","content_collected":false}}]}}