{"source_checked_on":"2026-10-19","schema_version":1,"key":"mobile/T1655","id":"T1655","name":"Masquerading","domain":"mobile","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1655","source_file":{"file":"mobile.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/mobile-attack/mobile-attack-20.0.json","sha256":"824f7d8a37e7893b29e4c6ca6d87b5fbbf3b228ec6384f1a69ee20d523ff59e5","bytes":6095145},"source_object_sha256":"9b816459f387703db04cec002db822c9b21068ee4f3a7f525291152b552c2eb7","description":"Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name, location, or appearance of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.\n\nRenaming abusable system utilities to evade security monitoring is also a form of [Masquerading](https://attack.mitre.org/techniques/T1655)\n","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1655","external_id":"T1655"},{"source_name":"NIST Mobile Threat Catalogue","url":"https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-14.html","external_id":"APP-14"},{"source_name":"NIST Mobile Threat Catalogue","url":"https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-31.html","external_id":"APP-31"}],"platforms":["Android","iOS"],"environments":["mobile"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[{"key":"mobile/T1655.001","id":"T1655.001","name":"Match Legitimate Name or Location","page":"techniques/mobile/T1655.001/"}],"telemetry":[{"id":"DC0114","name":"Application Permission","page":"telemetry/DC0114/","kind":"attack_component","category":"Mobile lab instrumentation","description":"Declared or granted permissions of a mobile application.","collection_focus":"Compare manifest declarations with runtime granted state using authorized package inspection and own-app permission checks.","providers":[{"name":"Android logcat","scope":"Permitted logs from a consented test device/emulator; output depends on build, permissions and instrumentation.","source_id":"android_logs"},{"name":"Android dumpsys","scope":"Point-in-time service/package state on an authorized development device.","source_id":"android_state"},{"name":"Instrumented test application","scope":"Own-app permission, API and state callbacks; not universal visibility into other apps.","source_id":"android_permissions"}],"configuration":["Use a disposable emulator or owned development device with approved debugging. Record OS/API level, app version and instrumentation privileges.","Collect only relevant logcat buffers/tags and service snapshots; add explicit own-app instrumentation for events absent from OS logs.","Forward sanitized logs and compare before/after state. Remove test data and revoke debugging access after the lab session."],"configuration_example":{"label":"Inspect the owned Android lab application","language":"shell","source_id":"android_state","content":"adb shell dumpsys package test.example.lab","note":"Read-only snapshot on a consented debug device. Replace the example package with your owned test app. Output and access vary by Android build; this is not a permission-request event stream."},"required_fields":["package","permission","declared","granted"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0114","collector":"illustrative-lab-collector","observation":{"package":"test.example.lab","permission":"android.permission.CAMERA","declared":true,"granted":false}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Android tooling does not imply iOS coverage. Standard mobile apps cannot observe all other apps or protected OS internals; MDM status is not full API, filesystem or content telemetry.","sources":[{"id":"android_logs","title":"Android logcat and access limits","url":"https://developer.android.com/tools/logcat"},{"id":"android_state","title":"Android dumpsys","url":"https://developer.android.com/tools/dumpsys"},{"id":"android_permissions","title":"Android runtime permission requests","url":"https://developer.android.com/training/permissions/requesting"}],"association":"attack_component","anomaly_design":"Per owned device, app version and permission state: unexpected API/permission changes, background activity and network destinations. OS privacy restrictions and emulator differences limit observability."},{"id":"DC0039","name":"File Creation","page":"telemetry/DC0039/","kind":"attack_component","category":"Endpoint activity","description":"Creation or overwrite of a file at an observed path.","collection_focus":"Scope Sysmon FileCreate (11) to the lab directory; retain the process and file path. Differentiate creation/overwrite if the sensor can.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_id","path","action","size_bytes"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0039","collector":"illustrative-lab-collector","observation":{"process_id":4200,"path":"C:\\Lab\\demo.txt","action":"create","size_bytes":64}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0059","name":"File Metadata","page":"telemetry/DC0059/","kind":"attack_component","category":"Host state and inventory","description":"File attributes such as path, size, timestamps, ownership and cryptographic hash.","collection_focus":"Collect scoped file inventory/FIM metadata with hash algorithm and observation time; preserve original timestamps separately from collector time.","providers":[{"name":"osquery","scope":"Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.","source_id":"osquery"},{"name":"Linux Audit plus inventory snapshots","scope":"Events explain changes; snapshots describe state at collection time.","source_id":"linux"}],"configuration":["Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.","Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.","Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset."],"configuration_example":null,"required_fields":["path","size_bytes","sha256","owner_uid"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0059","collector":"illustrative-lab-collector","observation":{"path":"/opt/lab/demo.txt","size_bytes":64,"sha256":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","owner_uid":1000}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.","sources":[{"id":"osquery","title":"osquery scheduled configuration","url":"https://github.com/osquery/osquery/blob/master/docs/wiki/deployment/configuration.md"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Compare authorized state snapshots: first-seen drivers/services/modules, unexpected configuration drift and integrity changes. Record collection cadence; absence in a sample is not evidence of deletion."},{"id":"DC0078","name":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component","category":"Network and protocol telemetry","description":"Connection/flow summaries such as endpoints, duration, byte counts and transport.","collection_focus":"Collect Zeek conn.log, Suricata flow events or exporter equivalents, including observation point and sampling settings.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"},{"name":"AWS VPC Flow Logs","scope":"IP traffic metadata alternative; no packet payload or DNS answer history, and some traffic is not logged.","source_id":"flow"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["source_ip","destination_ip","destination_port","protocol","bytes_sent","bytes_received"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"},{"id":"flow","title":"AWS VPC Flow Logs","url":"https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."}],"detection":{"key":"mobile/T1655","id":"T1655","name":"Masquerading","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"source_url":"https://attack.mitre.org/techniques/T1655","technique_page":"techniques/mobile/T1655/","page":"detections/mobile/T1655/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0715","name":"Detection of Masquerading","url":"https://attack.mitre.org/detectionstrategies/DET0715","stix_id":"x-mitre-detection-strategy--d314d955-a323-4e87-a8e5-317b0b8ed203","relationship_id":"relationship--998f03cf-7dbe-45b4-9103-a26d5b0383c7","description":"","analytics":[{"id":"AN1843","name":"Analytic 1843","guidance":"For Android, detect Masquerading from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; File Creation via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: app binary written to device storage as part of install — confirms impersonating app is being persisted]; File Metadata via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: installed app package_name Levenshtein distance <= $NameDistanceThreshold$ to entry in $KnownAppCatalog$]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.","url":"https://attack.mitre.org/detectionstrategies/DET0715#AN1843","platforms":["Android"],"tuning":[{"field":"NameDistanceThreshold","description":"Default Levenshtein distance 2. Tightening: 1 — only single-char variants. Loosening: 3 — more coverage, more FP."},{"field":"KnownAppCatalog","description":"MDM-approved catalog plus Play Store reference catalog with cert fingerprints. Update with each new enterprise app deployment."},{"field":"IconHashThreshold","description":"Default perceptual hash distance < 10. Derive from baseline icon hash comparison."},{"field":"MDMApprovedCatalog","description":"MDM-managed app list."}],"log_sources":[{"component_id":"DC0114","component":"Application Permission","name":"android:DevicePolicyManager","channel":"DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review","platforms":["Android"],"analytic_id":"AN1843","source_url":"https://attack.mitre.org/detectionstrategies/DET0715#AN1843","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0114/"},{"component_id":"DC0039","component":"File Creation","name":"mobile:ForensicArtifacts","channel":"Dynamic filesystem trace or acquired app-container/filesystem artifacts: app binary written to device storage as part of install — confirms impersonating app is being persisted","platforms":["Android"],"analytic_id":"AN1843","source_url":"https://attack.mitre.org/detectionstrategies/DET0715#AN1843","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0039/"},{"component_id":"DC0059","component":"File Metadata","name":"mobile:ForensicArtifacts","channel":"Dynamic filesystem trace or acquired app-container/filesystem artifacts: installed app package_name Levenshtein distance <= $NameDistanceThreshold$ to entry in $KnownAppCatalog$","platforms":["Android"],"analytic_id":"AN1843","source_url":"https://attack.mitre.org/detectionstrategies/DET0715#AN1843","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0059/"}]},{"id":"AN1844","name":"Analytic 1844","guidance":"For iOS, detect Masquerading by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]; File Metadata via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: bundle_id LIKE $KnownSystemNamespace$]; Network Traffic Flow via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.","url":"https://attack.mitre.org/detectionstrategies/DET0715#AN1844","platforms":["iOS"],"tuning":[{"field":"KnownSystemNamespace","description":"com.apple.*, org.whispersystems.*, com.google.* — reserved/well-known namespaces."},{"field":"MDMApprovedCatalog","description":"MDM-managed app list."},{"field":"ImpersonatedAppPermissionProfile","description":"Permission set of each known-good app that could be impersonated. Derive from MDM app catalog audit."},{"field":"ImpersonatedAppCDN","description":"Known network destinations for each enterprise app that could be impersonated."}],"log_sources":[{"component_id":"DC0114","component":"Application Permission","name":"mobile:ApplicationVetting","channel":"Code-signing entitlements and Info.plist privacy usage-description keys","platforms":["iOS"],"analytic_id":"AN1844","source_url":"https://attack.mitre.org/detectionstrategies/DET0715#AN1844","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0114/"},{"component_id":"DC0059","component":"File Metadata","name":"mobile:ForensicArtifacts","channel":"Dynamic filesystem trace or acquired app-container/filesystem artifacts: bundle_id LIKE $KnownSystemNamespace$","platforms":["iOS"],"analytic_id":"AN1844","source_url":"https://attack.mitre.org/detectionstrategies/DET0715#AN1844","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0059/"},{"component_id":"DC0078","component":"Network Traffic Flow","name":"iOS:NetworkExtension","channel":"NEFilterFlow / per-app VPN / secure-web-gateway flow metadata","platforms":["iOS"],"analytic_id":"AN1844","source_url":"https://attack.mitre.org/detectionstrategies/DET0715#AN1844","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"}]}]}],"telemetry_references":[{"id":"DC0114","name":"Application Permission","tag":"Application Permission","page":"telemetry/DC0114/","kind":"attack_component"},{"id":"DC0039","name":"File Creation","tag":"File Creation","page":"telemetry/DC0039/","kind":"attack_component"},{"id":"DC0059","name":"File Metadata","tag":"File Metadata","page":"telemetry/DC0059/","kind":"attack_component"},{"id":"DC0078","name":"Network Traffic Flow","tag":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S1185","name":"LightSpy","url":"https://attack.mitre.org/software/S1185","kind":"malware","description":"[LightSpy](https://attack.mitre.org/software/S1185) has masqueraded a Mach-O executable as a png file.(Citation: Threatfabric LightSpy 2024)(Citation: LinkedIn Dmitry LightSpy 2025)","relationship_id":"relationship--f78e0c04-1946-4a0f-9ecb-324373f97e8a","references":[{"source_name":"LinkedIn Dmitry LightSpy 2025","description":"Dmitry Bestuzhev. (2025, April 7). The Coordinated Kill Switch: LightSpy's iOS Destructive Plugin Architecture Manages Device Disablement. Retrieved April 14, 2025.","url":"https://www.linkedin.com/pulse/coordinated-kill-switch-lightspys-ios-destructive-plugin-bestuzhev-zhoye/"},{"source_name":"Threatfabric LightSpy 2024","description":"ThreatFabric. (2024, October 29). LightSpy: Implant for iOS. Retrieved January 30, 2025.","url":"https://www.threatfabric.com/blogs/lightspy-implant-for-ios"}]},{"id":"S1208","name":"FjordPhantom","url":"https://attack.mitre.org/software/S1208","kind":"malware","description":"[FjordPhantom](https://attack.mitre.org/software/S1208) has masqueraded as legitimate banking applications.(Citation: Promon FjordPhantom Oct2024) ","relationship_id":"relationship--91dd9ddf-185f-496d-a20f-88c66476cfdd","references":[{"source_name":"Promon FjordPhantom Oct2024","description":"Promon Security Research Team. (2024, October 1). Retrieved February 19, 2025.","url":"https://promon.io/security-news/fjordphantom-android-malware"}]},{"id":"S1225","name":"CherryBlos","url":"https://attack.mitre.org/software/S1225","kind":"malware","description":"[CherryBlos](https://attack.mitre.org/software/S1225) has displayed masqueraded wallet applications if the EnabledUIMode field is set to `true`. [CherryBlos](https://attack.mitre.org/software/S1225) has also displayed a fake user interface while victims make withdrawals in the legitimate Binance application if the EnableExchange field is set to `true`. The withdrawal transaction is ultimately transferred to the threat actor’s controlled address.(Citation: TrendMicro_CherryBlos_July2023)  ","relationship_id":"relationship--e7d6a883-2f2b-41e7-954e-7888a65a6f42","references":[{"source_name":"TrendMicro_CherryBlos_July2023","description":"Trend Micro Research. (2023, July 28). Related CherryBlos and FakeTrade Android Malware Involved in Scam Campaigns. Retrieved March 28, 2025.","url":"https://www.trendmicro.com/en_us/research/23/g/cherryblos-and-faketrade-android-malware-involved-in-scam-campai.html"}]},{"id":"S9004","name":"Crocodilus","url":"https://attack.mitre.org/software/S9004","kind":"malware","description":"[Crocodilus](https://attack.mitre.org/software/S9004) has masqueraded as legitimate applications to include applications related to financial institutions, cryptocurrency, gambling, browser updates and occasionally geo-specific themes.(Citation: ThreatFabric_Crocodilus_June2025) ","relationship_id":"relationship--0f265012-567d-45e9-9dc2-e1fd1be5bb93","references":[{"source_name":"ThreatFabric_Crocodilus_June2025","description":"ThreatFabric. (2025, June 3). Crocodilus Mobile Malware: Evolving Fast, Going Global. Retrieved November 24, 2025.","url":"https://www.threatfabric.com/blogs/crocodilus-mobile-malware-evolving-fast-going-global"}]},{"id":"S9006","name":"VajraSpy","url":"https://attack.mitre.org/software/S9006","kind":"malware","description":"[VajraSpy](https://attack.mitre.org/software/S9006) has masqueraded as messaging and news applications.(Citation: ESET_VajraSpy_Feb2024)(Citation: K7Dhanalakshmi_VajraSpy_April2022) ","relationship_id":"relationship--cf056f03-bc7b-4630-8673-ee1a9f2a64f0","references":[{"source_name":"K7Dhanalakshmi_VajraSpy_April2022","description":"Dhanalakshmi. (2022, April 19).  VajraSpy – An Android RAT. Retrieved November 5, 2025.","url":"https://labs.k7computing.com/index.php/vajraspy-an-android-rat/"},{"source_name":"ESET_VajraSpy_Feb2024","description":"Stefanko, L. (2024, February 1). VajraSpy: A Patchwork of espionage apps. Retrieved October 27, 2025.","url":"https://www.welivesecurity.com/en/eset-research/vajraspy-patchwork-espionage-apps/"}]}],"actors":[],"mitigations":[{"id":"M1011","name":"User Guidance","url":"https://attack.mitre.org/mitigations/M1011","kind":"course-of-action","description":"Users should be encouraged to only install apps from authorized app stores, which are less likely to contain malicious repackaged apps.","relationship_id":"relationship--cf879fe8-9c31-48de-9e49-668d6cda67c5","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use owned test devices or emulators, disposable app accounts and test data. Verify platform/version instrumentation; desktop test procedures do not establish mobile coverage.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1655":"/ttp-simulation/techniques/mobile/T1655/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"mobile/T1655","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0114","collector":"illustrative-lab-collector","observation":{"package":"test.example.lab","permission":"android.permission.CAMERA","declared":true,"granted":false}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0039","collector":"illustrative-lab-collector","observation":{"process_id":4200,"path":"C:\\Lab\\demo.txt","action":"create","size_bytes":64}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0059","collector":"illustrative-lab-collector","observation":{"path":"/opt/lab/demo.txt","size_bytes":64,"sha256":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","owner_uid":1000}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}}]}}