mobile — environment tag

Meaning and evidence boundary

Navigation membership is based on explicit metadata in this pinned module, not a claim of detection effectiveness or live validation.

Related pages

• FlexiSpy · tool
• T1398 Boot or Logon Initialization Scripts · simulation
• T1398 Boot or Logon Initialization Scripts detections · detection
• T1404 Exploitation for Privilege Escalation · simulation
• T1404 Exploitation for Privilege Escalation detections · detection
• T1406 Obfuscated Files or Information · simulation
• T1406 Obfuscated Files or Information detections · detection
• T1406.001 Steganography · simulation
• T1406.001 Steganography detections · detection
• T1406.002 Software Packing · simulation
• T1406.002 Software Packing detections · detection
• T1407 Download New Code at Runtime · simulation
• T1407 Download New Code at Runtime detections · detection
• T1409 Stored Application Data · simulation
• T1409 Stored Application Data detections · detection
• T1414 Clipboard Data · simulation
• T1414 Clipboard Data detections · detection
• T1417 Input Capture · simulation
• T1417 Input Capture detections · detection
• T1417.001 Keylogging · simulation
• T1417.001 Keylogging detections · detection
• T1417.002 GUI Input Capture · simulation
• T1417.002 GUI Input Capture detections · detection
• T1418 Software Discovery · simulation
• T1418 Software Discovery detections · detection
• T1418.001 Security Software Discovery · simulation
• T1418.001 Security Software Discovery detections · detection
• T1420 File and Directory Discovery · simulation
• T1420 File and Directory Discovery detections · detection
• T1421 System Network Connections Discovery · simulation
• T1421 System Network Connections Discovery detections · detection
• T1422 System Network Configuration Discovery · simulation
• T1422 System Network Configuration Discovery detections · detection
• T1422.001 Internet Connection Discovery · simulation
• T1422.001 Internet Connection Discovery detections · detection
• T1422.002 Wi-Fi Discovery · simulation
• T1422.002 Wi-Fi Discovery detections · detection
• T1423 Network Service Scanning · simulation
• T1423 Network Service Scanning detections · detection
• T1424 Process Discovery · simulation
• T1424 Process Discovery detections · detection
• T1426 System Information Discovery · simulation
• T1426 System Information Discovery detections · detection
• T1428 Exploitation of Remote Services · simulation
• T1428 Exploitation of Remote Services detections · detection
• T1429 Audio Capture · simulation
• T1429 Audio Capture detections · detection
• T1430 Location Tracking · simulation
• T1430 Location Tracking detections · detection
• T1430.001 Remote Device Management Services · simulation
• T1430.001 Remote Device Management Services detections · detection
• T1430.002 Impersonate SS7 Nodes · simulation
• T1430.002 Impersonate SS7 Nodes detections · detection
• T1437 Application Layer Protocol · simulation
• T1437 Application Layer Protocol detections · detection
• T1437.001 Web Protocols · simulation
• T1437.001 Web Protocols detections · detection
• T1451 SIM Card Swap · simulation
• T1451 SIM Card Swap detections · detection
• T1453 Abuse Accessibility Features · simulation
• T1453 Abuse Accessibility Features detections · detection
• T1456 Drive-By Compromise · simulation
• T1456 Drive-By Compromise detections · detection
• T1458 Replication Through Removable Media · simulation
• T1458 Replication Through Removable Media detections · detection
• T1461 Lockscreen Bypass · simulation
• T1461 Lockscreen Bypass detections · detection
• T1464 Network Denial of Service · simulation
• T1464 Network Denial of Service detections · detection
• T1471 Data Encrypted for Impact · simulation
• T1471 Data Encrypted for Impact detections · detection
• T1474 Supply Chain Compromise · simulation
• T1474 Supply Chain Compromise detections · detection
• T1474.001 Compromise Software Dependencies and Development Tools · simulation
• T1474.001 Compromise Software Dependencies and Development Tools detections · detection
• T1474.002 Compromise Hardware Supply Chain · simulation
• T1474.002 Compromise Hardware Supply Chain detections · detection
• T1474.003 Compromise Software Supply Chain · simulation
• T1474.003 Compromise Software Supply Chain detections · detection
• T1481 Web Service · simulation
• T1481 Web Service detections · detection
• T1481.001 Dead Drop Resolver · simulation
• T1481.001 Dead Drop Resolver detections · detection
• T1481.002 Bidirectional Communication · simulation
• T1481.002 Bidirectional Communication detections · detection
• T1481.003 One-Way Communication · simulation
• T1481.003 One-Way Communication detections · detection
• T1509 Non-Standard Port · simulation
• T1509 Non-Standard Port detections · detection
• T1512 Video Capture · simulation
• T1512 Video Capture detections · detection
• T1513 Screen Capture · simulation
• T1513 Screen Capture detections · detection
• T1516 Input Injection · simulation
• T1516 Input Injection detections · detection
• T1517 Access Notifications · simulation
• T1517 Access Notifications detections · detection
• T1521 Encrypted Channel · simulation
• T1521 Encrypted Channel detections · detection
• T1521.001 Symmetric Cryptography · simulation
• T1521.001 Symmetric Cryptography detections · detection
• T1521.002 Asymmetric Cryptography · simulation
• T1521.002 Asymmetric Cryptography detections · detection
• T1521.003 SSL Pinning · simulation
• T1521.003 SSL Pinning detections · detection
• T1532 Archive Collected Data · simulation
• T1532 Archive Collected Data detections · detection
• T1533 Data from Local System · simulation
• T1533 Data from Local System detections · detection
• T1541 Foreground Persistence · simulation
• T1541 Foreground Persistence detections · detection
• T1544 Ingress Tool Transfer · simulation
• T1544 Ingress Tool Transfer detections · detection
• T1575 Native API · simulation
• T1575 Native API detections · detection
• T1577 Compromise Application Executable · simulation
• T1577 Compromise Application Executable detections · detection
• T1582 SMS Control · simulation
• T1582 SMS Control detections · detection
• T1603 Scheduled Task/Job · simulation
• T1603 Scheduled Task/Job detections · detection
• T1604 Proxy Through Victim · simulation
• T1604 Proxy Through Victim detections · detection
• T1616 Call Control · simulation
• T1616 Call Control detections · detection
• T1617 Hooking · simulation
• T1617 Hooking detections · detection
• T1623 Command and Scripting Interpreter · simulation
• T1623 Command and Scripting Interpreter detections · detection
• T1623.001 Unix Shell · simulation
• T1623.001 Unix Shell detections · detection
• T1624 Event Triggered Execution · simulation
• T1624 Event Triggered Execution detections · detection
• T1624.001 Broadcast Receivers · simulation
• T1624.001 Broadcast Receivers detections · detection
• T1625 Hijack Execution Flow · simulation
• T1625 Hijack Execution Flow detections · detection
• T1625.001 System Runtime API Hijacking · simulation
• T1625.001 System Runtime API Hijacking detections · detection
• T1626 Abuse Elevation Control Mechanism · simulation
• T1626 Abuse Elevation Control Mechanism detections · detection
• T1626.001 Device Administrator Permissions · simulation
• T1626.001 Device Administrator Permissions detections · detection
• T1627 Execution Guardrails · simulation
• T1627 Execution Guardrails detections · detection
• T1627.001 Geofencing · simulation
• T1627.001 Geofencing detections · detection
• T1628 Hide Artifacts · simulation
• T1628 Hide Artifacts detections · detection
• T1628.001 Suppress Application Icon · simulation
• T1628.001 Suppress Application Icon detections · detection
• T1628.002 User Evasion · simulation
• T1628.002 User Evasion detections · detection
• T1628.003 Conceal Multimedia Files · simulation
• T1628.003 Conceal Multimedia Files detections · detection
• T1629 Impair Defenses · simulation
• T1629 Impair Defenses detections · detection
• T1629.001 Prevent Application Removal · simulation
• T1629.001 Prevent Application Removal detections · detection
• T1629.002 Device Lockout · simulation
• T1629.002 Device Lockout detections · detection
• T1629.003 Disable or Modify Tools · simulation
• T1629.003 Disable or Modify Tools detections · detection
• T1630 Indicator Removal on Host · simulation
• T1630 Indicator Removal on Host detections · detection
• T1630.001 Uninstall Malicious Application · simulation
• T1630.001 Uninstall Malicious Application detections · detection
• T1630.002 File Deletion · simulation
• T1630.002 File Deletion detections · detection
• T1630.003 Disguise Root/Jailbreak Indicators · simulation
• T1630.003 Disguise Root/Jailbreak Indicators detections · detection
• T1631 Process Injection · simulation
• T1631 Process Injection detections · detection
• T1631.001 Ptrace System Calls · simulation
• T1631.001 Ptrace System Calls detections · detection
• T1632 Subvert Trust Controls · simulation
• T1632 Subvert Trust Controls detections · detection
• T1632.001 Code Signing Policy Modification · simulation
• T1632.001 Code Signing Policy Modification detections · detection
• T1633 Virtualization/Sandbox Evasion · simulation
• T1633 Virtualization/Sandbox Evasion detections · detection
• T1633.001 System Checks · simulation
• T1633.001 System Checks detections · detection
• T1634 Credentials from Password Store · simulation
• T1634 Credentials from Password Store detections · detection
• T1634.001 Keychain · simulation
• T1634.001 Keychain detections · detection
• T1635 Steal Application Access Token · simulation
• T1635 Steal Application Access Token detections · detection
• T1635.001 URI Hijacking · simulation
• T1635.001 URI Hijacking detections · detection
• T1636 Protected User Data · simulation
• T1636 Protected User Data detections · detection
• T1636.001 Calendar Entries · simulation
• T1636.001 Calendar Entries detections · detection
• T1636.002 Call Log · simulation
• T1636.002 Call Log detections · detection
• T1636.003 Contact List · simulation
• T1636.003 Contact List detections · detection
• T1636.004 SMS Messages · simulation
• T1636.004 SMS Messages detections · detection
• T1636.005 Accounts · simulation
• T1636.005 Accounts detections · detection
• T1637 Dynamic Resolution · simulation
• T1637 Dynamic Resolution detections · detection
• T1637.001 Domain Generation Algorithms · simulation
• T1637.001 Domain Generation Algorithms detections · detection
• T1638 Adversary-in-the-Middle · simulation
• T1638 Adversary-in-the-Middle detections · detection
• T1639 Exfiltration Over Alternative Protocol · simulation
• T1639 Exfiltration Over Alternative Protocol detections · detection
• T1639.001 Exfiltration Over Unencrypted Non-C2 Protocol · simulation
• T1639.001 Exfiltration Over Unencrypted Non-C2 Protocol detections · detection
• T1640 Account Access Removal · simulation
• T1640 Account Access Removal detections · detection
• T1641 Data Manipulation · simulation
• T1641 Data Manipulation detections · detection
• T1641.001 Transmitted Data Manipulation · simulation
• T1641.001 Transmitted Data Manipulation detections · detection
• T1642 Endpoint Denial of Service · simulation
• T1642 Endpoint Denial of Service detections · detection
• T1643 Generate Traffic from Victim · simulation
• T1643 Generate Traffic from Victim detections · detection
• T1644 Out of Band Data · simulation
• T1644 Out of Band Data detections · detection
• T1645 Compromise Client Software Binary · simulation
• T1645 Compromise Client Software Binary detections · detection
• T1646 Exfiltration Over C2 Channel · simulation
• T1646 Exfiltration Over C2 Channel detections · detection
• T1655 Masquerading · simulation
• T1655 Masquerading detections · detection
• T1655.001 Match Legitimate Name or Location · simulation
• T1655.001 Match Legitimate Name or Location detections · detection
• T1658 Exploitation for Client Execution · simulation
• T1658 Exploitation for Client Execution detections · detection
• T1660 Phishing · simulation
• T1660 Phishing detections · detection
• T1661 Application Versioning · simulation
• T1661 Application Versioning detections · detection
• T1662 Data Destruction · simulation
• T1662 Data Destruction detections · detection
• T1663 Remote Access Software · simulation
• T1663 Remote Access Software detections · detection
• T1664 Exploitation for Initial Access · simulation
• T1664 Exploitation for Initial Access detections · detection
• T1670 Virtualization Solution · simulation
• T1670 Virtualization Solution detections · detection
• T1676 Linked Devices · simulation
• T1676 Linked Devices detections · detection
• Xbot · tool