T1404 Exploitation for Privilege Escalation — Attack Simulation

DC0114 collection page — Compare manifest declarations with runtime granted state using authorized package inspection and own-app permission checks.

Providers and collection configuration

• Android logcat: Permitted logs from a consented test device/emulator; output depends on build, permissions and instrumentation.
• Android dumpsys: Point-in-time service/package state on an authorized development device.
• Instrumented test application: Own-app permission, API and state callbacks; not universal visibility into other apps.

• Use a disposable emulator or owned development device with approved debugging. Record OS/API level, app version and instrumentation privileges.
• Collect only relevant logcat buffers/tags and service snapshots; add explicit own-app instrumentation for events absent from OS logs.
• Forward sanitized logs and compare before/after state. Remove test data and revoke debugging access after the lab session.

Required normalized fields: package, permission, declared, granted.

adb shell dumpsys package test.example.lab

Read-only snapshot on a consented debug device. Replace the example package with your owned test app. Output and access vary by Android build; this is not a permission-request event stream.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0114",
  "collector": "illustrative-lab-collector",
  "observation": {
    "package": "test.example.lab",
    "permission": "android.permission.CAMERA",
    "declared": true,
    "granted": false
  }
}

Visibility limits: Android tooling does not imply iOS coverage. Standard mobile apps cannot observe all other apps or protected OS internals; MDM status is not full API, filesystem or content telemetry.

DC0018 collection page — Collect agent heartbeat and OS health independently; record missed polls, last-seen time and monitor health.

Providers and collection configuration

• osquery: Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.
• Linux Audit plus inventory snapshots: Events explain changes; snapshots describe state at collection time.

• Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.
• Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.
• Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset.

Required normalized fields: asset_id, status, heartbeat_age_seconds, collector_healthy.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0018",
  "collector": "illustrative-lab-collector",
  "observation": {
    "asset_id": "lab-host-1",
    "status": "degraded",
    "heartbeat_age_seconds": 90,
    "collector_healthy": true
  }
}

Visibility limits: Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.

DC0078 collection page — Collect Zeek conn.log, Suricata flow events or exporter equivalents, including observation point and sampling settings.

Providers and collection configuration

• Zeek: Connection and protocol metadata from traffic visible to the sensor.
• Suricata EVE: Configured flow, alert, DNS, HTTP, TLS and protocol records.
• AWS VPC Flow Logs: IP traffic metadata alternative; no packet payload or DNS answer history, and some traffic is not logged.

• Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.
• Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.
• Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection.

Required normalized fields: source_ip, destination_ip, destination_port, protocol, bytes_sent, bytes_received.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0078",
  "collector": "illustrative-lab-collector",
  "observation": {
    "source_ip": "192.0.2.10",
    "destination_ip": "198.51.100.20",
    "destination_port": 443,
    "protocol": "tcp",
    "bytes_sent": 128,
    "bytes_received": 512
  }
}

Visibility limits: Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.

DC0021 collection page — Use an approved EDR trace or instrument the owned lab process at selected APIs. Define API name, caller, sanitized arguments and return status.

Providers and collection configuration

• Application audit logs: First-party service events and request/result fields; schema is application-specific.
• OpenTelemetry-compatible log pipelines: Transport and normalization of emitted records; do not create missing audit instrumentation.

• Enable the application audit category or instrument the owned lab application at the authorization/action boundary.
• Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.
• Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart.

Required normalized fields: process_id, api, path, result.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0021",
  "collector": "illustrative-lab-collector",
  "observation": {
    "process_id": 4200,
    "api": "CreateFileW",
    "path": "C:\\Lab\\demo.txt",
    "result": "success"
  }
}

Visibility limits: Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.

MITRE detection strategy

No exact-tagged Sigma source rule was imported. This does not establish that the technique is undetectable; the MITRE guidance and collection requirements remain relevant.

• S0182 FinFisher — malware.

  FinFisher comes packaged with ExynosAbuse, an Android exploit that can gain root privileges.[Lookout Dark Caracal Jan 2018]

  Exact relationship: relationship--be39c012-7201-4757-8cd6-c855bc945a9e
• S0289 Pegasus for iOS — malware.

  Pegasus for iOS exploits iOS vulnerabilities to escalate privileges.[Lookout-Pegasus]

  Exact relationship: relationship--63e67cba-4eae-4495-8897-2610103a0c41
• S0290 Gooligan — malware.

  Gooligan executes Android root exploits.[Gooligan Citation]

  Exact relationship: relationship--aa8e45c2-4276-451b-b1eb-59c396bf720a
• S0293 BrainTest — malware.

  Some original variants of BrainTest had the capability to automatically root some devices, but that behavior was not observed in later samples.[Lookout-BrainTest]

  Exact relationship: relationship--02b3c8fe-1539-4c77-b67e-07fa8a22c91e
• S0294 ShiftyBug — malware.

  ShiftyBug is packed with at least eight publicly available exploits that can perform rooting.[Lookout-Adware]

  Exact relationship: relationship--f0851531-e554-4658-920c-f2342632c19a
• S0316 Pegasus for Android — malware.

  Pegasus for Android attempts to exploit well-known Android OS vulnerabilities to escalate privileges.[Lookout-PegasusAndroid]

  Exact relationship: relationship--3d24d88e-a0ab-42c6-8e8f-11f721082bba
• S0322 HummingBad — malware.

  HummingBad can exploit unfixed vulnerabilities in older Android versions to root victim phones.[ArsTechnica-HummingBad]

  Exact relationship: relationship--d87b468e-f610-4e95-8dfb-8cf029f0e891
• S0324 SpyDealer — malware.

  SpyDealer uses the commercial rooting app Baidu Easy Root to gain root privilege and maintain persistence on the victim.[PaloAlto-SpyDealer]

  Exact relationship: relationship--d8d773ab-b0e3-484b-bdb8-c1a1ab48d218
• S0327 Skygofree — malware.

  Skygofree has the capability to exploit several known vulnerabilities and escalate privileges.[Kaspersky-Skygofree]

  Exact relationship: relationship--dfe6d454-1a24-4c42-97eb-4ddfd1dbb09b
• S0405 Exodus — malware.

  Exodus Two attempts to elevate privileges by using a modified version of the DirtyCow exploit.[SWB Exodus March 2019]

  Exact relationship: relationship--3bf5a566-986b-478c-b2da-e57caf261378
• S0420 Dvmap — malware.

  Dvmap attempts to gain root access by using local exploits.[SecureList DVMap June 2017]

  Exact relationship: relationship--cce5d90f-edff-454d-bafa-caf33b71ed6c
• S0440 Agent Smith — malware.

  Agent Smith exploits known OS vulnerabilities, including Janus, to replace legitimate applications with malicious versions.[CheckPoint Agent Smith]

  Exact relationship: relationship--96490f73-d8ef-4c6b-9a3a-3c66fc963306
• S0463 INSOMNIA — malware.

  INSOMNIA exploits a WebKit vulnerability to achieve root access on the device.[Volexity Insomnia]

  Exact relationship: relationship--0bb6f851-4302-4936-a98e-d23feecb234d
• S0494 Zen — malware.

  Zen can obtain root access via a rooting trojan in its infection chain.[Google Security Zen]

  Exact relationship: relationship--27c8d474-f3f8-4a0e-a317-7e57b9de620c
• S0550 DoubleAgent — malware.

  DoubleAgent has used exploit tools to gain root, such as TowelRoot.[Lookout Uyghur Campaign]

  Exact relationship: relationship--a501b700-250f-4e9a-a20f-656ae9bf90f9
• S1061 AbstractEmu — malware.

  AbstractEmu can use rooting exploits to silently give itself permissions or install additional malware.[lookout_abstractemu_1021]

  Exact relationship: relationship--25655385-5b0d-4700-a59f-d5d043625b84
• S1126 Phenakite — malware.

  Phenakite has included exploits for jailbreaking infected devices.[fb_arid_viper]

  Exact relationship: relationship--ed6ebdd2-0095-4241-b3fc-7fc22366ec0d
• S1185 LightSpy — malware.

  LightSpy uses the embedded `time_waste` function to bypass standard iOS API restrictions and enable unauthorized audio/video recording. This exploit injects a `.dylib` into the `SpringBoard` process, allowing persistent access to audio and video capture.[LinkedIn Dmitry LightSpy 2025][Threatfabric LightSpy 2024]

  Exact relationship: relationship--e515259a-63b1-4ac8-bbec-4b0103d0a79a

• M1001 Security Updates

  Security updates often contain patches for vulnerabilities.

• M1002 Attestation

  Device attestation can often detect jailbroken or rooted devices.

• M1010 Deploy Compromised Device Detection Method

  Mobile security products can potentially detect jailbroken or rooted devices.