T1414 Clipboard Data — Attack Simulation

DC0112 collection page — Instrument selected APIs in the owned test app or approved research build; log caller, API, sanitized argument class and return status.

Providers and collection configuration

• Android logcat: Permitted logs from a consented test device/emulator; output depends on build, permissions and instrumentation.
• Android dumpsys: Point-in-time service/package state on an authorized development device.
• Instrumented test application: Own-app permission, API and state callbacks; not universal visibility into other apps.

• Use a disposable emulator or owned development device with approved debugging. Record OS/API level, app version and instrumentation privileges.
• Collect only relevant logcat buffers/tags and service snapshots; add explicit own-app instrumentation for events absent from OS logs.
• Forward sanitized logs and compare before/after state. Remove test data and revoke debugging access after the lab session.

Required normalized fields: package, api, result, thread.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0112",
  "collector": "illustrative-lab-collector",
  "observation": {
    "package": "test.example.lab",
    "api": "android.hardware.camera2.CameraManager.openCamera",
    "result": "permission_denied",
    "thread": "main"
  }
}

Visibility limits: Android tooling does not imply iOS coverage. Standard mobile apps cannot observe all other apps or protected OS internals; MDM status is not full API, filesystem or content telemetry.

DC0123 collection page — Instrument the owned app lifecycle and corroborate permitted service snapshots; distinguish app events from inferred gateway activity.

Providers and collection configuration

• Android logcat: Permitted logs from a consented test device/emulator; output depends on build, permissions and instrumentation.
• Android dumpsys: Point-in-time service/package state on an authorized development device.
• Instrumented test application: Own-app permission, API and state callbacks; not universal visibility into other apps.

• Use a disposable emulator or owned development device with approved debugging. Record OS/API level, app version and instrumentation privileges.
• Collect only relevant logcat buffers/tags and service snapshots; add explicit own-app instrumentation for events absent from OS logs.
• Forward sanitized logs and compare before/after state. Remove test data and revoke debugging access after the lab session.

Required normalized fields: package, state_before, state_after, source.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0123",
  "collector": "illustrative-lab-collector",
  "observation": {
    "package": "test.example.lab",
    "state_before": "background",
    "state_after": "foreground",
    "source": "own_app_callback"
  }
}

Visibility limits: Android tooling does not imply iOS coverage. Standard mobile apps cannot observe all other apps or protected OS internals; MDM status is not full API, filesystem or content telemetry.

DC0082 collection page — Enable scoped Sysmon NetworkConnect (3), disabled by default, or a platform-equivalent process-aware network sensor.

Providers and collection configuration

• Microsoft Sysmon: Windows event-based collection; enable the event types needed below.
• Linux Audit: Linux alternative for supported system-call and file events; different semantics and fields.
• Apple Endpoint Security clients: macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.

• On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
• Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
• For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms.

Required normalized fields: process_guid, destination_ip, destination_port, protocol, initiated.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0082",
  "collector": "illustrative-lab-collector",
  "observation": {
    "process_guid": "lab-process-001",
    "destination_ip": "198.51.100.20",
    "destination_port": 443,
    "protocol": "tcp",
    "initiated": true
  }
}

Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.

DC0117 collection page — Use consented system debugging or supported notification monitoring; collect metadata rather than notification contents unless explicitly approved.

Providers and collection configuration

• Android logcat: Permitted logs from a consented test device/emulator; output depends on build, permissions and instrumentation.
• Android dumpsys: Point-in-time service/package state on an authorized development device.
• Instrumented test application: Own-app permission, API and state callbacks; not universal visibility into other apps.

• Use a disposable emulator or owned development device with approved debugging. Record OS/API level, app version and instrumentation privileges.
• Collect only relevant logcat buffers/tags and service snapshots; add explicit own-app instrumentation for events absent from OS logs.
• Forward sanitized logs and compare before/after state. Remove test data and revoke debugging access after the lab session.

Required normalized fields: device_id, notification_type, source, content_collected.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0117",
  "collector": "illustrative-lab-collector",
  "observation": {
    "device_id": "android-lab-1",
    "notification_type": "usb_connection",
    "source": "system",
    "content_collected": false
  }
}

Visibility limits: Android tooling does not imply iOS coverage. Standard mobile apps cannot observe all other apps or protected OS internals; MDM status is not full API, filesystem or content telemetry.

MITRE detection strategy

No exact-tagged Sigma source rule was imported. This does not establish that the technique is undetectable; the MITRE guidance and collection requirements remain relevant.

• S0295 RCSAndroid — malware.

  RCSAndroid can monitor clipboard content.[TrendMicro-RCSAndroid]

  Exact relationship: relationship--9e3921a8-a9e1-48c4-9b61-ff190c104f63
• S0297 XcodeGhost — malware.

  XcodeGhost can read and write data in the user’s clipboard.[PaloAlto-XcodeGhost]

  Exact relationship: relationship--2de76a24-ec87-4808-b0d3-b84d318ac22c
• S0421 GolfSpy — malware.

  GolfSpy can obtain clipboard contents.[Trend Micro Bouncing Golf 2019]

  Exact relationship: relationship--4b68bcb1-a512-40f7-9aee-235b3668f022
• S1079 BOULDSPY — malware.

  BOULDSPY can collect clipboard data.[lookout_bouldspy_0423]

  Exact relationship: relationship--4c035760-9bf2-40cd-87d1-f286afd76376
• S1241 RatMilad — malware.

  RatMilad has collected clipboard content.[ZimperiumGupta_RatMilad_Oct2022]

  Exact relationship: relationship--12006533-e26f-4168-9b1f-7fb3073a9938

• M1006 Use Recent OS Version

  Android 10 introduced changes to prevent applications from accessing clipboard data if they are not in the foreground or set as the device’s default IME.[Android 10 Privacy Changes]