T1616 Call Control — Attack Simulation

DC0114 collection page — Compare manifest declarations with runtime granted state using authorized package inspection and own-app permission checks.

Providers and collection configuration

• Android logcat: Permitted logs from a consented test device/emulator; output depends on build, permissions and instrumentation.
• Android dumpsys: Point-in-time service/package state on an authorized development device.
• Instrumented test application: Own-app permission, API and state callbacks; not universal visibility into other apps.

• Use a disposable emulator or owned development device with approved debugging. Record OS/API level, app version and instrumentation privileges.
• Collect only relevant logcat buffers/tags and service snapshots; add explicit own-app instrumentation for events absent from OS logs.
• Forward sanitized logs and compare before/after state. Remove test data and revoke debugging access after the lab session.

Required normalized fields: package, permission, declared, granted.

adb shell dumpsys package test.example.lab

Read-only snapshot on a consented debug device. Replace the example package with your owned test app. Output and access vary by Android build; this is not a permission-request event stream.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0114",
  "collector": "illustrative-lab-collector",
  "observation": {
    "package": "test.example.lab",
    "permission": "android.permission.CAMERA",
    "declared": true,
    "granted": false
  }
}

Visibility limits: Android tooling does not imply iOS coverage. Standard mobile apps cannot observe all other apps or protected OS internals; MDM status is not full API, filesystem or content telemetry.

DC0061 collection page — Use file-integrity monitoring or scoped OS file-write auditing for general changes. Sysmon 2 records creation-time changes; it is not a general file-write event.

Providers and collection configuration

• Microsoft Sysmon: Windows event-based collection; enable the event types needed below.
• Linux Audit: Linux alternative for supported system-call and file events; different semantics and fields.
• Apple Endpoint Security clients: macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.

• On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
• Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
• For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms.

Required normalized fields: path, attribute, before, after.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0061",
  "collector": "illustrative-lab-collector",
  "observation": {
    "path": "C:\\Lab\\demo.txt",
    "attribute": "content_hash",
    "before": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
    "after": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
  }
}

Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.

DC0021 collection page — Use an approved EDR trace or instrument the owned lab process at selected APIs. Define API name, caller, sanitized arguments and return status.

Providers and collection configuration

• Application audit logs: First-party service events and request/result fields; schema is application-specific.
• OpenTelemetry-compatible log pipelines: Transport and normalization of emitted records; do not create missing audit instrumentation.

• Enable the application audit category or instrument the owned lab application at the authorization/action boundary.
• Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.
• Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart.

Required normalized fields: process_id, api, path, result.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0021",
  "collector": "illustrative-lab-collector",
  "observation": {
    "process_id": 4200,
    "api": "CreateFileW",
    "path": "C:\\Lab\\demo.txt",
    "result": "success"
  }
}

Visibility limits: Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.

MITRE detection strategy

No exact-tagged Sigma source rule was imported. This does not establish that the technique is undetectable; the MITRE guidance and collection requirements remain relevant.

• S0292 AndroRAT — malware.

  AndroRAT can make phone calls.[forcepoint_bitter]

  Exact relationship: relationship--e50c605a-0cdf-4316-bb49-2deccc69143f
• S0407 Monokle — malware.

  Monokle can be controlled via phone call from a set of "control phones."[Lookout-Monokle]

  Exact relationship: relationship--716f68ee-1e77-4254-8f67-d8f3c71db678
• S0422 Anubis — malware.

  Anubis can make phone calls.[Cofense Anubis]

  Exact relationship: relationship--6935752c-e400-4dfa-863f-1d44a8f6dd50
• S0529 CarbonSteal — malware.

  CarbonSteal can silently accept an incoming phone call.[Lookout Uyghur Campaign]

  Exact relationship: relationship--684c17bb-2075-4e1f-9fcb-17408511222d
• S0655 BusyGasper — malware.

  BusyGasper can open a hidden menu when a specific phone number is called from the infected device.[SecureList BusyGasper]

  Exact relationship: relationship--5b670281-0054-42b4-8e54-ea01a692f5bf
• S1054 Drinik — malware.

  Drinik can use the Android `CallScreeningService` to silently block incoming calls.[cyble_drinik_1022]

  Exact relationship: relationship--4e68feca-083f-40ed-88d8-2b6a3935c949
• S1069 TangleBot — malware.

  TangleBot can make and block phone calls.[cloudmark_tanglebot_0921]

  Exact relationship: relationship--4aae6ab8-2a67-4780-a69e-b15ecff7fc5d
• S1080 Fakecalls — malware.

  Fakecalls can intercept and imitate phone conversations by breaking the connection and displaying a fake call screen. It can also make outgoing calls and spoof incoming calls.[kaspersky_fakecalls_0422]

  Exact relationship: relationship--ade5c0c5-8b53-4bc5-9d81-0284be2e5fee
• S1083 Chameleon — malware.

  Chameleon has the ability to control calls.[ThreatFabric_Chameleon_Dec2023]

  Exact relationship: relationship--1cf04fb7-17a6-4424-a3f2-93f1b33d19cd
• S1092 Escobar — malware.

  Escobar can initiate phone calls.[Bleeipng Computer Escobar]

  Exact relationship: relationship--3a282967-0536-474d-8831-30cd60b818a9
• S1094 BRATA — malware.

  BRATA can hide incoming calls by setting ring volume to 0 and showing a blank screen overlay.[mcafee_brata_0421]

  Exact relationship: relationship--80eb5ebc-ae6f-461e-8e78-a18702249343
• S1195 SpyC23 — malware.

  SpyC23 can make phone calls.[welivesecurity_apt-c-23][SentinelLabs AridViper 2023]

  Exact relationship: relationship--06869cb8-7384-4d85-aa0a-78256133c88d
• S1214 Android/SpyAgent — malware.

  Android/SpyAgent can execute an automated phone call.[McAfee MoqHao 2019]

  Exact relationship: relationship--c6759fbe-ae7c-438e-9b30-dff3cc0b8e6c
• S1231 GodFather — malware.

  GodFather has requested for the `CALL_PHONE` permission to initiate phone calls.[MerkleScience_Godfather_April2023]

  Exact relationship: relationship--c836cf05-3e52-4b6e-8ade-a3e620dd32ad
• S9004 Crocodilus — malware.

  Crocodilus has the ability to enable call forwarding.[ThreatFabric_Crocodilus_March2025]

  Exact relationship: relationship--10c912f6-6e0c-41a7-9911-f7fa5c9ba6f8
• S9005 DocSwap — malware.

  DocSwap has requested for the `CALL_PHONE` permission to make phone calls.[EnkiWhiteHat_KimsukyDOCSWAP_Dec2025][S2W_DocSwap_Mar2025]

  Exact relationship: relationship--79872876-cb90-4371-9819-1bc51219d3f4
• S9006 VajraSpy — malware.

  VajraSpy has requested for `android.permission.CALL_PHONE`.[K7Dhanalakshmi_VajraSpy_April2022]

  Exact relationship: relationship--e92e167d-d8b7-4429-bf60-d923f0a7f714

• M1011 User Guidance

  Users should be encouraged to be very careful with what applications they grant phone call-based permissions to. Further, users should not change their default call handler to applications they do not recognize.