1. Home
  2. Matrices
  3. Android

Android Matrices

Below are the tactics and techniques representing the two MITRE ATT&CK® Matrices for Mobile. The Matrices cover techniques involving device access and network-based effects that can be used by adversaries without device access. The Matrices contains information for the Android platform.

View on the ATT&CK® Navigator

Device Access

Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command and Control Exfiltration Impact
9 techniques 4 techniques 9 techniques 4 techniques 21 techniques 10 techniques 9 techniques 2 techniques 18 techniques 9 techniques 4 techniques 11 techniques
Deliver Malicious App via Authorized App Store
Deliver Malicious App via Other Means
Drive-by Compromise
Exploit via Charging Station or PC
Exploit via Radio Interfaces
Install Insecure or Malicious Configuration
Lockscreen Bypass
Masquerade as Legitimate Application
Supply Chain Compromise
Broadcast Receivers
Command-Line Interface
Native Code
Scheduled Task/Job
Broadcast Receivers
Code Injection
Compromise Application Executable
Foreground Persistence
Modify Cached Executable Code
Modify OS Kernel or Boot Partition
Modify System Partition
Modify Trusted Execution Environment
Scheduled Task/Job
Code Injection
Device Administrator Permissions
Exploit OS Vulnerability
Exploit TEE Vulnerability
Application Discovery
Code Injection
Delete Device Data
Device Lockout
Disguise Root/Jailbreak Indicators
Download New Code at Runtime
Evade Analysis Environment
Geofencing
Hooking
Input Injection
Install Insecure or Malicious Configuration
Masquerade as Legitimate Application
Modify OS Kernel or Boot Partition
Modify System Partition
Modify Trusted Execution Environment
Native Code
Obfuscated Files or Information
Proxy Through Victim
Suppress Application Icon
Uninstall Malicious Application
User Evasion
Access Notifications
Access Sensitive Data in Device Logs
Access Stored Application Data
Capture Clipboard Data
Capture SMS Messages
Exploit TEE Vulnerability
Input Capture
Input Prompt
Network Traffic Capture or Redirection
URI Hijacking
Application Discovery
Evade Analysis Environment
File and Directory Discovery
Location Tracking
Network Service Scanning
Process Discovery
System Information Discovery
System Network Configuration Discovery
System Network Connections Discovery
Attack PC via USB Connection
Exploit Enterprise Resources
Access Calendar Entries
Access Call Log
Access Contact List
Access Notifications
Access Sensitive Data in Device Logs
Access Stored Application Data
Call Control
Capture Audio
Capture Camera
Capture Clipboard Data
Capture SMS Messages
Data from Local System
Foreground Persistence
Input Capture
Location Tracking
Network Information Discovery
Network Traffic Capture or Redirection
Screen Capture
Alternate Network Mediums
Call Control
Commonly Used Port
Domain Generation Algorithms
Remote File Copy
Standard Application Layer Protocol
Standard Cryptographic Protocol
Uncommonly Used Port
Web Service
Alternate Network Mediums
Commonly Used Port
Data Encrypted
Standard Application Layer Protocol
Call Control
Carrier Billing Fraud
Clipboard Modification
Data Encrypted for Impact
Delete Device Data
Device Lockout
Generate Fraudulent Advertising Revenue
Input Injection
Manipulate App Store Rankings or Ratings
Modify System Partition
SMS Control
Last modified: 01 November 2021

Network-Based Effects

Network Effects Remote Service Effects
9 techniques 3 techniques
Downgrade to Insecure Protocols
Eavesdrop on Insecure Network Communication
Exploit SS7 to Redirect Phone Calls/SMS
Exploit SS7 to Track Device Location
Jamming or Denial of Service
Manipulate Device Communication
Rogue Cellular Base Station
Rogue Wi-Fi Access Points
SIM Card Swap
Obtain Device Cloud Backups
Remotely Track Device Without Authorization
Remotely Wipe Data Without Authorization
Last modified: 30 September 2021