TA0027
|
Initial Access
|
The initial access tactic represents the vectors adversaries use to gain an initial foothold onto a mobile device.
|
TA0028
|
Persistence
|
Persistence is any access, action, or configuration change to a mobile device that gives an attacker a persistent presence on the device. Attackers often will need to maintain
access to mobile devices through interruptions such as device reboots and potentially even factory data resets.
|
TA0029
|
Privilege Escalation
|
Privilege escalation includes techniques that allow an attacker to obtain a higher level of permissions on the mobile device. Attackers may enter the mobile device with very
limited privileges and may be required to take advantage of a device weakness to obtain higher privileges necessary to successfully carry out their mission objectives.
|
TA0030
|
Defense Evasion
|
Defense evasion consists of techniques an adversary may use to evade detection or avoid other defenses. Sometimes these actions are the same as or variations of techniques in
other categories that have the added benefit of subverting a particular defense or mitigation. Defense evasion may be considered a set of attributes the adversary applies to
all other phases of the operation.
|
TA0031
|
Credential Access
|
Credential access represents techniques that can be used by adversaries to obtain access to or control over passwords, tokens, cryptographic keys, or other values that could
be used by an adversary to gain unauthorized access to resources. Credential access allows the adversary to assume the identity of an account, with all of that account's
permissions on the system and network, and makes it harder for defenders to detect the adversary. With sufficient access within a network, an adversary can create accounts for
later use within the environment.
|
TA0032
|
Discovery
|
Discovery consists of techniques that allow the adversary to gain knowledge about the characteristics of the mobile device and potentially other networked systems. When
adversaries gain access to a new system, they must orient themselves to what they now have control of and what benefits operating from that system give to their current
objective or overall goals during the intrusion. The operating system may provide capabilities that aid in this post-compromise information-gathering phase.
|
TA0033
|
Lateral Movement
|
Lateral movement consists of techniques that enable an adversary to access and control remote systems on a network and could, but does not necessarily, include execution of
tools on remote systems. The lateral movement techniques could allow an adversary to gather information from a system without needing additional tools, such as a remote access
tool.
|
TA0034
|
Impact
|
The impact tactic consists of techniques used by the adversary to execute his or her mission objectives but that do not cleanly fit into another category such as Collection.
Mission objectives vary based on each adversary's goals, but examples include toll fraud, destruction of device data, or locking the user out of his or her device until a
ransom is paid.
|
TA0035
|
Collection
|
Collection consists of techniques used to identify and gather information, such as sensitive files, from a target network prior to exfiltration. This category also covers
locations on a system or network where the adversary may look for information to exfiltrate.
|
TA0036
|
Exfiltration
|
Exfiltration refers to techniques and attributes that result or aid in the adversary removing files and information from the targeted mobile device.
|
TA0037
|
Command and Control
|
The command and control tactic represents how adversaries communicate with systems under their control within a target network. There are many ways an adversary can establish
command and control with various levels of covertness, depending on system configuration and network topology. Due to the wide degree of variation available to the adversary
at the network level, only the most common factors were used to describe the differences in command and control. There are still a great many specific techniques within the
documented methods, largely due to how easy it is to define new protocols and use existing, legitimate protocols and network services for communication.
|
TA0038
|
Network Effects
|
This category refers to network-based techniques that an adversary may be able to use to fulfill his or her objectives without access to the mobile device itself. These
include techniques to intercept or manipulate network traffic to and from the mobile device.
|
TA0039
|
Remote Service Effects
|
This category refers to techniques involving remote services, such as vendor-provided cloud services (e.g. Google Drive, Google Find My Device, or Apple iCloud), or enterprise
mobility management (EMM)/mobile device management (MDM) services that an adversary may be able to use to fulfill his or her objectives without access to the mobile device
itself.
|