ATT&CK Changes Between v19.2 and v20.0

Key

New objects: ATT&CK objects which are only present in the new release.
Major version changes: ATT&CK objects that have a major version change. (e.g. 1.0 → 2.0)
Minor version changes: ATT&CK objects that have a minor version change. (e.g. 1.0 → 1.1)
Other version changes: ATT&CK objects that have a version change of any other kind. (e.g. 1.0 → 1.2)
Patches: ATT&CK objects that have been patched while keeping the version the same. (e.g., 1.0 → 1.0 but something like a typo, a URL, or some metadata was fixed)
Object revocations: ATT&CK objects which are revoked by a different object.
Object deprecations: ATT&CK objects which are deprecated and no longer in use, and not replaced.
Object deletions: ATT&CK objects which are no longer found in the STIX data.

Additional formats

These ATT&CK Navigator layer files can be uploaded to ATT&CK Navigator manually.

This JSON file contains the machine readble output used to create this page: changelog.json

Techniques

enterprise-attack

New Techniques

[T1608.007] Stage Capabilities: AI Result Poisoning

Current version: 1.0

Current version: 1.0

Description:

Adversaries may steal Application Specific Passwords (ASPs) to gain access to Valid Accounts, bypassing multifactor authentication (MFA) methods. ASPs are passwords typically used to give third-party applications or legacy devices (which do not support MFA methods) account access.(Citation: Application Specific Passwords)(Citation: Application Specific Passwords Push Sec)

An adversary may socially engineer a user into providing an ASP(Citation: UNC6293 ASP Creative Phishing Attack)(Citation: Application Specific Passwords Phishing) (using methods like Phishing for Information), generate an ASP for an already compromised account,(Citation: Mandiant APT42-untangling)(Citation: TAG APT42) or obtain an ASP stored on a system. Afterward, adversaries may use the ASP to access Valid Accounts and, in some cases, maintain Persistence, bypassing any form of MFA set on the account.

Major Version Changes

[T1195.001] Supply Chain Compromise: Compromise Software Dependencies and Development Tools

Current version: 2.0

Version changed from: 1.3 → 2.0

	Old Description			New Description
t	1	Adversaries may manipulate software dependencies and develop	t	1	Adversaries may manipulate software dependencies and develop
	>	ment tools prior to receipt by a final consumer for the purp		>	ment tools prior to receipt by a final consumer for the purp
	>	ose of data or system compromise. Applications often depend		>	ose of data or system compromise. Applications often depend
	>	on external software to function properly. Popular open sour		>	on external software to function properly. Popular open sour
	>	ce projects that are used as dependencies in many applicatio		>	ce projects that are used as dependencies in many applicatio
	>	ns, such as pip and NPM packages, may be targeted as a means		>	ns, such as pip and NPM packages, may be targeted as a means
	>	to add malicious code to users of the dependency.(Citation:		>	to add malicious code to users of the dependency.(Citation:
	>	Trendmicro NPM Compromise)(Citation: Bitdefender NPM Reposi		>	Trendmicro NPM Compromise)(Citation: Bitdefender NPM Reposi
	>	tories Compromised 2021)(Citation: MANDVI Malicious npm and		>	tories Compromised 2021)(Citation: MANDVI Malicious npm and
	>	PyPI Packages Disguised) This may also include abandoned pac		>	PyPI Packages Disguised) This may also include abandoned pac
	>	kages, which in some cases could be re-registered by threat		>	kages, which in some cases could be re-registered by threat
	>	actors after being removed by adversaries.(Citation: The Hac		>	actors after being removed by adversaries.(Citation: The Hac
	>	ker News PyPi Revival Hijack 2024) Adversaries may also empl		>	ker News PyPi Revival Hijack 2024) Adversaries may also empl
	>	oy "typosquatting" or name-confusion by choosing names simil		>	oy "typosquatting" or name-confusion by choosing names simil
	>	ar to existing popular libraries or packages in order to dec		>	ar to existing popular libraries or packages in order to dec
	>	eive a user.(Citation: Ahmed Backdoors in Python and NPM Pac		>	eive a user.(Citation: Ahmed Backdoors in Python and NPM Pac
	>	kages)(Citation: Meyer PyPI Supply Chain Attack Uncovered)(C		>	kages)(Citation: Meyer PyPI Supply Chain Attack Uncovered)(C
	>	itation: Checkmarx-oss-seo) Additionally, CI/CD pipeline co		>	itation: Checkmarx-oss-seo) Additionally, CI/CD pipeline co
	>	mponents, such as GitHub Actions, may be targeted in order t		>	mponents, such as GitHub Actions, may be targeted in order t
	>	o gain access to the building, testing, and deployment cycle		>	o gain access to the building, testing, and deployment cycle
	>	s of an application.(Citation: Unit 42 Palo Alto GitHub Acti		>	s of an application.(Citation: Unit 42 Palo Alto GitHub Acti
	>	ons Supply Chain Attack 2025) By adding malicious code into		>	ons Supply Chain Attack 2025) By adding malicious code into
	>	a GitHub action, a threat actor may be able to collect runti		>	a GitHub action, a threat actor may be able to collect runti
	>	me credentials (e.g., via [Proc Filesystem](https://attack.m		>	me credentials (e.g., via [Proc Filesystem](https://attack.m
	>	itre.org/techniques/T1003/007)) or insert further malicious		>	itre.org/techniques/T1003/007)) or insert further malicious
	>	components into the build pipelines for a second-order suppl		>	components into the build pipelines for a second-order suppl
	>	y chain compromise.(Citation: OWASP CICD-SEC-4) As GitHub Ac		>	y chain compromise.(Citation: OWASP CICD-SEC-4) As GitHub Ac
	>	tions are often dependent on other GitHub Actions, threat ac		>	tions are often dependent on other GitHub Actions, threat ac
	>	tors may be able to infect a large number of repositories vi		>	tors may be able to infect a large number of repositories vi
	>	a the compromise of a single Action.(Citation: Palo Alto Net		>	a the compromise of a single Action.(Citation: Palo Alto Net
	>	works GitHub Actions Worm 2023) Targeting may be specific t		>	works GitHub Actions Worm 2023) Adversaries may also target
	>	o a desired victim set or may be distributed to a broad set		>	the configuration and instruction files consumed by integra
	>	of consumers but only move on to additional tactics on speci		>	ted development environments and AI coding agents. Project f
	>	fic victims.		>	iles such as tasks.json may execute commands when a develope
				>	r opens or builds a project, while agent skill files (SKILL.
				>	md) supply an agent with instructions and resources that it
				>	loads on demand and runs with the permissions of the agent p
				>	rocess.(Citation: Microsoft - Agent Skills Docs)(Citation: G
				>	oogle Agent Files May 2026)(Citation: CrowdStrike Threat Hun
				>	ting Report 2026)(Citation: Microsoft Contagious Interview M
				>	arch 2026) To encourage downloads, adversaries may publish t
				>	hese files under benign-appearing or typo-squatted names, up
				>	load unmodified copies of the genuine skills first so the li
				>	stings accumulate installs before the content behind them is
				>	weaponized, or may place the malicious instructions in a se
				>	condary document that the reviewed entry point references.(C
				>	itation: Zenity Skill Supply Chain August 2026)(Citation: ES
				>	ET Agent Skills March 2026) Because these artifacts are natu
				>	ral language or configuration rather than executable code, t
				>	hey may pass registry screening and signature-based scanning
				>	.(Citation: ESET Agent Skills March 2026)(Citation: TrendMic
				>	ro - OpenClaw Skills Distribute ATMOS) Targeting may be sp
				>	ecific to a desired victim set or may be distributed to a br
				>	oad set of consumers but only move on to additional tactics
				>	on specific victims.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.622000+00:00	2026-10-06 16:05:56.514000+00:00
description	Adversaries may manipulate software dependencies and development tools prior to receipt by a final consumer for the purpose of data or system compromise. Applications often depend on external software to function properly. Popular open source projects that are used as dependencies in many applications, such as pip and NPM packages, may be targeted as a means to add malicious code to users of the dependency.(Citation: Trendmicro NPM Compromise)(Citation: Bitdefender NPM Repositories Compromised 2021)(Citation: MANDVI Malicious npm and PyPI Packages Disguised) This may also include abandoned packages, which in some cases could be re-registered by threat actors after being removed by adversaries.(Citation: The Hacker News PyPi Revival Hijack 2024) Adversaries may also employ "typosquatting" or name-confusion by choosing names similar to existing popular libraries or packages in order to deceive a user.(Citation: Ahmed Backdoors in Python and NPM Packages)(Citation: Meyer PyPI Supply Chain Attack Uncovered)(Citation: Checkmarx-oss-seo) Additionally, CI/CD pipeline components, such as GitHub Actions, may be targeted in order to gain access to the building, testing, and deployment cycles of an application.(Citation: Unit 42 Palo Alto GitHub Actions Supply Chain Attack 2025) By adding malicious code into a GitHub action, a threat actor may be able to collect runtime credentials (e.g., via [Proc Filesystem](https://attack.mitre.org/techniques/T1003/007)) or insert further malicious components into the build pipelines for a second-order supply chain compromise.(Citation: OWASP CICD-SEC-4) As GitHub Actions are often dependent on other GitHub Actions, threat actors may be able to infect a large number of repositories via the compromise of a single Action.(Citation: Palo Alto Networks GitHub Actions Worm 2023) Targeting may be specific to a desired victim set or may be distributed to a broad set of consumers but only move on to additional tactics on specific victims.	Adversaries may manipulate software dependencies and development tools prior to receipt by a final consumer for the purpose of data or system compromise. Applications often depend on external software to function properly. Popular open source projects that are used as dependencies in many applications, such as pip and NPM packages, may be targeted as a means to add malicious code to users of the dependency.(Citation: Trendmicro NPM Compromise)(Citation: Bitdefender NPM Repositories Compromised 2021)(Citation: MANDVI Malicious npm and PyPI Packages Disguised) This may also include abandoned packages, which in some cases could be re-registered by threat actors after being removed by adversaries.(Citation: The Hacker News PyPi Revival Hijack 2024) Adversaries may also employ "typosquatting" or name-confusion by choosing names similar to existing popular libraries or packages in order to deceive a user.(Citation: Ahmed Backdoors in Python and NPM Packages)(Citation: Meyer PyPI Supply Chain Attack Uncovered)(Citation: Checkmarx-oss-seo) Additionally, CI/CD pipeline components, such as GitHub Actions, may be targeted in order to gain access to the building, testing, and deployment cycles of an application.(Citation: Unit 42 Palo Alto GitHub Actions Supply Chain Attack 2025) By adding malicious code into a GitHub action, a threat actor may be able to collect runtime credentials (e.g., via [Proc Filesystem](https://attack.mitre.org/techniques/T1003/007)) or insert further malicious components into the build pipelines for a second-order supply chain compromise.(Citation: OWASP CICD-SEC-4) As GitHub Actions are often dependent on other GitHub Actions, threat actors may be able to infect a large number of repositories via the compromise of a single Action.(Citation: Palo Alto Networks GitHub Actions Worm 2023) Adversaries may also target the configuration and instruction files consumed by integrated development environments and AI coding agents. Project files such as tasks.json may execute commands when a developer opens or builds a project, while agent skill files (SKILL.md) supply an agent with instructions and resources that it loads on demand and runs with the permissions of the agent process.(Citation: Microsoft - Agent Skills Docs)(Citation: Google Agent Files May 2026)(Citation: CrowdStrike Threat Hunting Report 2026)(Citation: Microsoft Contagious Interview March 2026) To encourage downloads, adversaries may publish these files under benign-appearing or typo-squatted names, upload unmodified copies of the genuine skills first so the listings accumulate installs before the content behind them is weaponized, or may place the malicious instructions in a secondary document that the reviewed entry point references.(Citation: Zenity Skill Supply Chain August 2026)(Citation: ESET Agent Skills March 2026) Because these artifacts are natural language or configuration rather than executable code, they may pass registry screening and signature-based scanning.(Citation: ESET Agent Skills March 2026)(Citation: TrendMicro - OpenClaw Skills Distribute ATMOS) Targeting may be specific to a desired victim set or may be distributed to a broad set of consumers but only move on to additional tactics on specific victims.
x_mitre_version	1.3	2.0

iterable_item_added
STIX Field	Old value	New Value
external_references		{'source_name': 'TrendMicro - OpenClaw Skills Distribute ATMOS', 'description': 'Alfredo Oliveira, Buddy Tancio, David Fiser, Philippe Lin, Roel Reyes. (2026, February 23). Malicious OpenClaw Skills Used to Distribute Atomic macOS Stealer. Retrieved October 1, 2026.', 'url': 'https://www.trendmicro.com/en/research/26/b/openclaw-skills-used-to-distribute-atomic-macos-stealer.html'}
external_references		{'source_name': 'Google Agent Files May 2026', 'description': 'Bernardo Quintero, Daniel Kapellmann Zafra. (2026, May 12). Beyond source code: The files AI coding agents trust — and attackers exploit. Retrieved October 1, 2026.', 'url': 'https://cloud.google.com/blog/products/identity-security/beyond-source-code-the-files-ai-coding-agents-trust-and-attackers-exploit'}
external_references		{'source_name': 'CrowdStrike Threat Hunting Report 2026', 'description': 'CrowdStrike. (2026, August). CROWDSTRIKE 2026 THREAT HUNTING REPORT. Retrieved October 1, 2026.', 'url': 'https://go.crowdstrike.com/2026-threat-hunting-report.html'}
external_references		{'source_name': 'ESET Agent Skills March 2026', 'description': 'ESET Research. (2026, March 20). Too big to ignore? The security crisis brewing in AI agent platforms. Retrieved October 1, 2026.', 'url': 'https://www.eset.com/blog/en/business-topics/threat-landscape/security-in-ai-agent-platforms/'}
external_references		{'source_name': 'Zenity Skill Supply Chain August 2026', 'description': 'Michael Bargury. (2026, August 6). Attackers Target Agents via The Skill Supply Chain. Retrieved October 1, 2026.', 'url': 'https://labs.zenity.io/post/attackers-target-agents-via-the-skill-supply-chain'}
external_references		{'source_name': 'Microsoft Contagious Interview March 2026', 'description': 'Microsoft Defender Experts, Microsoft Defender Security Research Team. (2026, March 11). Contagious Interview: Malware delivered through fake developer job interviews. Retrieved October 1, 2026.', 'url': 'https://www.microsoft.com/en-us/security/blog/2026/03/11/contagious-interview-malware-delivered-through-fake-developer-job-interviews/'}
external_references		{'source_name': 'Microsoft - Agent Skills Docs', 'description': 'Sergey Menshykh. (2026, September 18). Agent Skills. Retrieved October 1, 2026.', 'url': 'https://learn.microsoft.com/en-us/agent-framework/agents/skills'}

Minor Version Changes

[T1588.007] Obtain Capabilities: Artificial Intelligence

Current version: 1.2

Version changed from: 1.1 → 1.2

	Old Description			New Description
t	1	Adversaries may obtain access to generative artificial intel	t	1	Adversaries may obtain access to generative artificial intel
	>	ligence tools, such as large language models (LLMs), to aid		>	ligence (AI) tools, such as large language models (LLMs), to
	>	various techniques during targeting. These tools may be used		>	aid various techniques during targeting. These tools may be
	>	to inform, bolster, and enable a variety of malicious tasks		>	used to inform, bolster, and enable a variety of malicious
	>	, including conducting [Reconnaissance](https://attack.mitre		>	tasks, including creating scripts, assisting social engineer
	>	.org/tactics/TA0043), creating basic scripts, assisting soci		>	ing, developing payloads, and to [Query Public AI Services](
	>	al engineering, and even developing payloads.(Citation: MSFT		>	https://attack.mitre.org/techniques/T1682) in support of [Re
	>	-AI) For example, by utilizing a publicly available LLM an		>	connaissance](https://attack.mitre.org/tactics/TA0043).(Cita
	>	adversary is essentially outsourcing or automating certain		>	tion: MSFT-AI) For example, by utilizing a publicly availa
	>	tasks to the tool. Using AI, the adversary may draft and gen		>	ble LLM an adversary is essentially outsourcing or automatin
	>	erate content in a variety of written languages to be used i		>	g certain tasks to the tool. Using AI, the adversary may dra
	>	n [Phishing](https://attack.mitre.org/techniques/T1566)/[Phi		>	ft and [Generate Content](https://attack.mitre.org/technique
	>	shing for Information](https://attack.mitre.org/techniques/T		>	s/T1683) in a variety of written languages to be used in [Ph
	>	1598) campaigns. The same publicly available tool may furthe		>	ishing](https://attack.mitre.org/techniques/T1566)/[Phishing
	>	r enable vulnerability or other offensive research supportin		>	for Information](https://attack.mitre.org/techniques/T1598)
	>	g [Develop Capabilities](https://attack.mitre.org/techniques		>	campaigns. The same publicly available tool may further ena
	>	/T1587). AI tools may also automate technical tasks by gener		>	ble vulnerability or other offensive research supporting [De
	>	ating, refining, or otherwise enhancing (e.g., [Obfuscated F		>	velop Capabilities](https://attack.mitre.org/techniques/T158
	>	iles or Information](https://attack.mitre.org/techniques/T10		>	7). AI tools may also automate technical tasks by generating
	>	27)) malicious scripts and payloads.(Citation: OpenAI-CTI) F		>	, refining, or otherwise enhancing (e.g., [Obfuscated Files
	>	inally, AI-generated text, images, audio, and video may be u		>	or Information](https://attack.mitre.org/techniques/T1027))
	>	sed for fraud, [Impersonation](https://attack.mitre.org/tech		>	malicious scripts and payloads.(Citation: OpenAI-CTI) Finall
	>	niques/T1684/001), and other malicious activities.(Citation:		>	y, AI-generated text, images, audio, and video may be used f
	>	Google-Vishing24)(Citation: IC3-AI24)(Citation: WSJ-Vishing		>	or fraud, [Impersonation](https://attack.mitre.org/technique
	>	-AI24)		>	s/T1684/001), and other malicious activities.(Citation: Goog
				>	le-Vishing24)(Citation: IC3-AI24)(Citation: WSJ-Vishing-AI24
				>	)

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.620000+00:00	2026-09-16 19:44:37.015000+00:00
description	Adversaries may obtain access to generative artificial intelligence tools, such as large language models (LLMs), to aid various techniques during targeting. These tools may be used to inform, bolster, and enable a variety of malicious tasks, including conducting [Reconnaissance](https://attack.mitre.org/tactics/TA0043), creating basic scripts, assisting social engineering, and even developing payloads.(Citation: MSFT-AI) For example, by utilizing a publicly available LLM an adversary is essentially outsourcing or automating certain tasks to the tool. Using AI, the adversary may draft and generate content in a variety of written languages to be used in [Phishing](https://attack.mitre.org/techniques/T1566)/[Phishing for Information](https://attack.mitre.org/techniques/T1598) campaigns. The same publicly available tool may further enable vulnerability or other offensive research supporting [Develop Capabilities](https://attack.mitre.org/techniques/T1587). AI tools may also automate technical tasks by generating, refining, or otherwise enhancing (e.g., [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027)) malicious scripts and payloads.(Citation: OpenAI-CTI) Finally, AI-generated text, images, audio, and video may be used for fraud, [Impersonation](https://attack.mitre.org/techniques/T1684/001), and other malicious activities.(Citation: Google-Vishing24)(Citation: IC3-AI24)(Citation: WSJ-Vishing-AI24)	Adversaries may obtain access to generative artificial intelligence (AI) tools, such as large language models (LLMs), to aid various techniques during targeting. These tools may be used to inform, bolster, and enable a variety of malicious tasks, including creating scripts, assisting social engineering, developing payloads, and to [Query Public AI Services](https://attack.mitre.org/techniques/T1682) in support of [Reconnaissance](https://attack.mitre.org/tactics/TA0043).(Citation: MSFT-AI) For example, by utilizing a publicly available LLM an adversary is essentially outsourcing or automating certain tasks to the tool. Using AI, the adversary may draft and [Generate Content](https://attack.mitre.org/techniques/T1683) in a variety of written languages to be used in [Phishing](https://attack.mitre.org/techniques/T1566)/[Phishing for Information](https://attack.mitre.org/techniques/T1598) campaigns. The same publicly available tool may further enable vulnerability or other offensive research supporting [Develop Capabilities](https://attack.mitre.org/techniques/T1587). AI tools may also automate technical tasks by generating, refining, or otherwise enhancing (e.g., [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027)) malicious scripts and payloads.(Citation: OpenAI-CTI) Finally, AI-generated text, images, audio, and video may be used for fraud, [Impersonation](https://attack.mitre.org/techniques/T1684/001), and other malicious activities.(Citation: Google-Vishing24)(Citation: IC3-AI24)(Citation: WSJ-Vishing-AI24)
x_mitre_version	1.1	1.2

[T1573.002] Encrypted Channel: Asymmetric Cryptography

Current version: 1.3

Version changed from: 1.2 → 1.3

	Old Description			New Description
t	1	Adversaries may employ a known asymmetric encryption algorit	t	1	Adversaries may employ a known asymmetric encryption algorit
	>	hm to conceal command and control traffic rather than relyin		>	hm to conceal command and control traffic rather than relyin
	>	g on any inherent protections provided by a communication pr		>	g on any inherent protections provided by a communication pr
	>	otocol. Asymmetric cryptography, also known as public key cr		>	otocol. Asymmetric cryptography, also known as public key cr
	>	yptography, uses a keypair per party: one public that can be		>	yptography, uses a keypair per party: one public that can be
	>	freely distributed, and one private. Due to how the keys ar		>	freely distributed, and one private. Due to how the keys ar
	>	e generated, the sender encrypts data with the receiver’s pu		>	e generated, the sender encrypts data with the receiver’s pu
	>	blic key and the receiver decrypts the data with their priva		>	blic key and the receiver decrypts the data with their priva
	>	te key. This ensures that only the intended recipient can re		>	te key. This ensures that only the intended recipient can re
	>	ad the encrypted data. Common public key encryption algorith		>	ad the encrypted data. Common public key encryption algorith
	>	ms include RSA and ElGamal. For efficiency, many protocols		>	ms include RSA and ElGamal. For efficiency, many protocols
	>	(including SSL/TLS) use symmetric cryptography once a connec		>	(including SSL/TLS) use symmetric cryptography once a connec
	>	tion is established, but use asymmetric cryptography to esta		>	tion is established, but use asymmetric cryptography to esta
	>	blish or transmit a key. As such, these protocols are classi		>	blish or transmit a key. As such, these protocols are classi
	>	fied as [Asymmetric Cryptography](https://attack.mitre.org/t		>	fied as [Asymmetric Cryptography](https://attack.mitre.org/t
	>	echniques/T1573/002).		>	echniques/T1573/002).(Citation: What is asymmetric encryptio
				>	n)(Citation: Symmetric vs Asymmetric Cryptography)

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.713000+00:00	2026-09-11 19:44:43.501000+00:00
description	Adversaries may employ a known asymmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Asymmetric cryptography, also known as public key cryptography, uses a keypair per party: one public that can be freely distributed, and one private. Due to how the keys are generated, the sender encrypts data with the receiver’s public key and the receiver decrypts the data with their private key. This ensures that only the intended recipient can read the encrypted data. Common public key encryption algorithms include RSA and ElGamal. For efficiency, many protocols (including SSL/TLS) use symmetric cryptography once a connection is established, but use asymmetric cryptography to establish or transmit a key. As such, these protocols are classified as [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002).	Adversaries may employ a known asymmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Asymmetric cryptography, also known as public key cryptography, uses a keypair per party: one public that can be freely distributed, and one private. Due to how the keys are generated, the sender encrypts data with the receiver’s public key and the receiver decrypts the data with their private key. This ensures that only the intended recipient can read the encrypted data. Common public key encryption algorithms include RSA and ElGamal. For efficiency, many protocols (including SSL/TLS) use symmetric cryptography once a connection is established, but use asymmetric cryptography to establish or transmit a key. As such, these protocols are classified as [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002).(Citation: What is asymmetric encryption)(Citation: Symmetric vs Asymmetric Cryptography)
external_references[1]['source_name']	SANS Decrypting SSL	Symmetric vs Asymmetric Cryptography
external_references[1]['description']	Butler, M. (2013, November). Finding Hidden Threats by Decrypting SSL. Retrieved April 5, 2016.	Keyfactor. (2026, July 22). Symmetric vs Asymmetric Cryptography: What’s the Difference and When to Use Each. Retrieved September 2, 2026.
external_references[1]['url']	http://www.sans.org/reading-room/whitepapers/analyst/finding-hidden-threats-decrypting-ssl-34840	https://www.keyfactor.com/blog/symmetric-vs-asymmetric-cryptography-whats-the-difference-and-when-to-use-each/
x_mitre_version	1.2	1.3

iterable_item_added
STIX Field	Old value	New Value
external_references		{'source_name': 'What is asymmetric encryption', 'description': 'IBM Annie Badman, Matthew Kosinski. (n.d.). What is asymmetric encryption. Retrieved September 2, 2026.', 'url': 'https://www.ibm.com/think/topics/asymmetric-encryption'}

iterable_item_removed
STIX Field	Old value	New Value
external_references	{'source_name': 'SEI SSL Inspection Risks', 'description': 'Dormann, W. (2015, March 13). The Risks of SSL Inspection. Retrieved April 5, 2016.', 'url': 'https://insights.sei.cmu.edu/cert/2015/03/the-risks-of-ssl-inspection.html'}
external_references	{'source_name': 'University of Birmingham C2', 'description': 'Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.', 'url': 'https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf'}

[T1213.001] Data from Information Repositories: Confluence

Current version: 1.2

Version changed from: 1.1 → 1.2

	Old Description			New Description
t	1	Adversaries may leverage Confluence repositories to mine va	t	1	Adversaries may leverage Confluence repositories to mine va
	>	luable information. Often found in development environments		>	luable information.(Citation: Confluence Standards in Data E
	>	alongside Atlassian JIRA, Confluence is generally used to st		>	ngineering) Often found in development environments alongsid
	>	ore development-related documentation, however, in general m		>	e Atlassian JIRA, Confluence is generally used to store deve
	>	ay contain more diverse categories of useful information, su		>	lopment-related documentation, however, in general may conta
	>	ch as: * Policies, procedures, and standards * Physical / l		>	in more diverse categories of useful information, such as:
	>	ogical network diagrams * System architecture diagrams * Tec		>	* Policies, procedures, and standards * Physical / logical n
	>	hnical system documentation * Testing / development credenti		>	etwork diagrams * System architecture diagrams * Technical s
	>	als (i.e., [Unsecured Credentials](https://attack.mitre.org/		>	ystem documentation * Testing / development credentials (i.e
	>	techniques/T1552)) * Work / project schedules * Source code		>	., [Unsecured Credentials](https://attack.mitre.org/techniqu
	>	snippets * Links to network shares and other internal resour		>	es/T1552)) * Work / project schedules * Source code snippets
	>	ces		>	* Links to network shares and other internal resources

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.643000+00:00	2026-09-02 19:58:33.749000+00:00
description	Adversaries may leverage Confluence repositories to mine valuable information. Often found in development environments alongside Atlassian JIRA, Confluence is generally used to store development-related documentation, however, in general may contain more diverse categories of useful information, such as: * Policies, procedures, and standards * Physical / logical network diagrams * System architecture diagrams * Technical system documentation * Testing / development credentials (i.e., [Unsecured Credentials](https://attack.mitre.org/techniques/T1552)) * Work / project schedules * Source code snippets * Links to network shares and other internal resources	Adversaries may leverage Confluence repositories to mine valuable information.(Citation: Confluence Standards in Data Engineering) Often found in development environments alongside Atlassian JIRA, Confluence is generally used to store development-related documentation, however, in general may contain more diverse categories of useful information, such as: * Policies, procedures, and standards * Physical / logical network diagrams * System architecture diagrams * Technical system documentation * Testing / development credentials (i.e., [Unsecured Credentials](https://attack.mitre.org/techniques/T1552)) * Work / project schedules * Source code snippets * Links to network shares and other internal resources
external_references[1]['source_name']	Atlassian Confluence Logging	Confluence Standards in Data Engineering
external_references[1]['description']	Atlassian. (2018, January 9). How to Enable User Access Logging. Retrieved April 4, 2018.	Agha Mustafa Ali Khan Qizilbash. (2025, June 4). Confluence Standards in Data Engineering. Retrieved September 2, 2026.
external_references[1]['url']	https://confluence.atlassian.com/confkb/how-to-enable-user-access-logging-182943.html	https://medium.com/data-engineering-technical-standards-and-best/confluence-standards-in-data-engineering-b5dee98eac83
x_mitre_version	1.1	1.2

[T1030] Data Transfer Size Limits

Current version: 1.2

Version changed from: 1.1 → 1.2

	Old Description			New Description
t	1	An adversary may exfiltrate data in fixed size chunks instea	t	1	An adversary may exfiltrate data in fixed size chunks instea
	>	d of whole files or limit packet sizes below certain thresho		>	d of whole files or limit packet sizes below certain thresho
	>	lds. This approach may be used to avoid triggering network d		>	lds. This approach may be used to avoid triggering network d
	>	ata transfer threshold alerts.		>	ata transfer threshold alerts.(Citation: Chunked Encoding)

Details

values_changed
STIX Field	Old value	New Value
modified	2025-10-24 17:49:20.770000+00:00	2026-09-16 18:03:15.995000+00:00
description	An adversary may exfiltrate data in fixed size chunks instead of whole files or limit packet sizes below certain thresholds. This approach may be used to avoid triggering network data transfer threshold alerts.	An adversary may exfiltrate data in fixed size chunks instead of whole files or limit packet sizes below certain thresholds. This approach may be used to avoid triggering network data transfer threshold alerts.(Citation: Chunked Encoding)
external_references[1]['source_name']	University of Birmingham C2	Chunked Encoding
external_references[1]['description']	Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.	Requestly. (n.d.). Chunked Transfer Encoding Explained. Retrieved September 2, 2026.
external_references[1]['url']	https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf	https://requestly.com/blog/chunked-encoding/
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	1.2

[T1039] Data from Network Shared Drive

Current version: 1.6

Version changed from: 1.5 → 1.6

	Old Description			New Description
t	1	Adversaries may search network shares on computers they have	t	1	Adversaries may search network shares on computers they have
	>	compromised to find files of interest. Sensitive data can b		>	compromised to find files of interest. Sensitive data can b
	>	e collected from remote systems via shared network drives (h		>	e collected from remote systems via shared network drives (h
	>	ost shared directory, network file server, etc.) that are ac		>	ost shared directory, network file server, etc.) that are ac
	>	cessible from the current system prior to Exfiltration. Inte		>	cessible from the current system prior to Exfiltration. Inte
	>	ractive command shells may be in use, and common functionali		>	ractive command shells may be in use, and common functionali
	>	ty within [cmd](https://attack.mitre.org/software/S0106) may		>	ty within [cmd](https://attack.mitre.org/software/S0106) may
	>	be used to gather information.		>	be used to gather information.(Citation: Net Use)(Citation:
				>	Cybersecurity Advisory GRU Brute Force Campaign July 2021)

Details

values_changed
STIX Field	Old value	New Value
modified	2025-10-24 17:49:13.555000+00:00	2026-09-02 18:26:02.395000+00:00
description	Adversaries may search network shares on computers they have compromised to find files of interest. Sensitive data can be collected from remote systems via shared network drives (host shared directory, network file server, etc.) that are accessible from the current system prior to Exfiltration. Interactive command shells may be in use, and common functionality within [cmd](https://attack.mitre.org/software/S0106) may be used to gather information.	Adversaries may search network shares on computers they have compromised to find files of interest. Sensitive data can be collected from remote systems via shared network drives (host shared directory, network file server, etc.) that are accessible from the current system prior to Exfiltration. Interactive command shells may be in use, and common functionality within [cmd](https://attack.mitre.org/software/S0106) may be used to gather information.(Citation: Net Use)(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021)
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.5	1.6

iterable_item_added
STIX Field	Old value	New Value
external_references		{'source_name': 'Net Use', 'description': 'Microsoft Ignite. (n.d.). Net Use. Retrieved September 2, 2026.', 'url': 'https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/gg651155(v=ws.11)'}
external_references		{'source_name': 'Cybersecurity Advisory GRU Brute Force Campaign July 2021', 'description': 'NSA, CISA, FBI, NCSC. (2021, July). Russian GRU Conducting Global Brute Force Campaign to Compromise Enterprise and Cloud Environments. Retrieved July 26, 2021.', 'url': 'https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF'}

[T1102.001] Web Service: Dead Drop Resolver

Current version: 1.2

Version changed from: 1.1 → 1.2

	Old Description			New Description
t	1	Adversaries may use an existing, legitimate external Web ser	t	1	Adversaries may use an existing, legitimate external Web ser
	>	vice to host information that points to additional command a		>	vice to host information that points to additional command a
	>	nd control (C2) infrastructure. Adversaries may post content		>	nd control (C2) infrastructure. Adversaries may post content
	>	, known as a dead drop resolver, on Web services with embedd		>	, known as a dead drop resolver, on Web services with embedd
	>	ed (and often obfuscated/encoded) domains or IP addresses. O		>	ed (and often obfuscated/encoded) domains or IP addresses. O
	>	nce infected, victims will reach out to and be redirected by		>	nce infected, victims will reach out to and be redirected by
	>	these resolvers. Popular websites and social media acting		>	these resolvers.(Citation: Dead Drop Resolver) Popular web
	>	as a mechanism for C2 may give a significant amount of cover		>	sites and social media acting as a mechanism for C2 may give
	>	due to the likelihood that hosts within a network are alrea		>	a significant amount of cover due to the likelihood that ho
	>	dy communicating with them prior to a compromise. Using comm		>	sts within a network are already communicating with them pri
	>	on services, such as those offered by Google or Twitter, mak		>	or to a compromise. Using common services, such as those off
	>	es it easier for adversaries to hide in expected noise. Web		>	ered by Google or Twitter, makes it easier for adversaries t
	>	service providers commonly use SSL/TLS encryption, giving ad		>	o hide in expected noise. Web service providers commonly use
	>	versaries an added level of protection. Use of a dead drop		>	SSL/TLS encryption, giving adversaries an added level of pr
	>	resolver may also protect back-end C2 infrastructure from di		>	otection. Use of a dead drop resolver may also protect back
	>	scovery through malware binary analysis while also enabling		>	-end C2 infrastructure from discovery through malware binary
	>	operational resiliency (since this infrastructure may be dyn		>	analysis while also enabling operational resiliency (since
	>	amically changed).		>	this infrastructure may be dynamically changed).

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.725000+00:00	2026-09-11 19:23:51.161000+00:00
description	Adversaries may use an existing, legitimate external Web service to host information that points to additional command and control (C2) infrastructure. Adversaries may post content, known as a dead drop resolver, on Web services with embedded (and often obfuscated/encoded) domains or IP addresses. Once infected, victims will reach out to and be redirected by these resolvers. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection. Use of a dead drop resolver may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).	Adversaries may use an existing, legitimate external Web service to host information that points to additional command and control (C2) infrastructure. Adversaries may post content, known as a dead drop resolver, on Web services with embedded (and often obfuscated/encoded) domains or IP addresses. Once infected, victims will reach out to and be redirected by these resolvers.(Citation: Dead Drop Resolver) Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection. Use of a dead drop resolver may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).
external_references[1]['source_name']	University of Birmingham C2	Dead Drop Resolver
external_references[1]['description']	Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.	Sycope. (2025, April 16). Dead Drop Resolver. Retrieved September 2, 2026.
external_references[1]['url']	https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf	https://www.sycope.com/post/dictionary-item/dead-drop-resolver
x_mitre_version	1.1	1.2

[T1491] Defacement

Current version: 1.5

Version changed from: 1.4 → 1.5

	Old Description			New Description
t	1	Adversaries may modify visual content available internally o	t	1	Adversaries may modify visual content available internally o
	>	r externally to an enterprise network, thus affecting the in		>	r externally to an enterprise network, thus affecting the in
	>	tegrity of the original content. Reasons for [Defacement](ht		>	tegrity of the original content. Reasons for [Defacement](ht
	>	tps://attack.mitre.org/techniques/T1491) include delivering		>	tps://attack.mitre.org/techniques/T1491) include delivering
	>	messaging, intimidation, or claiming (possibly false) credit		>	messaging, intimidation, or claiming (possibly false) credit
	>	for an intrusion. Disturbing or offensive images may be use		>	for an intrusion. Disturbing or offensive images may be use
	>	d as a part of [Defacement](https://attack.mitre.org/techniq		>	d as a part of [Defacement](https://attack.mitre.org/techniq
	>	ues/T1491) in order to cause user discomfort, or to pressure		>	ues/T1491) in order to cause user discomfort, or to pressure
	>	compliance with accompanying messages.		>	compliance with accompanying messages.(Citation: Defacement
				>	Attacks)

Details

values_changed
STIX Field	Old value	New Value
modified	2025-10-24 17:48:49.761000+00:00	2026-09-02 20:02:31.002000+00:00
description	Adversaries may modify visual content available internally or externally to an enterprise network, thus affecting the integrity of the original content. Reasons for [Defacement](https://attack.mitre.org/techniques/T1491) include delivering messaging, intimidation, or claiming (possibly false) credit for an intrusion. Disturbing or offensive images may be used as a part of [Defacement](https://attack.mitre.org/techniques/T1491) in order to cause user discomfort, or to pressure compliance with accompanying messages.	Adversaries may modify visual content available internally or externally to an enterprise network, thus affecting the integrity of the original content. Reasons for [Defacement](https://attack.mitre.org/techniques/T1491) include delivering messaging, intimidation, or claiming (possibly false) credit for an intrusion. Disturbing or offensive images may be used as a part of [Defacement](https://attack.mitre.org/techniques/T1491) in order to cause user discomfort, or to pressure compliance with accompanying messages.(Citation: Defacement Attacks)
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.4	1.5

iterable_item_added
STIX Field	Old value	New Value
external_references		{'source_name': 'Defacement Attacks', 'description': 'HKCERT. (2024, March 20). Defacement Attacks: Understanding and Prevention. Retrieved September 2, 2026.', 'url': 'https://www.hkcert.org/blog/defacement-attacks-understanding-and-prevention'}

[T1587] Develop Capabilities

Current version: 1.2

Version changed from: 1.1 → 1.2

	Old Description			New Description
t	1	Adversaries may build capabilities that can be used during t	t	1	Adversaries may build capabilities that can be used during t
	>	argeting. Rather than purchasing, freely downloading, or ste		>	argeting. Rather than purchasing, freely downloading, or ste
	>	aling capabilities, adversaries may develop their own capabi		>	aling capabilities, adversaries may develop their own capabi
	>	lities in-house. This is the process of identifying developm		>	lities in-house. This is the process of identifying developm
	>	ent requirements and building solutions such as malware, exp		>	ent requirements and building solutions such as malware, exp
	>	loits, and self-signed certificates. Adversaries may develop		>	loits, and self-signed certificates. Adversaries may develop
	>	capabilities to support their operations throughout numerou		>	capabilities to support their operations throughout numerou
	>	s phases of the adversary lifecycle.(Citation: Mandiant APT1		>	s phases of the adversary lifecycle.(Citation: Mandiant APT1
	>	)(Citation: Kaspersky Sofacy)(Citation: Bitdefender StrongPi		>	)(Citation: Kaspersky Sofacy)(Citation: Bitdefender StrongPi
	>	ty June 2020)(Citation: Talos Promethium June 2020) As with		>	ty June 2020)(Citation: Talos Promethium June 2020) As with
	>	legitimate development efforts, different skill sets may be		>	legitimate development efforts, different skill sets may be
	>	required for developing capabilities. The skills needed may		>	required for developing capabilities. The skills needed may
	>	be located in-house, or may need to be contracted out. Use		>	be located in-house, or may need to be contracted out. Use
	>	of a contractor may be considered an extension of that adver		>	of a contractor may be considered an extension of that adver
	>	sary's development capabilities, provided the adversary play		>	sary's development capabilities, provided the adversary play
	>	s a role in shaping requirements and maintains a degree of e		>	s a role in shaping requirements and maintains a degree of e
	>	xclusivity to the capability.		>	xclusivity to the capability. Adversaries may also employ th
				>	e use of [Artificial Intelligence](https://attack.mitre.org/
				>	techniques/T1588/007) for development.

Details

values_changed
STIX Field	Old value	New Value
modified	2025-10-24 17:49:34.675000+00:00	2026-09-18 18:22:04.969000+00:00
description	Adversaries may build capabilities that can be used during targeting. Rather than purchasing, freely downloading, or stealing capabilities, adversaries may develop their own capabilities in-house. This is the process of identifying development requirements and building solutions such as malware, exploits, and self-signed certificates. Adversaries may develop capabilities to support their operations throughout numerous phases of the adversary lifecycle.(Citation: Mandiant APT1)(Citation: Kaspersky Sofacy)(Citation: Bitdefender StrongPity June 2020)(Citation: Talos Promethium June 2020) As with legitimate development efforts, different skill sets may be required for developing capabilities. The skills needed may be located in-house, or may need to be contracted out. Use of a contractor may be considered an extension of that adversary's development capabilities, provided the adversary plays a role in shaping requirements and maintains a degree of exclusivity to the capability.	Adversaries may build capabilities that can be used during targeting. Rather than purchasing, freely downloading, or stealing capabilities, adversaries may develop their own capabilities in-house. This is the process of identifying development requirements and building solutions such as malware, exploits, and self-signed certificates. Adversaries may develop capabilities to support their operations throughout numerous phases of the adversary lifecycle.(Citation: Mandiant APT1)(Citation: Kaspersky Sofacy)(Citation: Bitdefender StrongPity June 2020)(Citation: Talos Promethium June 2020) As with legitimate development efforts, different skill sets may be required for developing capabilities. The skills needed may be located in-house, or may need to be contracted out. Use of a contractor may be considered an extension of that adversary's development capabilities, provided the adversary plays a role in shaping requirements and maintains a degree of exclusivity to the capability. Adversaries may also employ the use of [Artificial Intelligence](https://attack.mitre.org/techniques/T1588/007) for development.
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	1.2

iterable_item_removed
STIX Field	Old value	New Value
external_references	{'source_name': 'Splunk Kovar Certificates 2017', 'description': 'Kovar, R. (2017, December 11). Tall Tales of Hunting with TLS/SSL Certificates. Retrieved October 16, 2020.', 'url': 'https://www.splunk.com/en_us/blog/security/tall-tales-of-hunting-with-tls-ssl-certificates.html'}

[T1587.003] Develop Capabilities: Digital Certificates

Current version: 1.3

Version changed from: 1.2 → 1.3

	Old Description			New Description
t	1	Adversaries may create self-signed SSL/TLS certificates that	t	1	Adversaries may create self-signed SSL/TLS certificates that
	>	can be used during targeting. SSL/TLS certificates are desi		>	can be used during targeting. SSL/TLS certificates are desi
	>	gned to instill trust. They include information about the ke		>	gned to instill trust. They include information about the ke
	>	y, information about its owner's identity, and the digital s		>	y, information about its owner's identity, and the digital s
	>	ignature of an entity that has verified the certificate's co		>	ignature of an entity that has verified the certificate's co
	>	ntents are correct. If the signature is valid, and the perso		>	ntents are correct. If the signature is valid, and the perso
	>	n examining the certificate trusts the signer, then they kno		>	n examining the certificate trusts the signer, then they kno
	>	w they can use that key to communicate with its owner. In th		>	w they can use that key to communicate with its owner. In th
	>	e case of self-signing, digital certificates will lack the e		>	e case of self-signing, digital certificates will lack the e
	>	lement of trust associated with the signature of a third-par		>	lement of trust associated with the signature of a third-par
	>	ty certificate authority (CA). Adversaries may create self-		>	ty certificate authority (CA).(Citation: Spice Works Digital
	>	signed SSL/TLS certificates that can be used to further thei		>	Certificates) Adversaries may create self-signed SSL/TLS c
	>	r operations, such as encrypting C2 traffic (ex: [Asymmetric		>	ertificates that can be used to further their operations, su
	>	Cryptography](https://attack.mitre.org/techniques/T1573/002		>	ch as encrypting C2 traffic (ex: [Asymmetric Cryptography](h
	>	) with [Web Protocols](https://attack.mitre.org/techniques/T		>	ttps://attack.mitre.org/techniques/T1573/002) with [Web Prot
	>	1071/001)) or even enabling [Adversary-in-the-Middle](https:		>	ocols](https://attack.mitre.org/techniques/T1071/001)) or ev
	>	//attack.mitre.org/techniques/T1557) if added to the root of		>	en enabling [Adversary-in-the-Middle](https://attack.mitre.o
	>	trust (i.e. [Install Root Certificate](https://attack.mitre		>	rg/techniques/T1557) if added to the root of trust (i.e. [In
	>	.org/techniques/T1553/004)). After creating a digital certi		>	stall Root Certificate](https://attack.mitre.org/techniques/
	>	ficate, an adversary may then install that certificate (see		>	T1553/004)). After creating a digital certificate, an adver
	>	[Install Digital Certificate](https://attack.mitre.org/techn		>	sary may then install that certificate (see [Install Digital
	>	iques/T1608/003)) on infrastructure under their control.		>	Certificate](https://attack.mitre.org/techniques/T1608/003)
				>	) on infrastructure under their control.

Details

values_changed
STIX Field	Old value	New Value
modified	2025-10-24 17:48:29.137000+00:00	2026-08-27 14:17:14.395000+00:00
description	Adversaries may create self-signed SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are designed to instill trust. They include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner. In the case of self-signing, digital certificates will lack the element of trust associated with the signature of a third-party certificate authority (CA). Adversaries may create self-signed SSL/TLS certificates that can be used to further their operations, such as encrypting C2 traffic (ex: [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002) with [Web Protocols](https://attack.mitre.org/techniques/T1071/001)) or even enabling [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557) if added to the root of trust (i.e. [Install Root Certificate](https://attack.mitre.org/techniques/T1553/004)). After creating a digital certificate, an adversary may then install that certificate (see [Install Digital Certificate](https://attack.mitre.org/techniques/T1608/003)) on infrastructure under their control.	Adversaries may create self-signed SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are designed to instill trust. They include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner. In the case of self-signing, digital certificates will lack the element of trust associated with the signature of a third-party certificate authority (CA).(Citation: Spice Works Digital Certificates) Adversaries may create self-signed SSL/TLS certificates that can be used to further their operations, such as encrypting C2 traffic (ex: [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002) with [Web Protocols](https://attack.mitre.org/techniques/T1071/001)) or even enabling [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557) if added to the root of trust (i.e. [Install Root Certificate](https://attack.mitre.org/techniques/T1553/004)). After creating a digital certificate, an adversary may then install that certificate (see [Install Digital Certificate](https://attack.mitre.org/techniques/T1608/003)) on infrastructure under their control.
external_references[1]['source_name']	Splunk Kovar Certificates 2017	Spice Works Digital Certificates
external_references[1]['description']	Kovar, R. (2017, December 11). Tall Tales of Hunting with TLS/SSL Certificates. Retrieved October 16, 2020.	Chiradeep BasuMallick. (2022, December 9). Who controls trust on the internet? Why digital certificates matter more than ever now?. Retrieved August 27, 2026.
external_references[1]['url']	https://www.splunk.com/en_us/blog/security/tall-tales-of-hunting-with-tls-ssl-certificates.html	https://www.spiceworks.com/security/digital-certificate/
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.2	1.3

[T1048.002] Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol

Current version: 1.3

Version changed from: 1.2 → 1.3

	Old Description			New Description
t	1	Adversaries may steal data by exfiltrating it over an asymme	t	1	Adversaries may steal data by exfiltrating it over an asymme
	>	trically encrypted network protocol other than that of the e		>	trically encrypted network protocol other than that of the e
	>	xisting command and control channel. The data may also be se		>	xisting command and control channel. The data may also be se
	>	nt to an alternate network location from the main command an		>	nt to an alternate network location from the main command an
	>	d control server. Asymmetric encryption algorithms are tho		>	d control server. Asymmetric encryption algorithms are tho
	>	se that use different keys on each end of the channel. Also		>	se that use different keys on each end of the channel. Also
	>	known as public-key cryptography, this requires pairs of cry		>	known as public-key cryptography, this requires pairs of cry
	>	ptographic keys that can encrypt/decrypt data from the corre		>	ptographic keys that can encrypt/decrypt data from the corre
	>	sponding key. Each end of the communication channels require		>	sponding key. Each end of the communication channels require
	>	s a private key (only in the procession of that entity) and		>	s a private key (only in the procession of that entity) and
	>	the public key of the other entity. The public keys of each		>	the public key of the other entity. The public keys of each
	>	entity are exchanged before encrypted communications begin.		>	entity are exchanged before encrypted communications begin.
	>	Network protocols that use asymmetric encryption (such as		>	Network protocols that use asymmetric encryption (such as
	>	HTTPS/TLS/SSL) often utilize symmetric encryption once keys		>	HTTPS/TLS/SSL) often utilize symmetric encryption once keys
	>	are exchanged. Adversaries may opt to use these encrypted me		>	are exchanged.(Citation: Cybersecurity Advisory GRU Brute Fo
	>	chanisms that are baked into a protocol.		>	rce Campaign July 2021) Adversaries may opt to use these enc
				>	rypted mechanisms that are baked into a protocol.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.705000+00:00	2026-09-02 18:35:02.657000+00:00
description	Adversaries may steal data by exfiltrating it over an asymmetrically encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. Asymmetric encryption algorithms are those that use different keys on each end of the channel. Also known as public-key cryptography, this requires pairs of cryptographic keys that can encrypt/decrypt data from the corresponding key. Each end of the communication channels requires a private key (only in the procession of that entity) and the public key of the other entity. The public keys of each entity are exchanged before encrypted communications begin. Network protocols that use asymmetric encryption (such as HTTPS/TLS/SSL) often utilize symmetric encryption once keys are exchanged. Adversaries may opt to use these encrypted mechanisms that are baked into a protocol.	Adversaries may steal data by exfiltrating it over an asymmetrically encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. Asymmetric encryption algorithms are those that use different keys on each end of the channel. Also known as public-key cryptography, this requires pairs of cryptographic keys that can encrypt/decrypt data from the corresponding key. Each end of the communication channels requires a private key (only in the procession of that entity) and the public key of the other entity. The public keys of each entity are exchanged before encrypted communications begin. Network protocols that use asymmetric encryption (such as HTTPS/TLS/SSL) often utilize symmetric encryption once keys are exchanged.(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021) Adversaries may opt to use these encrypted mechanisms that are baked into a protocol.
external_references[1]['source_name']	University of Birmingham C2	Cybersecurity Advisory GRU Brute Force Campaign July 2021
external_references[1]['description']	Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.	NSA, CISA, FBI, NCSC. (2021, July). Russian GRU Conducting Global Brute Force Campaign to Compromise Enterprise and Cloud Environments. Retrieved July 26, 2021.
external_references[1]['url']	https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf	https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF
x_mitre_version	1.2	1.3

[T1041] Exfiltration Over C2 Channel

Current version: 2.4

Version changed from: 2.3 → 2.4

	Old Description			New Description
t	1	Adversaries may steal data by exfiltrating it over an existi	t	1	Adversaries may steal data by exfiltrating it over an existi
	>	ng command and control channel. Stolen data is encoded into		>	ng command and control channel. Stolen data is encoded into
	>	the normal communications channel using the same protocol as		>	the normal communications channel using the same protocol as
	>	command and control communications.		>	command and control communications.(Citation: C2 FRAMEWORKS
				>	)

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.706000+00:00	2026-09-11 19:45:01.540000+00:00
description	Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.	Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.(Citation: C2 FRAMEWORKS)
external_references[1]['source_name']	University of Birmingham C2	C2 FRAMEWORKS
external_references[1]['description']	Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.	Karen Patel, CEO. (2025, October 26). INTRODUCTION TO C2 FRAMEWORKS: HOW ATTACKERS OPERATE. Retrieved September 2, 2026.
external_references[1]['url']	https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf	https://www.redfoxsec.com/blog/introduction-to-c2-frameworks-how-attackers-control-compromised-systems
x_mitre_version	2.3	2.4

[T1052] Exfiltration Over Physical Medium

Current version: 1.4

Version changed from: 1.3 → 1.4

	Old Description			New Description
t	1	Adversaries may attempt to exfiltrate data via a physical me	t	1	Adversaries may attempt to exfiltrate data via a physical me
	>	dium, such as a removable drive. In certain circumstances, s		>	dium, such as a removable drive. In certain circumstances, s
	>	uch as an air-gapped network compromise, exfiltration could		>	uch as an air-gapped network compromise, exfiltration could
	>	occur via a physical medium or device introduced by a user.		>	occur via a physical medium or device introduced by a user.
	>	Such media could be an external hard drive, USB drive, cellu		>	Such media could be an external hard drive, USB drive, cellu
	>	lar phone, MP3 player, or other removable storage and proces		>	lar phone, MP3 player, or other removable storage and proces
	>	sing device. The physical medium or device could be used as		>	sing device. The physical medium or device could be used as
	>	the final exfiltration point or to hop between otherwise dis		>	the final exfiltration point or to hop between otherwise dis
	>	connected systems.		>	connected systems.(Citation: USB Drives Threaten Enterprise
				>	Security)(Citation: Tropic Trooper’s USBferry)(Citation: APT
				>	37 Adds New Capabilities for Air-Gapped Networks)

Details

values_changed
STIX Field	Old value	New Value
modified	2025-10-24 17:49:32.547000+00:00	2026-09-03 19:19:40.603000+00:00
description	Adversaries may attempt to exfiltrate data via a physical medium, such as a removable drive. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a physical medium or device introduced by a user. Such media could be an external hard drive, USB drive, cellular phone, MP3 player, or other removable storage and processing device. The physical medium or device could be used as the final exfiltration point or to hop between otherwise disconnected systems.	Adversaries may attempt to exfiltrate data via a physical medium, such as a removable drive. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a physical medium or device introduced by a user. Such media could be an external hard drive, USB drive, cellular phone, MP3 player, or other removable storage and processing device. The physical medium or device could be used as the final exfiltration point or to hop between otherwise disconnected systems.(Citation: USB Drives Threaten Enterprise Security)(Citation: Tropic Trooper’s USBferry)(Citation: APT37 Adds New Capabilities for Air-Gapped Networks)
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.3	1.4

iterable_item_added
STIX Field	Old value	New Value
external_references		{'source_name': 'USB Drives Threaten Enterprise Security', 'description': 'Crowdstrike. (2026, January 21). Small Devices, Big Risk: USB Drives Threaten Enterprise Security. Retrieved September 3, 2026.', 'url': 'https://www.crowdstrike.com/en-us/blog/usb-drives-threaten-enterprise-security/'}
external_references		{'source_name': 'Tropic Trooper’s USBferry', 'description': 'Trend Micro: Joey Chen. (2020, May 12). Tropic Trooper’s USBferry Targets Air-Gapped Networks. Retrieved September 3, 2026.', 'url': 'https://www.trendmicro.com/en_us/research/20/e/tropic-troopers-back-usbferry-attack-targets-air-gapped-environments.html'}
external_references		{'source_name': 'APT37 Adds New Capabilities for Air-Gapped Networks', 'description': 'Zscaler: Seongsu Park. (2026, February 26). APT37 Adds New Capabilities for Air-Gapped Networks. Retrieved September 3, 2026.', 'url': 'https://www.zscaler.com/blogs/security-research/apt37-adds-new-capabilities-air-gapped-networks'}

[T1048.001] Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol

Current version: 1.2

Version changed from: 1.1 → 1.2

	Old Description			New Description
t	1	Adversaries may steal data by exfiltrating it over a symmetr	t	1	Adversaries may steal data by exfiltrating it over a symmetr
	>	ically encrypted network protocol other than that of the exi		>	ically encrypted network protocol other than that of the exi
	>	sting command and control channel. The data may also be sent		>	sting command and control channel. The data may also be sent
	>	to an alternate network location from the main command and		>	to an alternate network location from the main command and
	>	control server. Symmetric encryption algorithms are those		>	control server. Symmetric encryption algorithms are those
	>	that use shared or the same keys/secrets on each end of the		>	that use shared or the same keys/secrets on each end of the
	>	channel. This requires an exchange or pre-arranged agreement		>	channel. This requires an exchange or pre-arranged agreement
	>	/possession of the value used to encrypt and decrypt data.		>	/possession of the value used to encrypt and decrypt data.(C
	>	Network protocols that use asymmetric encryption often util		>	itation: Exfiltration Over Symmetric Encrypted Non-C2 Protoc
	>	ize symmetric encryption once keys are exchanged, but advers		>	ol) Network protocols that use asymmetric encryption often
	>	aries may opt to manually share keys and implement symmetric		>	utilize symmetric encryption once keys are exchanged, but ad
	>	cryptographic algorithms (ex: RC4, AES) vice using mechanis		>	versaries may opt to manually share keys and implement symme
	>	ms that are baked into a protocol. This may result in multip		>	tric cryptographic algorithms (ex: RC4, AES) vice using mech
	>	le layers of encryption (in protocols that are natively encr		>	anisms that are baked into a protocol. This may result in mu
	>	ypted such as HTTPS) or encryption in protocols that not typ		>	ltiple layers of encryption (in protocols that are natively
	>	ically encrypted (such as HTTP or FTP).		>	encrypted such as HTTPS) or encryption in protocols that not
				>	typically encrypted (such as HTTP or FTP).

Details

values_changed
STIX Field	Old value	New Value
modified	2025-10-24 17:48:59.332000+00:00	2026-09-02 18:30:25.080000+00:00
description	Adversaries may steal data by exfiltrating it over a symmetrically encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. Symmetric encryption algorithms are those that use shared or the same keys/secrets on each end of the channel. This requires an exchange or pre-arranged agreement/possession of the value used to encrypt and decrypt data. Network protocols that use asymmetric encryption often utilize symmetric encryption once keys are exchanged, but adversaries may opt to manually share keys and implement symmetric cryptographic algorithms (ex: RC4, AES) vice using mechanisms that are baked into a protocol. This may result in multiple layers of encryption (in protocols that are natively encrypted such as HTTPS) or encryption in protocols that not typically encrypted (such as HTTP or FTP).	Adversaries may steal data by exfiltrating it over a symmetrically encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. Symmetric encryption algorithms are those that use shared or the same keys/secrets on each end of the channel. This requires an exchange or pre-arranged agreement/possession of the value used to encrypt and decrypt data.(Citation: Exfiltration Over Symmetric Encrypted Non-C2 Protocol) Network protocols that use asymmetric encryption often utilize symmetric encryption once keys are exchanged, but adversaries may opt to manually share keys and implement symmetric cryptographic algorithms (ex: RC4, AES) vice using mechanisms that are baked into a protocol. This may result in multiple layers of encryption (in protocols that are natively encrypted such as HTTPS) or encryption in protocols that not typically encrypted (such as HTTP or FTP).
external_references[1]['source_name']	University of Birmingham C2	Exfiltration Over Symmetric Encrypted Non-C2 Protocol
external_references[1]['description']	Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.	STARTUP DEFENSE. (n.d.). Exfiltration Over Symmetric Encrypted Non-C2 Protocol. Retrieved September 2, 2026.
external_references[1]['url']	https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf	https://www.startupdefense.io/mitre-attack-techniques/t1048-001-exfiltration-over-symmetric-encrypted-non-c2-protocol
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	1.2

[T1052.001] Exfiltration Over Physical Medium: Exfiltration over USB

Current version: 1.3

Version changed from: 1.2 → 1.3

	Old Description			New Description
t	1	Adversaries may attempt to exfiltrate data over a USB connec	t	1	Adversaries may attempt to exfiltrate data over a USB connec
	>	ted physical device. In certain circumstances, such as an ai		>	ted physical device. In certain circumstances, such as an ai
	>	r-gapped network compromise, exfiltration could occur via a		>	r-gapped network compromise, exfiltration could occur via a
	>	USB device introduced by a user. The USB device could be use		>	USB device introduced by a user. The USB device could be use
	>	d as the final exfiltration point or to hop between otherwis		>	d as the final exfiltration point or to hop between otherwis
	>	e disconnected systems.		>	e disconnected systems.(Citation: A USB data exfiltration ca
				>	se study)

Details

values_changed
STIX Field	Old value	New Value
modified	2025-10-24 17:49:10.994000+00:00	2026-09-02 18:41:21.426000+00:00
description	Adversaries may attempt to exfiltrate data over a USB connected physical device. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a USB device introduced by a user. The USB device could be used as the final exfiltration point or to hop between otherwise disconnected systems.	Adversaries may attempt to exfiltrate data over a USB connected physical device. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a USB device introduced by a user. The USB device could be used as the final exfiltration point or to hop between otherwise disconnected systems.(Citation: A USB data exfiltration case study)
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.2	1.3

iterable_item_added
STIX Field	Old value	New Value
external_references		{'source_name': 'A USB data exfiltration case study', 'description': 'Mu-Huan (Miles) Chunga, Yuhong (Alisha) Yangb, Lu Wanga, Greg Centob, Khilan Jerathb, Parwinder Taankb, Abhay Ramanb, Jonathan H. Chanc, Mark H. Chignella. (n.d.). Enhancing cybersecurity situation awareness through visualization: A USB data exfiltration case study. Retrieved September 2, 2026.', 'url': 'https://www.cell.com/heliyon/fulltext/S2405-8440(23)00232-3'}

[T1574] Hijack Execution Flow

Current version: 2.1

Version changed from: 2.0 → 2.1

	Old Description			New Description
t	1	Adversaries may execute their own malicious payloads by hija	t	1	Adversaries may execute their own malicious payloads by hija
	>	cking the way operating systems run programs. Hijacking exec		>	cking the way operating systems run programs. Hijacking exec
	>	ution flow can be for the purposes of persistence, since thi		>	ution flow can be for the purposes of persistence, since thi
	>	s hijacked execution may reoccur over time. Adversaries may		>	s hijacked execution may reoccur over time. Adversaries may
	>	also use these mechanisms to elevate privileges or evade def		>	also use these mechanisms to elevate privileges or evade def
	>	enses, such as application control or other restrictions on		>	enses, such as application control or other restrictions on
	>	execution. There are many ways an adversary may hijack the		>	execution. There are many ways an adversary may hijack the
	>	flow of execution, including by manipulating how the operati		>	flow of execution, including by manipulating how the operati
	>	ng system locates programs to be executed. How the operating		>	ng system locates programs to be executed. How the operating
	>	system locates libraries to be used by a program can also b		>	system locates libraries to be used by a program can also b
	>	e intercepted. Locations where the operating system looks fo		>	e intercepted. Locations where the operating system looks fo
	>	r programs/resources, such as file directories and in the ca		>	r programs/resources, such as file directories and in the ca
	>	se of Windows the Registry, could also be poisoned to includ		>	se of Windows the Registry, could also be poisoned to includ
	>	e malicious payloads.		>	e malicious payloads.(Citation: Execution flow hijack attemp
				>	t)

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.707000+00:00	2026-09-02 18:05:12.296000+00:00
description	Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time. Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution. There are many ways an adversary may hijack the flow of execution, including by manipulating how the operating system locates programs to be executed. How the operating system locates libraries to be used by a program can also be intercepted. Locations where the operating system looks for programs/resources, such as file directories and in the case of Windows the Registry, could also be poisoned to include malicious payloads.	Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time. Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution. There are many ways an adversary may hijack the flow of execution, including by manipulating how the operating system locates programs to be executed. How the operating system locates libraries to be used by a program can also be intercepted. Locations where the operating system looks for programs/resources, such as file directories and in the case of Windows the Registry, could also be poisoned to include malicious payloads.(Citation: Execution flow hijack attempt)
x_mitre_version	2.0	2.1

iterable_item_added
STIX Field	Old value	New Value
external_references		{'source_name': 'Execution flow hijack attempt', 'description': 'Prisma Cloud Docs. (n.d.). Execution flow hijack attempt. Retrieved September 2, 2026.', 'url': 'https://docs.prismacloud.io/admin-guide/runtime-defense/incident-types/execution-flow-hijack-attempt'}

[T1027.005] Obfuscated Files or Information: Indicator Removal from Tools

Current version: 2.1

Version changed from: 2.0 → 2.1

	Old Description			New Description
t	1	Adversaries may remove indicators from tools if they believe	t	1	Adversaries may remove indicators from tools if they believe
	>	their malicious tool was detected, quarantined, or otherwis		>	their malicious tool was detected, quarantined, or otherwis
	>	e curtailed. They can modify the tool by removing the indica		>	e curtailed. They can modify the tool by removing the indica
	>	tor and using the updated version that is no longer detected		>	tor and using the updated version that is no longer detected
	>	by the target's defensive systems or subsequent targets tha		>	by the target's defensive systems or subsequent targets tha
	>	t may use similar systems. A good example of this is when m		>	t may use similar systems. A good example of this is when m
	>	alware is detected with a file signature and quarantined by		>	alware is detected with a file signature and quarantined by
	>	anti-virus software. An adversary who can determine that the		>	anti-virus software. An adversary who can determine that the
	>	malware was quarantined because of its file signature may m		>	malware was quarantined because of its file signature may m
	>	odify the file to explicitly avoid that signature, and then		>	odify the file to explicitly avoid that signature, and then
	>	re-use the malware.		>	re-use the malware.(Citation: Files and Antivirus Detection)

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.707000+00:00	2026-09-11 19:58:00.789000+00:00
description	Adversaries may remove indicators from tools if they believe their malicious tool was detected, quarantined, or otherwise curtailed. They can modify the tool by removing the indicator and using the updated version that is no longer detected by the target's defensive systems or subsequent targets that may use similar systems. A good example of this is when malware is detected with a file signature and quarantined by anti-virus software. An adversary who can determine that the malware was quarantined because of its file signature may modify the file to explicitly avoid that signature, and then re-use the malware.	Adversaries may remove indicators from tools if they believe their malicious tool was detected, quarantined, or otherwise curtailed. They can modify the tool by removing the indicator and using the updated version that is no longer detected by the target's defensive systems or subsequent targets that may use similar systems. A good example of this is when malware is detected with a file signature and quarantined by anti-virus software. An adversary who can determine that the malware was quarantined because of its file signature may modify the file to explicitly avoid that signature, and then re-use the malware.(Citation: Files and Antivirus Detection)
x_mitre_version	2.0	2.1

iterable_item_added
STIX Field	Old value	New Value
external_references		{'source_name': 'Files and Antivirus Detection', 'description': 'OPSWAT. (n.d.). Why can small file changes bypass the Antivirus detection?. Retrieved September 2, 2026.', 'url': 'https://www.opswat.com/docs/mdcore/knowledge-base/why-can-small-file-changes-bypass-the-antivirus-detection-'}

[T1588.001] Obtain Capabilities: Malware

Current version: 1.2

Version changed from: 1.1 → 1.2

	Old Description			New Description
t	1	Adversaries may buy, steal, or download malware that can be	t	1	Adversaries may buy, steal, or download malware that can be
	>	used during targeting. Malicious software can include payloa		>	used during targeting. Malicious software can include payloa
	>	ds, droppers, post-compromise tools, backdoors, packers, and		>	ds, droppers, post-compromise tools, backdoors, packers, and
	>	C2 protocols. Adversaries may acquire malware to support th		>	C2 protocols. Adversaries may acquire malware to support th
	>	eir operations, obtaining a means for maintaining control of		>	eir operations, obtaining a means for maintaining control of
	>	remote machines, evading defenses, and executing post-compr		>	remote machines, evading defenses, and executing post-compr
	>	omise behaviors. In addition to downloading free malware fr		>	omise behaviors. In addition to downloading free malware fr
	>	om the internet, adversaries may purchase these capabilities		>	om the internet, adversaries may purchase these capabilities
	>	from third-party entities. Third-party entities can include		>	from third-party entities. Third-party entities can include
	>	technology companies that specialize in malware development		>	technology companies that specialize in malware development
	>	, criminal marketplaces (including Malware-as-a-Service, or		>	, criminal marketplaces (including Malware-as-a-Service, or
	>	MaaS), or from individuals. In addition to purchasing malwar		>	MaaS), or from individuals.(Citation: BITSIGHT Malware Analy
	>	e, adversaries may steal and repurpose malware from third-pa		>	sis) In addition to purchasing malware, adversaries may stea
	>	rty entities (including other adversaries).		>	l and repurpose malware from third-party entities (including
				>	other adversaries).

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.643000+00:00	2026-09-02 17:55:52.445000+00:00
description	Adversaries may buy, steal, or download malware that can be used during targeting. Malicious software can include payloads, droppers, post-compromise tools, backdoors, packers, and C2 protocols. Adversaries may acquire malware to support their operations, obtaining a means for maintaining control of remote machines, evading defenses, and executing post-compromise behaviors. In addition to downloading free malware from the internet, adversaries may purchase these capabilities from third-party entities. Third-party entities can include technology companies that specialize in malware development, criminal marketplaces (including Malware-as-a-Service, or MaaS), or from individuals. In addition to purchasing malware, adversaries may steal and repurpose malware from third-party entities (including other adversaries).	Adversaries may buy, steal, or download malware that can be used during targeting. Malicious software can include payloads, droppers, post-compromise tools, backdoors, packers, and C2 protocols. Adversaries may acquire malware to support their operations, obtaining a means for maintaining control of remote machines, evading defenses, and executing post-compromise behaviors. In addition to downloading free malware from the internet, adversaries may purchase these capabilities from third-party entities. Third-party entities can include technology companies that specialize in malware development, criminal marketplaces (including Malware-as-a-Service, or MaaS), or from individuals.(Citation: BITSIGHT Malware Analysis) In addition to purchasing malware, adversaries may steal and repurpose malware from third-party entities (including other adversaries).
external_references[1]['source_name']	FireEyeSupplyChain	BITSIGHT Malware Analysis
external_references[1]['description']	FireEye. (2014). SUPPLY CHAIN ANALYSIS: From Quartermaster to SunshopFireEye. Retrieved March 6, 2017.	Emma Stevens. (2025, August 27). The Business of Malware: Inside the MaaS Economy. Retrieved September 2, 2026.
external_references[1]['url']	https://www.mandiant.com/resources/supply-chain-analysis-from-quartermaster-to-sunshop	https://www.bitsight.com/blog/what-is-malware-as-a-service
x_mitre_version	1.1	1.2

[T1601] Modify System Image

Current version: 2.1

Version changed from: 2.0 → 2.1

	Old Description			New Description
t	1	Adversaries may make changes to the operating system of embe	t	1	Adversaries may make changes to the operating system of embe
	>	dded network devices to weaken defenses and provide new capa		>	dded network devices to weaken defenses and provide new capa
	>	bilities for themselves. On such devices, the operating sys		>	bilities for themselves. On such devices, the operating sys
	>	tems are typically monolithic and most of the device functio		>	tems are typically monolithic and most of the device functio
	>	nality and capabilities are contained within a single file.		>	nality and capabilities are contained within a single file.(
	>	To change the operating system, the adversary typically onl		>	Citation: Cisco Networking Software Product Lines)(Citation:
	>	y needs to affect this one file, replacing or modifying it.		>	Network Device Integrity Methodology) To change the operat
	>	This can either be done live in memory during system runtim		>	ing system, the adversary typically only needs to affect thi
	>	e for immediate effect, or in storage to implement the chang		>	s one file, replacing or modifying it. This can either be d
	>	e on the next boot of the network device.		>	one live in memory during system runtime for immediate effec
				>	t, or in storage to implement the change on the next boot of
				>	the network device.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.707000+00:00	2026-08-27 17:55:53.583000+00:00
description	Adversaries may make changes to the operating system of embedded network devices to weaken defenses and provide new capabilities for themselves. On such devices, the operating systems are typically monolithic and most of the device functionality and capabilities are contained within a single file. To change the operating system, the adversary typically only needs to affect this one file, replacing or modifying it. This can either be done live in memory during system runtime for immediate effect, or in storage to implement the change on the next boot of the network device.	Adversaries may make changes to the operating system of embedded network devices to weaken defenses and provide new capabilities for themselves. On such devices, the operating systems are typically monolithic and most of the device functionality and capabilities are contained within a single file.(Citation: Cisco Networking Software Product Lines)(Citation: Network Device Integrity Methodology) To change the operating system, the adversary typically only needs to affect this one file, replacing or modifying it. This can either be done live in memory during system runtime for immediate effect, or in storage to implement the change on the next boot of the network device.
x_mitre_version	2.0	2.1

iterable_item_added
STIX Field	Old value	New Value
external_references		{'source_name': 'Cisco Networking Software Product Lines', 'description': 'Cisco. (n.d.). Cisco IOS & NX-OS Networking Software. Retrieved August 27, 2026.', 'url': 'https://www.cisco.com/c/en/us/support/ios-nx-os-software/index.html#GUID-CCB80DF4-C5E7-4543-A3D2-598EF13E5FCA'}
external_references		{'source_name': 'Network Device Integrity Methodology', 'description': 'U.S. Department of War. (n.d.). Network Device Integrity (NDI) Methodology. Retrieved August 27, 2026.', 'url': 'https://media.defense.gov/2023/Oct/06/2003315573/-1/-1/0/NETWORK%20DEVICE%20INTEGRITY%20NDI%20METHODOLOGY.PDF'}

[T1566] Phishing

Current version: 2.8

Version changed from: 2.7 → 2.8

	Old Description			New Description
t	1	Adversaries may send phishing messages to gain access to vic	t	1	Adversaries may send phishing messages to gain access to vic
	>	tim systems. All forms of phishing are electronically delive		>	tim systems. All forms of phishing are electronically delive
	>	red social engineering. Phishing can be targeted, known as s		>	red social engineering. Phishing can be targeted, known as s
	>	pearphishing. In spearphishing, a specific individual, compa		>	pearphishing. In spearphishing, a specific individual, compa
	>	ny, or industry will be targeted by the adversary. More gene		>	ny, or industry will be targeted by the adversary. More gene
	>	rally, adversaries can conduct non-targeted phishing, such a		>	rally, adversaries can conduct non-targeted phishing, such a
	>	s in mass malware spam campaigns. Adversaries may send vict		>	s in mass malware spam campaigns. Adversaries may send vict
	>	ims emails containing malicious attachments or links, typica		>	ims emails containing malicious attachments or links, typica
	>	lly to execute malicious code on victim systems. Phishing ma		>	lly to execute malicious code on victim systems. Phishing ma
	>	y also be conducted via third-party services, like social me		>	y also be conducted via third-party services (like social me
	>	dia platforms. Phishing may also involve social engineering		>	dia platforms) or delivered via calendar invites. Phishing m
	>	techniques, such as posing as a trusted source, as well as e		>	ay also involve social engineering techniques, such as posin
	>	vasive techniques such as removing or manipulating emails or		>	g as a trusted source, as well as evasive techniques such as
	>	metadata/headers from compromised accounts being abused to		>	removing or manipulating emails or metadata/headers from co
	>	send messages (e.g., [Email Hiding Rules](https://attack.mit		>	mpromised accounts being abused to send messages (e.g., [Ema
	>	re.org/techniques/T1564/008)).(Citation: Microsoft OAuth Spa		>	il Hiding Rules](https://attack.mitre.org/techniques/T1564/0
	>	m 2022)(Citation: Palo Alto Unit 42 VBA Infostealer 2014) An		>	08)).(Citation: Microsoft OAuth Spam 2022)(Citation: Palo Al
	>	other way to accomplish this is by [Email Spoofing](https://		>	to Unit 42 VBA Infostealer 2014) Another way to accomplish t
	>	attack.mitre.org/techniques/T1684/002)(Citation: Proofpoint-		>	his is by [Email Spoofing](https://attack.mitre.org/techniqu
	>	spoof) the identity of the sender, which can be used to fool		>	es/T1684/002)(Citation: Proofpoint-spoof) the identity of th
	>	both the human recipient as well as automated security tool		>	e sender, which can be used to fool both the human recipient
	>	s,(Citation: cyberproof-double-bounce) or by including the i		>	as well as automated security tools,(Citation: cyberproof-d
	>	ntended target as a party to an existing email thread that i		>	ouble-bounce) or by including the intended target as a party
	>	ncludes malicious files or links (i.e., "thread hijacking").		>	to an existing email thread that includes malicious files o
	>	(Citation: phishing-krebs) Victims may also receive phishin		>	r links (i.e., "thread hijacking").(Citation: phishing-krebs
	>	g messages that instruct them to call a phone number where t		>	) Victims may also receive phishing messages that instruct
	>	hey are directed to visit a malicious URL, download malware,		>	them to call a phone number where they are directed to visit
	>	(Citation: sygnia Luna Month)(Citation: CISA Remote Monitori		>	a malicious URL, download malware,(Citation: sygnia Luna Mo
	>	ng and Management Software) or install adversary-accessible		>	nth)(Citation: CISA Remote Monitoring and Management Softwar
	>	remote management tools onto their computer (i.e., [User Exe		>	e) or install adversary-accessible remote management tools o
	>	cution](https://attack.mitre.org/techniques/T1204)).(Citatio		>	nto their computer (i.e., [User Execution](https://attack.mi
	>	n: Unit42 Luna Moth)		>	tre.org/techniques/T1204)).(Citation: Unit42 Luna Moth)

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.706000+00:00	2026-09-18 01:13:52.216000+00:00
description	Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns. Adversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems. Phishing may also be conducted via third-party services, like social media platforms. Phishing may also involve social engineering techniques, such as posing as a trusted source, as well as evasive techniques such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., [Email Hiding Rules](https://attack.mitre.org/techniques/T1564/008)).(Citation: Microsoft OAuth Spam 2022)(Citation: Palo Alto Unit 42 VBA Infostealer 2014) Another way to accomplish this is by [Email Spoofing](https://attack.mitre.org/techniques/T1684/002)(Citation: Proofpoint-spoof) the identity of the sender, which can be used to fool both the human recipient as well as automated security tools,(Citation: cyberproof-double-bounce) or by including the intended target as a party to an existing email thread that includes malicious files or links (i.e., "thread hijacking").(Citation: phishing-krebs) Victims may also receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware,(Citation: sygnia Luna Month)(Citation: CISA Remote Monitoring and Management Software) or install adversary-accessible remote management tools onto their computer (i.e., [User Execution](https://attack.mitre.org/techniques/T1204)).(Citation: Unit42 Luna Moth)	Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns. Adversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems. Phishing may also be conducted via third-party services (like social media platforms) or delivered via calendar invites. Phishing may also involve social engineering techniques, such as posing as a trusted source, as well as evasive techniques such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., [Email Hiding Rules](https://attack.mitre.org/techniques/T1564/008)).(Citation: Microsoft OAuth Spam 2022)(Citation: Palo Alto Unit 42 VBA Infostealer 2014) Another way to accomplish this is by [Email Spoofing](https://attack.mitre.org/techniques/T1684/002)(Citation: Proofpoint-spoof) the identity of the sender, which can be used to fool both the human recipient as well as automated security tools,(Citation: cyberproof-double-bounce) or by including the intended target as a party to an existing email thread that includes malicious files or links (i.e., "thread hijacking").(Citation: phishing-krebs) Victims may also receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware,(Citation: sygnia Luna Month)(Citation: CISA Remote Monitoring and Management Software) or install adversary-accessible remote management tools onto their computer (i.e., [User Execution](https://attack.mitre.org/techniques/T1204)).(Citation: Unit42 Luna Moth)
x_mitre_version	2.7	2.8

[T1059.001] Command and Scripting Interpreter: PowerShell

Current version: 1.6

Version changed from: 1.5 → 1.6

	Old Description			New Description
t	1	Adversaries may abuse PowerShell commands and scripts for ex	t	1	Adversaries may abuse PowerShell commands and scripts for ex
	>	ecution. PowerShell is a powerful interactive command-line i		>	ecution. PowerShell is a powerful interactive command-line i
	>	nterface and scripting environment included in the Windows o		>	nterface and scripting environment included in the Windows o
	>	perating system.(Citation: TechNet PowerShell) Adversaries c		>	perating system.(Citation: TechNet PowerShell) PowerShell ca
	>	an use PowerShell to perform a number of actions, including		>	n also be installed on Linux and macOS.(Citation: Powershell
	>	discovery of information and execution of code. Examples inc		>	installation) Adversaries can use PowerShell to perform a n
	>	lude the <code>Start-Process</code> cmdlet which can be used		>	umber of actions, including discovery of information and exe
	>	to run an executable and the <code>Invoke-Command</code> cm		>	cution of code. Examples include the <code>Start-Process</co
	>	dlet which runs a command locally or on a remote computer (t		>	de> cmdlet which can be used to run an executable and the <c
	>	hough administrator permissions are required to use PowerShe		>	ode>Invoke-Command</code> cmdlet which runs a command locall
	>	ll to connect to remote systems). PowerShell may also be us		>	y or on a remote computer (though administrator permissions
	>	ed to download and run executables from the Internet, which		>	are required to use PowerShell to connect to remote systems)
	>	can be executed from disk or in memory without touching disk		>	. PowerShell may also be used to download and run executabl
	>	. A number of PowerShell-based offensive testing tools are		>	es from the Internet, which can be executed from disk or in
	>	available, including [Empire](https://attack.mitre.org/softw		>	memory without touching disk. A number of PowerShell-based
	>	are/S0363), [PowerSploit](https://attack.mitre.org/software		>	offensive testing tools are available, including [Empire](ht
	>	/S0194), [PoshC2](https://attack.mitre.org/software/S0378),		>	tps://attack.mitre.org/software/S0363), [PowerSploit](https
	>	and PSAttack.(Citation: Github PSAttack) PowerShell command		>	://attack.mitre.org/software/S0194), [PoshC2](https://attack
	>	s/scripts can also be executed without directly invoking the		>	.mitre.org/software/S0378), and PSAttack.(Citation: Github P
	>	<code>powershell.exe</code> binary through interfaces to Po		>	SAttack) PowerShell commands/scripts can also be executed w
	>	werShell's underlying <code>System.Management.Automation</co		>	ithout directly invoking the <code>powershell.exe</code> bin
	>	de> assembly DLL exposed through the .NET framework and Wind		>	ary through interfaces to PowerShell's underlying <code>Syst
	>	ows Common Language Interface (CLI).(Citation: Sixdub PowerP		>	em.Management.Automation</code> assembly DLL exposed through
	>	ick Jan 2016)(Citation: SilentBreak Offensive PS Dec 2015)(C		>	the .NET framework and Windows Common Language Interface (C
	>	itation: Microsoft PSfromCsharp APR 2014)		>	LI).(Citation: Sixdub PowerPick Jan 2016)(Citation: SilentBr
				>	eak Offensive PS Dec 2015)(Citation: Microsoft PSfromCsharp
				>	APR 2014)

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.706000+00:00	2026-09-18 13:23:14.419000+00:00
description	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.(Citation: TechNet PowerShell) Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems). PowerShell may also be used to download and run executables from the Internet, which can be executed from disk or in memory without touching disk. A number of PowerShell-based offensive testing tools are available, including [Empire](https://attack.mitre.org/software/S0363), [PowerSploit](https://attack.mitre.org/software/S0194), [PoshC2](https://attack.mitre.org/software/S0378), and PSAttack.(Citation: Github PSAttack) PowerShell commands/scripts can also be executed without directly invoking the `powershell.exe` binary through interfaces to PowerShell's underlying `System.Management.Automation` assembly DLL exposed through the .NET framework and Windows Common Language Interface (CLI).(Citation: Sixdub PowerPick Jan 2016)(Citation: SilentBreak Offensive PS Dec 2015)(Citation: Microsoft PSfromCsharp APR 2014)	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.(Citation: TechNet PowerShell) PowerShell can also be installed on Linux and macOS.(Citation: Powershell installation) Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems). PowerShell may also be used to download and run executables from the Internet, which can be executed from disk or in memory without touching disk. A number of PowerShell-based offensive testing tools are available, including [Empire](https://attack.mitre.org/software/S0363), [PowerSploit](https://attack.mitre.org/software/S0194), [PoshC2](https://attack.mitre.org/software/S0378), and PSAttack.(Citation: Github PSAttack) PowerShell commands/scripts can also be executed without directly invoking the `powershell.exe` binary through interfaces to PowerShell's underlying `System.Management.Automation` assembly DLL exposed through the .NET framework and Windows Common Language Interface (CLI).(Citation: Sixdub PowerPick Jan 2016)(Citation: SilentBreak Offensive PS Dec 2015)(Citation: Microsoft PSfromCsharp APR 2014)
external_references[3]['source_name']	FireEye PowerShell Logging 2016	Powershell installation
external_references[3]['description']	Dunwoody, M. (2016, February 11). GREATER VISIBILITY THROUGH POWERSHELL LOGGING. Retrieved February 16, 2016.	Microsoft. (n.d.). Install PowerShell on Windows, Linux, and macOS. Retrieved September 17, 2026.
external_references[3]['url']	https://www.fireeye.com/blog/threat-research/2016/02/greater_visibilityt.html	https://learn.microsoft.com/en-us/powershell/scripting/install/install-powershell?view=powershell-7.6
x_mitre_version	1.5	1.6

iterable_item_added
STIX Field	Old value	New Value
x_mitre_contributors		Stephan H. Wenderlich, Gray-Hat IT-Security Consulting
x_mitre_platforms		Linux
x_mitre_platforms		macOS

iterable_item_removed
STIX Field	Old value	New Value
external_references	{'source_name': 'inv_ps_attacks', 'description': 'Hastings, M. (2014, July 16). Investigating PowerShell Attacks. Retrieved December 1, 2021.', 'url': 'https://powershellmagazine.com/2014/07/16/investigating-powershell-attacks/'}
external_references	{'source_name': 'Malware Archaeology PowerShell Cheat Sheet', 'description': 'Malware Archaeology. (2016, June). WINDOWS POWERSHELL LOGGING CHEAT SHEET - Win 7/Win 2008 or later. Retrieved June 24, 2016.', 'url': 'http://www.malwarearchaeology.com/s/Windows-PowerShell-Logging-Cheat-Sheet-ver-June-2016-v2.pdf'}

[T1114.002] Email Collection: Remote Email Collection

Current version: 1.4

Version changed from: 1.3 → 1.4

	Old Description			New Description
t	1	Adversaries may target an Exchange server, Office 365, or Go	t	1	Adversaries may target an Exchange server, Office 365, or Go
	>	ogle Workspace to collect sensitive information. Adversaries		>	ogle Workspace to collect sensitive information. Adversaries
	>	may leverage a user's credentials and interact directly wit		>	may leverage a user's credentials and interact directly wit
	>	h the Exchange server to acquire information from within a n		>	h the Exchange server to acquire information from within a n
	>	etwork. Adversaries may also access externally facing Exchan		>	etwork. Adversaries may also access externally facing Exchan
	>	ge services, Office 365, or Google Workspace to access email		>	ge services, Office 365, or Google Workspace to access email
	>	using credentials or access tokens. Tools such as [MailSnip		>	using credentials or access tokens. Tools such as [MailSnip
	>	er](https://attack.mitre.org/software/S0413) can be used to		>	er](https://attack.mitre.org/software/S0413) can be used to
	>	automate searches for specific keywords.		>	automate searches for specific keywords.(Citation: Cybersecu
				>	rity Advisory GRU Brute Force Campaign July 2021)

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.708000+00:00	2026-09-09 18:44:33.117000+00:00
description	Adversaries may target an Exchange server, Office 365, or Google Workspace to collect sensitive information. Adversaries may leverage a user's credentials and interact directly with the Exchange server to acquire information from within a network. Adversaries may also access externally facing Exchange services, Office 365, or Google Workspace to access email using credentials or access tokens. Tools such as [MailSniper](https://attack.mitre.org/software/S0413) can be used to automate searches for specific keywords.	Adversaries may target an Exchange server, Office 365, or Google Workspace to collect sensitive information. Adversaries may leverage a user's credentials and interact directly with the Exchange server to acquire information from within a network. Adversaries may also access externally facing Exchange services, Office 365, or Google Workspace to access email using credentials or access tokens. Tools such as [MailSniper](https://attack.mitre.org/software/S0413) can be used to automate searches for specific keywords.(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021)
x_mitre_version	1.3	1.4

iterable_item_added
STIX Field	Old value	New Value
external_references		{'source_name': 'Cybersecurity Advisory GRU Brute Force Campaign July 2021', 'description': 'NSA, CISA, FBI, NCSC. (2021, July). Russian GRU Conducting Global Brute Force Campaign to Compromise Enterprise and Cloud Environments. Retrieved July 26, 2021.', 'url': 'https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF'}

[T1021.004] Remote Services: SSH

Current version: 1.4

Version changed from: 1.3 → 1.4

	Old Description			New Description
t	1	Adversaries may use [Valid Accounts](https://attack.mitre.or	t	1	Adversaries may use [Valid Accounts](https://attack.mitre.or
	>	g/techniques/T1078) to log into remote machines using Secure		>	g/techniques/T1078) to log into remote machines using Secure
	>	Shell (SSH). The adversary may then perform actions as the		>	Shell (SSH). The adversary may then perform actions as the
	>	logged-on user. SSH is a protocol that allows authorized us		>	logged-on user. SSH is a protocol that allows authorized us
	>	ers to open remote shells on other computers. Many Linux and		>	ers to open remote shells on other computers. Many Linux and
	>	macOS versions come with SSH installed by default, although		>	macOS versions come with SSH installed by default, although
	>	typically disabled until the user enables it. On ESXi, SSH		>	typically disabled until the user enables it. On ESXi, SSH
	>	can be enabled either directly on the host (e.g., via `vim-c		>	can be enabled either directly on the host (e.g., via `vim-c
	>	md hostsvc/enable_ssh`) or via vCenter.(Citation: Sygnia ESX		>	md hostsvc/enable_ssh`) or via vCenter.(Citation: Sygnia ESX
	>	i Ransomware 2025)(Citation: TrendMicro ESXI Ransomware)(Cit		>	i Ransomware 2025)(Citation: TrendMicro ESXI Ransomware)(Cit
	>	ation: Sygnia Abyss Locker 2025) The SSH server can be confi		>	ation: Sygnia Abyss Locker 2025) Modern versions of Windows
	>	gured to use standard password authentication or public-priv		>	include a built-in SSH server and client.(Citation: Windows
	>	ate keypairs in lieu of or in addition to a password. In thi		>	SSH) The SSH server can be configured to use standard passwo
	>	s authentication scenario, the user’s public key must be in		>	rd authentication or public-private keypairs in lieu of or i
	>	a special file on the computer running the server that lists		>	n addition to a password. In this authentication scenario, t
	>	which keypairs are allowed to login as that user (i.e., [SS		>	he user’s public key must be in a special file on the comput
	>	H Authorized Keys](https://attack.mitre.org/techniques/T1098		>	er running the server that lists which keypairs are allowed
	>	/004)).		>	to login as that user (i.e., [SSH Authorized Keys](https://a
				>	ttack.mitre.org/techniques/T1098/004)).

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.624000+00:00	2026-09-18 02:23:13.647000+00:00
description	Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into remote machines using Secure Shell (SSH). The adversary may then perform actions as the logged-on user. SSH is a protocol that allows authorized users to open remote shells on other computers. Many Linux and macOS versions come with SSH installed by default, although typically disabled until the user enables it. On ESXi, SSH can be enabled either directly on the host (e.g., via `vim-cmd hostsvc/enable_ssh`) or via vCenter.(Citation: Sygnia ESXi Ransomware 2025)(Citation: TrendMicro ESXI Ransomware)(Citation: Sygnia Abyss Locker 2025) The SSH server can be configured to use standard password authentication or public-private keypairs in lieu of or in addition to a password. In this authentication scenario, the user’s public key must be in a special file on the computer running the server that lists which keypairs are allowed to login as that user (i.e., [SSH Authorized Keys](https://attack.mitre.org/techniques/T1098/004)).	Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into remote machines using Secure Shell (SSH). The adversary may then perform actions as the logged-on user. SSH is a protocol that allows authorized users to open remote shells on other computers. Many Linux and macOS versions come with SSH installed by default, although typically disabled until the user enables it. On ESXi, SSH can be enabled either directly on the host (e.g., via `vim-cmd hostsvc/enable_ssh`) or via vCenter.(Citation: Sygnia ESXi Ransomware 2025)(Citation: TrendMicro ESXI Ransomware)(Citation: Sygnia Abyss Locker 2025) Modern versions of Windows include a built-in SSH server and client.(Citation: Windows SSH) The SSH server can be configured to use standard password authentication or public-private keypairs in lieu of or in addition to a password. In this authentication scenario, the user’s public key must be in a special file on the computer running the server that lists which keypairs are allowed to login as that user (i.e., [SSH Authorized Keys](https://attack.mitre.org/techniques/T1098/004)).
external_references[3]['source_name']	Apple Unified Log Analysis Remote Login and Screen Sharing	Windows SSH
external_references[3]['description']	Sarah Edwards. (2020, April 30). Analysis of Apple Unified Logs: Quarantine Edition [Entry 6] – Working From Home? Remote Logins. Retrieved August 19, 2021.	Windows. (2024, May 29). Tutorial: SSH in Windows Terminal. Retrieved September 17, 2026.
external_references[3]['url']	https://sarah-edwards-xzkc.squarespace.com/blog/2020/4/30/analysis-of-apple-unified-logs-quarantine-edition-entry-6-working-from-home-remote-logins	https://learn.microsoft.com/en-us/windows/terminal/tutorials/ssh
x_mitre_version	1.3	1.4

iterable_item_added
STIX Field	Old value	New Value
x_mitre_contributors		Liran Ravich, Cribl
x_mitre_platforms		Windows

[T1029] Scheduled Transfer

Current version: 1.2

Version changed from: 1.1 → 1.2

	Old Description			New Description
t	1	Adversaries may schedule data exfiltration to be performed o	t	1	Adversaries may schedule data exfiltration to be performed o
	>	nly at certain times of day or at certain intervals. This co		>	nly at certain times of day or at certain intervals. This co
	>	uld be done to blend traffic patterns with normal activity o		>	uld be done to blend traffic patterns with normal activity o
	>	r availability. When scheduled exfiltration is used, other		>	r availability.(Citation: Delay Code Execution in Java) Whe
	>	exfiltration techniques likely apply as well to transfer the		>	n scheduled exfiltration is used, other exfiltration techniq
	>	information out of the network, such as [Exfiltration Over		>	ues likely apply as well to transfer the information out of
	>	C2 Channel](https://attack.mitre.org/techniques/T1041) or [E		>	the network, such as [Exfiltration Over C2 Channel](https://
	>	xfiltration Over Alternative Protocol](https://attack.mitre.		>	attack.mitre.org/techniques/T1041) or [Exfiltration Over Alt
	>	org/techniques/T1048).		>	ernative Protocol](https://attack.mitre.org/techniques/T1048
				>	).

Details

values_changed
STIX Field	Old value	New Value
modified	2025-10-24 17:48:45.522000+00:00	2026-09-03 19:46:50.463000+00:00
description	Adversaries may schedule data exfiltration to be performed only at certain times of day or at certain intervals. This could be done to blend traffic patterns with normal activity or availability. When scheduled exfiltration is used, other exfiltration techniques likely apply as well to transfer the information out of the network, such as [Exfiltration Over C2 Channel](https://attack.mitre.org/techniques/T1041) or [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048).	Adversaries may schedule data exfiltration to be performed only at certain times of day or at certain intervals. This could be done to blend traffic patterns with normal activity or availability.(Citation: Delay Code Execution in Java) When scheduled exfiltration is used, other exfiltration techniques likely apply as well to transfer the information out of the network, such as [Exfiltration Over C2 Channel](https://attack.mitre.org/techniques/T1041) or [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048).
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	1.2

iterable_item_added
STIX Field	Old value	New Value
external_references		{'source_name': 'Delay Code Execution in Java', 'description': 'JavaThinking. (n.d.). How to Delay Code Execution in Java: A Comprehensive Guide. Retrieved September 2, 2026.', 'url': 'https://www.javathinking.com/blog/how-to-delay-code-execution-in-java/#google_vignette'}

[T1213.002] Data from Information Repositories: Sharepoint

Current version: 1.2

Version changed from: 1.1 → 1.2

	Old Description			New Description
t	1	Adversaries may leverage the SharePoint repository as a sour	t	1	Adversaries may leverage the SharePoint repository as a sour
	>	ce to mine valuable information. SharePoint will often conta		>	ce to mine valuable information.(Citation: Information archi
	>	in useful information for an adversary to learn about the st		>	tecture guidance for SharePoint Online portals) SharePoint w
	>	ructure and functionality of the internal network and system		>	ill often contain useful information for an adversary to lea
	>	s. For example, the following is a list of example informati		>	rn about the structure and functionality of the internal net
	>	on that may hold potential value to an adversary and may als		>	work and systems. For example, the following is a list of ex
	>	o be found on SharePoint: * Policies, procedures, and stand		>	ample information that may hold potential value to an advers
	>	ards * Physical / logical network diagrams * System architec		>	ary and may also be found on SharePoint: * Policies, proced
	>	ture diagrams * Technical system documentation * Testing / d		>	ures, and standards * Physical / logical network diagrams *
	>	evelopment credentials (i.e., [Unsecured Credentials](https:		>	System architecture diagrams * Technical system documentatio
	>	//attack.mitre.org/techniques/T1552)) * Work / project sched		>	n * Testing / development credentials (i.e., [Unsecured Cred
	>	ules * Source code snippets * Links to network shares and ot		>	entials](https://attack.mitre.org/techniques/T1552)) * Work
	>	her internal resources		>	/ project schedules * Source code snippets * Links to networ
				>	k shares and other internal resources

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.620000+00:00	2026-10-07 17:43:08.237000+00:00
description	Adversaries may leverage the SharePoint repository as a source to mine valuable information. SharePoint will often contain useful information for an adversary to learn about the structure and functionality of the internal network and systems. For example, the following is a list of example information that may hold potential value to an adversary and may also be found on SharePoint: * Policies, procedures, and standards * Physical / logical network diagrams * System architecture diagrams * Technical system documentation * Testing / development credentials (i.e., [Unsecured Credentials](https://attack.mitre.org/techniques/T1552)) * Work / project schedules * Source code snippets * Links to network shares and other internal resources	Adversaries may leverage the SharePoint repository as a source to mine valuable information.(Citation: Information architecture guidance for SharePoint Online portals) SharePoint will often contain useful information for an adversary to learn about the structure and functionality of the internal network and systems. For example, the following is a list of example information that may hold potential value to an adversary and may also be found on SharePoint: * Policies, procedures, and standards * Physical / logical network diagrams * System architecture diagrams * Technical system documentation * Testing / development credentials (i.e., [Unsecured Credentials](https://attack.mitre.org/techniques/T1552)) * Work / project schedules * Source code snippets * Links to network shares and other internal resources
external_references[1]['source_name']	Microsoft SharePoint Logging	Information architecture guidance for SharePoint Online portals
external_references[1]['description']	Microsoft. (2017, July 19). Configure audit settings for a site collection. Retrieved April 4, 2018.	Microsoft Ignite. (n.d.). Information architecture guidance for SharePoint Online portals. Retrieved September 2, 2026.
external_references[1]['url']	https://support.office.com/en-us/article/configure-audit-settings-for-a-site-collection-a9920c97-38c0-44f2-8bcb-4cf1e2ae22d2	https://learn.microsoft.com/en-us/sharepoint/dev/solution-guidance/portal-information-architecture
x_mitre_version	1.1	1.2

[T1573.001] Encrypted Channel: Symmetric Cryptography

Current version: 1.3

Version changed from: 1.2 → 1.3

	Old Description			New Description
t	1	Adversaries may employ a known symmetric encryption algorith	t	1	Adversaries may employ a known symmetric encryption algorith
	>	m to conceal command and control traffic rather than relying		>	m to conceal command and control traffic rather than relying
	>	on any inherent protections provided by a communication pro		>	on any inherent protections provided by a communication pro
	>	tocol. Symmetric encryption algorithms use the same key for		>	tocol. Symmetric encryption algorithms use the same key for
	>	plaintext encryption and ciphertext decryption. Common symme		>	plaintext encryption and ciphertext decryption. Common symme
	>	tric encryption algorithms include AES, DES, 3DES, Blowfish,		>	tric encryption algorithms include AES, DES, 3DES, Blowfish,
	>	and RC4.		>	and RC4.(Citation: Destination Certification)(Citation: Sym
				>	metric vs Asymmetric Cryptography)

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.623000+00:00	2026-09-02 20:07:39.622000+00:00
description	Adversaries may employ a known symmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Symmetric encryption algorithms use the same key for plaintext encryption and ciphertext decryption. Common symmetric encryption algorithms include AES, DES, 3DES, Blowfish, and RC4.	Adversaries may employ a known symmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Symmetric encryption algorithms use the same key for plaintext encryption and ciphertext decryption. Common symmetric encryption algorithms include AES, DES, 3DES, Blowfish, and RC4.(Citation: Destination Certification)(Citation: Symmetric vs Asymmetric Cryptography)
external_references[1]['source_name']	University of Birmingham C2	Symmetric vs Asymmetric Cryptography
external_references[1]['description']	Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.	Keyfactor. (2026, July 22). Symmetric vs Asymmetric Cryptography: What’s the Difference and When to Use Each. Retrieved September 2, 2026.
external_references[1]['url']	https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf	https://www.keyfactor.com/blog/symmetric-vs-asymmetric-cryptography-whats-the-difference-and-when-to-use-each/
x_mitre_version	1.2	1.3

iterable_item_added
STIX Field	Old value	New Value
external_references		{'source_name': 'Destination Certification', 'description': 'John Berti. (2026, July 1). Symmetric Cryptography: A CISSP Exam Study Guide. Retrieved September 2, 2026.', 'url': 'https://destcert.com/resources/symmetric-cryptography/'}

Patches

[T1583] Acquire Infrastructure

Current version: 1.5

Details

values_changed
STIX Field	Old value	New Value
modified	2025-10-24 17:48:20.468000+00:00	2026-09-18 00:31:20.483000+00:00
external_references[8]['description']	ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved October 12, 2021.	ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved September 17, 2026.
external_references[8]['url']	https://threatconnect.com/blog/infrastructure-research-hunting/	https://web.archive.org/web/20221130114004/https://threatconnect.com/blog/infrastructure-research-hunting/
x_mitre_attack_spec_version	3.2.0	3.3.0

[T1098.001] Account Manipulation: Additional Cloud Credentials

Current version: 2.8

	Old Description			New Description
t	1	Adversaries may add adversary-controlled credentials to a cl	t	1	Adversaries may add adversary-controlled credentials to a cl
	>	oud account to maintain persistent access to victim accounts		>	oud account to maintain persistent access to victim accounts
	>	and instances within the environment. For example, adversa		>	and instances within the environment. For example, adversa
	>	ries may add credentials for Service Principals and Applicat		>	ries may add credentials for Service Principals and Applicat
	>	ions in addition to existing legitimate credentials in Azure		>	ions in addition to existing legitimate credentials in Azure
	>	/ Entra ID.(Citation: Microsoft SolarWinds Customer Guidanc		>	/ Entra ID.(Citation: Microsoft SolarWinds Customer Guidanc
	>	e)(Citation: Blue Cloud of Death)(Citation: Blue Cloud of De		>	e)(Citation: Blue Cloud of Death)(Citation: Blue Cloud of De
	>	ath Video) These credentials include both x509 keys and pass		>	ath Video) These credentials include both x509 keys and pass
	>	words.(Citation: Microsoft SolarWinds Customer Guidance) Wit		>	words.(Citation: Microsoft SolarWinds Customer Guidance) Wit
	>	h sufficient permissions, there are a variety of ways to add		>	h sufficient permissions, there are a variety of ways to add
	>	credentials including the Azure Portal, Azure command line		>	credentials including the Azure Portal, Azure command line
	>	interface, and Azure or Az PowerShell modules.(Citation: Dem		>	interface, and Azure or Az PowerShell modules.(Citation: Dem
	>	ystifying Azure AD Service Principals) In infrastructure-as		>	ystifying Azure AD Service Principals) In infrastructure-as
	>	-a-service (IaaS) environments, after gaining access through		>	-a-service (IaaS) environments, after gaining access through
	>	[Cloud Accounts](https://attack.mitre.org/techniques/T1078/		>	[Cloud Accounts](https://attack.mitre.org/techniques/T1078/
	>	004), adversaries may generate or import their own SSH keys		>	004), adversaries may generate or import their own SSH keys
	>	using either the <code>CreateKeyPair</code> or <code>ImportK		>	using either the <code>CreateKeyPair</code> or <code>ImportK
	>	eyPair</code> API in AWS or the <code>gcloud compute os-logi		>	eyPair</code> API in AWS or the <code>gcloud compute os-logi
	>	n ssh-keys add</code> command in GCP.(Citation: GCP SSH Key		>	n ssh-keys add</code> command in GCP.(Citation: GCP SSH Key
	>	Add) This allows persistent access to instances within the c		>	Add) This allows persistent access to instances within the c
	>	loud environment without further usage of the compromised cl		>	loud environment without further usage of the compromised cl
	>	oud accounts.(Citation: Expel IO Evil in AWS)(Citation: Expe		>	oud accounts.(Citation: Expel IO Evil in AWS)(Citation: Expe
	>	l Behind the Scenes) Adversaries may also use the <code>Cre		>	l Behind the Scenes) Adversaries may also use the <code>Cre
	>	ateAccessKey</code> API in AWS or the <code>gcloud iam servi		>	ateAccessKey</code> API in AWS or the <code>gcloud iam servi
	>	ce-accounts keys create</code> command in GCP to add access		>	ce-accounts keys create</code> command in GCP to add access
	>	keys to an account. Alternatively, they may use the <code>Cr		>	keys to an account. Alternatively, they may use the <code>Cr
	>	eateLoginProfile</code> API in AWS to add a password that ca		>	eateLoginProfile</code> API in AWS to add a password that ca
	>	n be used to log into the AWS Management Console for [Cloud		>	n be used to log into the AWS Management Console for [Cloud
	>	Service Dashboard](https://attack.mitre.org/techniques/T1538		>	Service Dashboard](https://attack.mitre.org/techniques/T1538
	>	).(Citation: Permiso Scattered Spider 2023)(Citation: Lacewo		>	).(Citation: Permiso Scattered Spider 2023)(Citation: Lacewo
	>	rk AI Resource Hijacking 2024) If the target account has dif		>	rk AI Resource Hijacking 2024) If the target account has dif
	>	ferent permissions from the requesting account, the adversar		>	ferent permissions from the requesting account, the adversar
	>	y may also be able to escalate their privileges in the envir		>	y may also be able to escalate their privileges in the envir
	>	onment (i.e. [Cloud Accounts](https://attack.mitre.org/techn		>	onment (i.e. [Cloud Accounts](https://attack.mitre.org/techn
	>	iques/T1078/004)).(Citation: Rhino Security Labs AWS Privile		>	iques/T1078/004)).(Citation: Rhino Security Labs AWS Privile
	>	ge Escalation)(Citation: Sysdig ScarletEel 2.0) For example,		>	ge Escalation)(Citation: Sysdig ScarletEel 2.0) For example,
	>	in Entra ID environments, an adversary with the Application		>	in Entra ID environments, an adversary with the Application
	>	Administrator role can add a new set of credentials to thei		>	Administrator role can add a new set of credentials to thei
	>	r application's service principal. In doing so the adversary		>	r application's service principal. In doing so the adversary
	>	would be able to access the service principal’s roles and p		>	would be able to access the service principal’s roles and p
	>	ermissions, which may be different from those of the Applica		>	ermissions, which may be different from those of the Applica
	>	tion Administrator.(Citation: SpecterOps Azure Privilege Esc		>	tion Administrator.(Citation: SpecterOps Azure Privilege Esc
	>	alation) In AWS environments, adversaries with the appropr		>	alation) In AWS environments, adversaries with the appropr
	>	iate permissions may also use the `sts:GetFederationToken` A		>	iate permissions may also use the `sts:GetFederationToken` A
	>	PI call to create a temporary set of credentials to [Forge W		>	PI call to create a temporary set of credentials to [Forge W
	>	eb Credentials](https://attack.mitre.org/techniques/T1606) t		>	eb Credentials](https://attack.mitre.org/techniques/T1606) t
	>	ied to the permissions of the original user account. These t		>	ied to the permissions of the original user account. These t
	>	emporary credentials may remain valid for the duration of th		>	emporary credentials may remain valid for the duration of th
	>	eir lifetime even if the original account’s API credentials		>	eir lifetime even if the original account’s API credentials
	>	are deactivated. (Citation: Crowdstrike AWS User Federation		>	are deactivated. (Citation: Crowdstrike AWS User Federation
	>	Persistence) In Entra ID environments with the app password		>	Persistence) In Entra ID environments with the app password
	>	feature enabled, adversaries may be able to add an app pass		>	feature enabled, adversaries may be able to add an app pass
	>	word to a user account.(Citation: Mandiant APT42 Operations		>	word to a user account.(Citation: Mandiant APT42-untangling)
	>	2024) As app passwords are intended to be used with legacy d		>	As app passwords are intended to be used with legacy device
	>	evices that do not support multi-factor authentication (MFA)		>	s that do not support multi-factor authentication (MFA), add
	>	, adding an app password can allow an adversary to bypass MF		>	ing an app password can allow an adversary to bypass MFA req
	>	A requirements. Additionally, app passwords may remain valid		>	uirements. Additionally, app passwords may remain valid even
	>	even if the user’s primary password is reset.(Citation: Mic		>	if the user’s primary password is reset.(Citation: Microsof
	>	rosoft Entra ID App Passwords)		>	t Entra ID App Passwords)

Details

values_changed
STIX Field	Old value	New Value
modified	2025-10-24 17:49:04.839000+00:00	2026-09-17 17:49:30.904000+00:00
description	Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment. For example, adversaries may add credentials for Service Principals and Applications in addition to existing legitimate credentials in Azure / Entra ID.(Citation: Microsoft SolarWinds Customer Guidance)(Citation: Blue Cloud of Death)(Citation: Blue Cloud of Death Video) These credentials include both x509 keys and passwords.(Citation: Microsoft SolarWinds Customer Guidance) With sufficient permissions, there are a variety of ways to add credentials including the Azure Portal, Azure command line interface, and Azure or Az PowerShell modules.(Citation: Demystifying Azure AD Service Principals) In infrastructure-as-a-service (IaaS) environments, after gaining access through [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004), adversaries may generate or import their own SSH keys using either the `CreateKeyPair` or `ImportKeyPair` API in AWS or the `gcloud compute os-login ssh-keys add` command in GCP.(Citation: GCP SSH Key Add) This allows persistent access to instances within the cloud environment without further usage of the compromised cloud accounts.(Citation: Expel IO Evil in AWS)(Citation: Expel Behind the Scenes) Adversaries may also use the `CreateAccessKey` API in AWS or the `gcloud iam service-accounts keys create` command in GCP to add access keys to an account. Alternatively, they may use the `CreateLoginProfile` API in AWS to add a password that can be used to log into the AWS Management Console for [Cloud Service Dashboard](https://attack.mitre.org/techniques/T1538).(Citation: Permiso Scattered Spider 2023)(Citation: Lacework AI Resource Hijacking 2024) If the target account has different permissions from the requesting account, the adversary may also be able to escalate their privileges in the environment (i.e. [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004)).(Citation: Rhino Security Labs AWS Privilege Escalation)(Citation: Sysdig ScarletEel 2.0) For example, in Entra ID environments, an adversary with the Application Administrator role can add a new set of credentials to their application's service principal. In doing so the adversary would be able to access the service principal’s roles and permissions, which may be different from those of the Application Administrator.(Citation: SpecterOps Azure Privilege Escalation) In AWS environments, adversaries with the appropriate permissions may also use the `sts:GetFederationToken` API call to create a temporary set of credentials to [Forge Web Credentials](https://attack.mitre.org/techniques/T1606) tied to the permissions of the original user account. These temporary credentials may remain valid for the duration of their lifetime even if the original account’s API credentials are deactivated. (Citation: Crowdstrike AWS User Federation Persistence) In Entra ID environments with the app password feature enabled, adversaries may be able to add an app password to a user account.(Citation: Mandiant APT42 Operations 2024) As app passwords are intended to be used with legacy devices that do not support multi-factor authentication (MFA), adding an app password can allow an adversary to bypass MFA requirements. Additionally, app passwords may remain valid even if the user’s primary password is reset.(Citation: Microsoft Entra ID App Passwords)	Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment. For example, adversaries may add credentials for Service Principals and Applications in addition to existing legitimate credentials in Azure / Entra ID.(Citation: Microsoft SolarWinds Customer Guidance)(Citation: Blue Cloud of Death)(Citation: Blue Cloud of Death Video) These credentials include both x509 keys and passwords.(Citation: Microsoft SolarWinds Customer Guidance) With sufficient permissions, there are a variety of ways to add credentials including the Azure Portal, Azure command line interface, and Azure or Az PowerShell modules.(Citation: Demystifying Azure AD Service Principals) In infrastructure-as-a-service (IaaS) environments, after gaining access through [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004), adversaries may generate or import their own SSH keys using either the `CreateKeyPair` or `ImportKeyPair` API in AWS or the `gcloud compute os-login ssh-keys add` command in GCP.(Citation: GCP SSH Key Add) This allows persistent access to instances within the cloud environment without further usage of the compromised cloud accounts.(Citation: Expel IO Evil in AWS)(Citation: Expel Behind the Scenes) Adversaries may also use the `CreateAccessKey` API in AWS or the `gcloud iam service-accounts keys create` command in GCP to add access keys to an account. Alternatively, they may use the `CreateLoginProfile` API in AWS to add a password that can be used to log into the AWS Management Console for [Cloud Service Dashboard](https://attack.mitre.org/techniques/T1538).(Citation: Permiso Scattered Spider 2023)(Citation: Lacework AI Resource Hijacking 2024) If the target account has different permissions from the requesting account, the adversary may also be able to escalate their privileges in the environment (i.e. [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004)).(Citation: Rhino Security Labs AWS Privilege Escalation)(Citation: Sysdig ScarletEel 2.0) For example, in Entra ID environments, an adversary with the Application Administrator role can add a new set of credentials to their application's service principal. In doing so the adversary would be able to access the service principal’s roles and permissions, which may be different from those of the Application Administrator.(Citation: SpecterOps Azure Privilege Escalation) In AWS environments, adversaries with the appropriate permissions may also use the `sts:GetFederationToken` API call to create a temporary set of credentials to [Forge Web Credentials](https://attack.mitre.org/techniques/T1606) tied to the permissions of the original user account. These temporary credentials may remain valid for the duration of their lifetime even if the original account’s API credentials are deactivated. (Citation: Crowdstrike AWS User Federation Persistence) In Entra ID environments with the app password feature enabled, adversaries may be able to add an app password to a user account.(Citation: Mandiant APT42-untangling) As app passwords are intended to be used with legacy devices that do not support multi-factor authentication (MFA), adding an app password can allow an adversary to bypass MFA requirements. Additionally, app passwords may remain valid even if the user’s primary password is reset.(Citation: Microsoft Entra ID App Passwords)
external_references[12]['source_name']	Mandiant APT42 Operations 2024	Mandiant APT42-untangling
external_references[12]['description']	Ofir Rozmann, Asli Koksal, Adrian Hernandez, Sarah Bock, and Jonathan Leathery. (2024, May 1). Uncharmed: Untangling Iran's APT42 Operations. Retrieved May 28, 2024.	Rozmann, O., et al. (2024, May 1). Uncharmed: Untangling Iran's APT42 Operations. Retrieved October 9, 2024.
x_mitre_attack_spec_version	3.2.0	3.3.0

[T1071] Application Layer Protocol

Current version: 2.4

Details

values_changed
STIX Field	Old value	New Value
modified	2025-10-24 17:48:38.368000+00:00	2026-09-03 19:46:45.255000+00:00
external_references[1]['description']	Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.	Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved September 3, 2026.
external_references[1]['url']	https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf	https://arxiv.org/pdf/1408.1136
x_mitre_attack_spec_version	3.2.0	3.3.0

[T1119] Automated Collection

Current version: 1.4

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.624000+00:00	2026-09-11 19:58:54.721000+00:00

[T1102.002] Web Service: Bidirectional Communication

Current version: 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.713000+00:00	2026-09-03 19:46:40.085000+00:00
external_references[1]['description']	Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.	Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved September 3, 2026.
external_references[1]['url']	https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf	https://arxiv.org/pdf/1408.1136

[T1027.001] Obfuscated Files or Information: Binary Padding

Current version: 2.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.635000+00:00	2026-09-11 20:00:19.155000+00:00

[T1217] Browser Information Discovery

Current version: 2.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.635000+00:00	2026-09-11 19:56:45.908000+00:00

[T1612] Build Image on Host

Current version: 2.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.662000+00:00	2026-10-07 17:57:15.222000+00:00
external_references[3]['description']	Team Nautilus. (2021, June). Attacks in the Wild on the Container Supply Chain and Infrastructure. Retrieved August 26, 2021.	Team Nautilus. (2021, June). Attacks in the Wild on the Container Supply Chain and Infrastructure. Retrieved October 7, 2026.
external_references[3]['url']	https://info.aquasec.com/hubfs/Threat%20reports/AquaSecurity_Cloud_Native_Threat_Report_2021.pdf?utm_campaign=WP%20-%20Jun2021%20Nautilus%202021%20Threat%20Research%20Report&utm_medium=email&_hsmi=132931006&_hsenc=p2ANqtz-_8oopT5Uhqab8B7kE0l3iFo1koirxtyfTehxF7N-EdGYrwk30gfiwp5SiNlW3G0TNKZxUcDkYOtwQ9S6nNVNyEO-Dgrw&utm_content=132931006&utm_source=hs_automation	https://web.archive.org/web/20220106180157/https://info.aquasec.com/hubfs/Threat%20reports/AquaSecurity_Cloud_Native_Threat_Report_2021.pdf

[T1592.004] Gather Victim Host Information: Client Configurations

Current version: 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.642000+00:00	2026-09-18 00:31:18.339000+00:00
external_references[2]['description']	ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved October 12, 2021.	ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved September 17, 2026.
external_references[2]['url']	https://threatconnect.com/blog/infrastructure-research-hunting/	https://web.archive.org/web/20221130114004/https://threatconnect.com/blog/infrastructure-research-hunting/

[T1584] Compromise Infrastructure

Current version: 1.6

Details

values_changed
STIX Field	Old value	New Value
modified	2025-10-24 17:49:01.181000+00:00	2026-09-18 00:31:20.766000+00:00
external_references[11]['description']	ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved October 12, 2021.	ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved September 17, 2026.
external_references[11]['url']	https://threatconnect.com/blog/infrastructure-research-hunting/	https://web.archive.org/web/20221130114004/https://threatconnect.com/blog/infrastructure-research-hunting/
x_mitre_attack_spec_version	3.2.0	3.3.0

[T1543] Create or Modify System Process

Current version: 1.2

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.621000+00:00	2026-09-11 19:43:15.046000+00:00

[T1552.001] Unsecured Credentials: Credentials In Files

Current version: 1.3

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.672000+00:00	2026-09-11 19:22:30.399000+00:00

[T1555.003] Credentials from Password Stores: Credentials from Web Browsers

Current version: 1.2

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.635000+00:00	2026-09-11 19:22:47.433000+00:00

[T1574.001] Hijack Execution Flow: DLL

Current version: 3.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.624000+00:00	2026-09-11 19:32:27.370000+00:00

[T1071.004] Application Layer Protocol: DNS

Current version: 1.4

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.622000+00:00	2026-09-03 19:46:40.083000+00:00
external_references[2]['description']	Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.	Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved September 3, 2026.
external_references[2]['url']	https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf	https://arxiv.org/pdf/1408.1136

[T1132] Data Encoding

Current version: 1.3

	Old Description			New Description
t	1	Adversaries may encode data to make the content of command a	t	1	Adversaries may encode data to make the content of command a
	>	nd control traffic more difficult to detect. Command and con		>	nd control traffic more difficult to detect. Command and con
	>	trol (C2) information can be encoded using a standard data e		>	trol (C2) information can be encoded using a standard data e
	>	ncoding system. Use of data encoding may adhere to existing		>	ncoding system. Use of data encoding may adhere to existing
	>	protocol specifications and includes use of ASCII, Unicode,		>	protocol specifications and includes use of ASCII, Unicode,
	>	Base64, MIME, or other binary-to-text and character encoding		>	Base64, MIME, or other binary-to-text and character encoding
	>	systems.(Citation: Wikipedia Binary-to-text Encoding) (Cita		>	systems.(Citation: Wikipedia Binary-to-text Encoding)(Citat
	>	tion: Wikipedia Character Encoding) Some data encoding syste		>	ion: Wikipedia Character Encoding) Some data encoding system
	>	ms may also result in data compression, such as gzip.		>	s may also result in data compression, such as gzip.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.717000+00:00	2026-09-08 20:15:04.260000+00:00
description	Adversaries may encode data to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system. Use of data encoding may adhere to existing protocol specifications and includes use of ASCII, Unicode, Base64, MIME, or other binary-to-text and character encoding systems.(Citation: Wikipedia Binary-to-text Encoding) (Citation: Wikipedia Character Encoding) Some data encoding systems may also result in data compression, such as gzip.	Adversaries may encode data to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system. Use of data encoding may adhere to existing protocol specifications and includes use of ASCII, Unicode, Base64, MIME, or other binary-to-text and character encoding systems.(Citation: Wikipedia Binary-to-text Encoding)(Citation: Wikipedia Character Encoding) Some data encoding systems may also result in data compression, such as gzip.

iterable_item_removed
STIX Field	Old value	New Value
external_references	{'source_name': 'University of Birmingham C2', 'description': 'Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.', 'url': 'https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf'}

[T1001] Data Obfuscation

Current version: 1.2

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.707000+00:00	2026-09-03 19:46:47.930000+00:00
external_references[1]['description']	Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.	Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved September 3, 2026.
external_references[1]['url']	https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf	https://arxiv.org/pdf/1408.1136

[T1005] Data from Local System

Current version: 1.8

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.628000+00:00	2026-09-11 19:59:22.966000+00:00

[T1622] Debugger Evasion

Current version: 2.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.723000+00:00	2026-09-11 19:39:55.836000+00:00

[T1678] Delay Execution

Current version: 2.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.706000+00:00	2026-09-11 19:52:38.458000+00:00

[T1140] Deobfuscate/Decode Files or Information

Current version: 2.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.628000+00:00	2026-09-11 19:42:55.679000+00:00

[T1685] Disable or Modify Tools

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.712000+00:00	2026-09-11 19:52:16.657000+00:00

[T1583.001] Acquire Infrastructure: Domains

Current version: 1.4

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.629000+00:00	2026-09-18 00:31:18.338000+00:00
external_references[19]['description']	ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved October 12, 2021.	ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved September 17, 2026.
external_references[19]['url']	https://threatconnect.com/blog/infrastructure-research-hunting/	https://web.archive.org/web/20221130114004/https://threatconnect.com/blog/infrastructure-research-hunting/

[T1585.002] Establish Accounts: Email Accounts

Current version: 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.636000+00:00	2026-09-11 19:22:11.810000+00:00

[T1573] Encrypted Channel

Current version: 1.2

Details

values_changed
STIX Field	Old value	New Value
modified	2025-10-24 17:49:17.042000+00:00	2026-09-03 19:46:48.529000+00:00
external_references[3]['description']	Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.	Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved September 3, 2026.
external_references[3]['url']	https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf	https://arxiv.org/pdf/1408.1136
x_mitre_attack_spec_version	3.2.0	3.3.0

[T1027.013] Obfuscated Files or Information: Encrypted/Encoded File

Current version: 2.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.620000+00:00	2026-09-11 19:42:10.060000+00:00

[T1048] Exfiltration Over Alternative Protocol

Current version: 1.6

Details

values_changed
STIX Field	Old value	New Value
modified	2025-10-24 17:49:10.460000+00:00	2026-09-03 19:46:48.106000+00:00
external_references[1]['description']	Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.	Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved September 3, 2026.
external_references[1]['url']	https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf	https://arxiv.org/pdf/1408.1136
x_mitre_attack_spec_version	3.2.0	3.3.0

[T1048.003] Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol

Current version: 2.2

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.726000+00:00	2026-09-03 19:46:40.087000+00:00
external_references[2]['description']	Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.	Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved September 3, 2026.
external_references[2]['url']	https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf	https://arxiv.org/pdf/1408.1136

[T1090.002] Proxy: External Proxy

Current version: 1.3

	Old Description			New Description
t	1	Adversaries may use an external proxy to act as an intermedi	t	1	Adversaries may use an external proxy to act as an intermedi
	>	ary for network communications to a command and control serv		>	ary for network communications to a command and control serv
	>	er to avoid direct connections to their infrastructure. Many		>	er to avoid direct connections to their infrastructure. Many
	>	tools exist that enable traffic redirection through proxies		>	tools exist that enable traffic redirection through proxies
	>	or port redirection, including [HTRAN](https://attack.mitre		>	or port redirection, including [HTRAN](https://attack.mitre
	>	.org/software/S0040), ZXProxy, and ZXPortMap. (Citation: Tre		>	.org/software/S0040), ZXProxy, and ZXPortMap.(Citation: Tren
	>	nd Micro APT Attack Tools) Adversaries use these types of pr		>	d Micro APT Attack Tools) Adversaries use these types of pro
	>	oxies to manage command and control communications, to provi		>	xies to manage command and control communications, to provid
	>	de resiliency in the face of connection loss, or to ride ove		>	e resiliency in the face of connection loss, or to ride over
	>	r existing trusted communications paths to avoid suspicion.		>	existing trusted communications paths to avoid suspicion.
	>	External connection proxies are used to mask the destinatio		>	External connection proxies are used to mask the destination
	>	n of C2 traffic and are typically implemented with port redi		>	of C2 traffic and are typically implemented with port redir
	>	rectors. Compromised systems outside of the victim environme		>	ectors. Compromised systems outside of the victim environmen
	>	nt may be used for these purposes, as well as purchased infr		>	t may be used for these purposes, as well as purchased infra
	>	astructure such as cloud-based resources or virtual private		>	structure such as cloud-based resources or virtual private s
	>	servers. Proxies may be chosen based on the low likelihood t		>	ervers. Proxies may be chosen based on the low likelihood th
	>	hat a connection to them from a compromised system would be		>	at a connection to them from a compromised system would be i
	>	investigated. Victim systems would communicate directly with		>	nvestigated. Victim systems would communicate directly with
	>	the external proxy on the Internet and then the proxy would		>	the external proxy on the Internet and then the proxy would
	>	forward communications to the C2 server.		>	forward communications to the C2 server.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.640000+00:00	2026-09-08 20:29:07.652000+00:00
description	Adversaries may use an external proxy to act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap. (Citation: Trend Micro APT Attack Tools) Adversaries use these types of proxies to manage command and control communications, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths to avoid suspicion. External connection proxies are used to mask the destination of C2 traffic and are typically implemented with port redirectors. Compromised systems outside of the victim environment may be used for these purposes, as well as purchased infrastructure such as cloud-based resources or virtual private servers. Proxies may be chosen based on the low likelihood that a connection to them from a compromised system would be investigated. Victim systems would communicate directly with the external proxy on the Internet and then the proxy would forward communications to the C2 server.	Adversaries may use an external proxy to act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap.(Citation: Trend Micro APT Attack Tools) Adversaries use these types of proxies to manage command and control communications, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths to avoid suspicion. External connection proxies are used to mask the destination of C2 traffic and are typically implemented with port redirectors. Compromised systems outside of the victim environment may be used for these purposes, as well as purchased infrastructure such as cloud-based resources or virtual private servers. Proxies may be chosen based on the low likelihood that a connection to them from a compromised system would be investigated. Victim systems would communicate directly with the external proxy on the Internet and then the proxy would forward communications to the C2 server.

iterable_item_removed
STIX Field	Old value	New Value
external_references	{'source_name': 'University of Birmingham C2', 'description': 'Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.', 'url': 'https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf'}

[T1008] Fallback Channels

Current version: 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.724000+00:00	2026-09-09 18:39:15.900000+00:00

iterable_item_removed
STIX Field	Old value	New Value
external_references	{'source_name': 'University of Birmingham C2', 'description': 'Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.', 'url': 'https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf'}

[T1070.004] Indicator Removal: File Deletion

Current version: 2.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.718000+00:00	2026-09-11 19:53:31.010000+00:00

[T1071.002] Application Layer Protocol: File Transfer Protocols

Current version: 1.4

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.706000+00:00	2026-09-03 19:46:40.084000+00:00
external_references[2]['description']	Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.	Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved September 3, 2026.
external_references[2]['url']	https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf	https://arxiv.org/pdf/1408.1136

[T1083] File and Directory Discovery

Current version: 1.7

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.644000+00:00	2026-09-11 19:45:35.899000+00:00

[T1592] Gather Victim Host Information

Current version: 1.2

Details

values_changed
STIX Field	Old value	New Value
modified	2025-10-24 17:48:21.583000+00:00	2026-09-18 00:31:20.607000+00:00
external_references[3]['description']	ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved October 12, 2021.	ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved September 17, 2026.
external_references[3]['url']	https://threatconnect.com/blog/infrastructure-research-hunting/	https://web.archive.org/web/20221130114004/https://threatconnect.com/blog/infrastructure-research-hunting/
x_mitre_attack_spec_version	3.2.0	3.3.0

[T1592.001] Gather Victim Host Information: Hardware

Current version: 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2025-10-24 17:48:32.066000+00:00	2026-09-18 00:31:18.338000+00:00
external_references[2]['description']	ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved October 12, 2021.	ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved September 17, 2026.
external_references[2]['url']	https://threatconnect.com/blog/infrastructure-research-hunting/	https://web.archive.org/web/20221130114004/https://threatconnect.com/blog/infrastructure-research-hunting/
x_mitre_attack_spec_version	3.2.0	3.3.0

[T1105] Ingress Tool Transfer

Current version: 2.6

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.723000+00:00	2026-09-11 19:48:23.794000+00:00

[T1090.001] Proxy: Internal Proxy

Current version: 1.2

	Old Description			New Description
t	1	Adversaries may use an internal proxy to direct command and	t	1	Adversaries may use an internal proxy to direct command and
	>	control traffic between two or more systems in a compromised		>	control traffic between two or more systems in a compromised
	>	environment. Many tools exist that enable traffic redirecti		>	environment. Many tools exist that enable traffic redirecti
	>	on through proxies or port redirection, including [HTRAN](ht		>	on through proxies or port redirection, including [HTRAN](ht
	>	tps://attack.mitre.org/software/S0040), ZXProxy, and ZXPortM		>	tps://attack.mitre.org/software/S0040), ZXProxy, and ZXPortM
	>	ap. (Citation: Trend Micro APT Attack Tools) Adversaries use		>	ap.(Citation: Trend Micro APT Attack Tools) Adversaries use
	>	internal proxies to manage command and control communicatio		>	internal proxies to manage command and control communication
	>	ns inside a compromised environment, to reduce the number of		>	s inside a compromised environment, to reduce the number of
	>	simultaneous outbound network connections, to provide resil		>	simultaneous outbound network connections, to provide resili
	>	iency in the face of connection loss, or to ride over existi		>	ency in the face of connection loss, or to ride over existin
	>	ng trusted communications paths between infected systems to		>	g trusted communications paths between infected systems to a
	>	avoid suspicion. Internal proxy connections may use common p		>	void suspicion. Internal proxy connections may use common pe
	>	eer-to-peer (p2p) networking protocols, such as SMB, to bett		>	er-to-peer (p2p) networking protocols, such as SMB, to bette
	>	er blend in with the environment. By using a compromised in		>	r blend in with the environment. By using a compromised int
	>	ternal system as a proxy, adversaries may conceal the true d		>	ernal system as a proxy, adversaries may conceal the true de
	>	estination of C2 traffic while reducing the need for numerou		>	stination of C2 traffic while reducing the need for numerous
	>	s connections to external systems.		>	connections to external systems.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.724000+00:00	2026-09-08 20:28:40.517000+00:00
description	Adversaries may use an internal proxy to direct command and control traffic between two or more systems in a compromised environment. Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap. (Citation: Trend Micro APT Attack Tools) Adversaries use internal proxies to manage command and control communications inside a compromised environment, to reduce the number of simultaneous outbound network connections, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between infected systems to avoid suspicion. Internal proxy connections may use common peer-to-peer (p2p) networking protocols, such as SMB, to better blend in with the environment. By using a compromised internal system as a proxy, adversaries may conceal the true destination of C2 traffic while reducing the need for numerous connections to external systems.	Adversaries may use an internal proxy to direct command and control traffic between two or more systems in a compromised environment. Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap.(Citation: Trend Micro APT Attack Tools) Adversaries use internal proxies to manage command and control communications inside a compromised environment, to reduce the number of simultaneous outbound network connections, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between infected systems to avoid suspicion. Internal proxy connections may use common peer-to-peer (p2p) networking protocols, such as SMB, to better blend in with the environment. By using a compromised internal system as a proxy, adversaries may conceal the true destination of C2 traffic while reducing the need for numerous connections to external systems.

iterable_item_removed
STIX Field	Old value	New Value
external_references	{'source_name': 'University of Birmingham C2', 'description': 'Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.', 'url': 'https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf'}

[T1036.001] Masquerading: Invalid Code Signature

Current version: 2.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.709000+00:00	2026-09-11 19:55:56.428000+00:00

[T1001.001] Data Obfuscation: Junk Data

Current version: 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.725000+00:00	2026-09-03 19:46:40.087000+00:00
external_references[2]['description']	Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.	Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved September 3, 2026.
external_references[2]['url']	https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf	https://arxiv.org/pdf/1408.1136

[T1570] Lateral Tool Transfer

Current version: 1.4

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.713000+00:00	2026-09-03 19:46:52.112000+00:00

[T1074.001] Data Staged: Local Data Staging

Current version: 1.2

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.622000+00:00	2026-09-11 19:49:27.665000+00:00

[T1071.003] Application Layer Protocol: Mail Protocols

Current version: 1.2

Details

values_changed
STIX Field	Old value	New Value
modified	2025-10-24 17:48:48.564000+00:00	2026-09-03 19:46:40.083000+00:00
external_references[2]['description']	Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.	Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved September 3, 2026.
external_references[2]['url']	https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf	https://arxiv.org/pdf/1408.1136

[T1204.003] User Execution: Malicious Image

Current version: 1.2

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_remote_support		False

values_changed
STIX Field	Old value	New Value
modified	2025-10-24 17:49:13.999000+00:00	2026-10-07 17:57:14.703000+00:00
external_references[2]['description']	Team Nautilus. (2021, June). Attacks in the Wild on the Container Supply Chain and Infrastructure. Retrieved August 26, 2021.	Team Nautilus. (2021, June). Attacks in the Wild on the Container Supply Chain and Infrastructure. Retrieved October 7, 2026.
external_references[2]['url']	https://info.aquasec.com/hubfs/Threat%20reports/AquaSecurity_Cloud_Native_Threat_Report_2021.pdf?utm_campaign=WP%20-%20Jun2021%20Nautilus%202021%20Threat%20Research%20Report&utm_medium=email&_hsmi=132931006&_hsenc=p2ANqtz-_8oopT5Uhqab8B7kE0l3iFo1koirxtyfTehxF7N-EdGYrwk30gfiwp5SiNlW3G0TNKZxUcDkYOtwQ9S6nNVNyEO-Dgrw&utm_content=132931006&utm_source=hs_automation	https://web.archive.org/web/20220106180157/https://info.aquasec.com/hubfs/Threat%20reports/AquaSecurity_Cloud_Native_Threat_Report_2021.pdf
x_mitre_attack_spec_version	3.2.0	3.3.0

[T1204.001] User Execution: Malicious Link

Current version: 1.2

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.723000+00:00	2026-09-11 19:19:57.658000+00:00

[T1036.005] Masquerading: Match Legitimate Resource Name or Location

Current version: 3.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.622000+00:00	2026-09-11 19:59:49.678000+00:00

[T1112] Modify Registry

Current version: 3.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.634000+00:00	2026-09-11 19:48:51.536000+00:00

[T1106] Native API

Current version: 2.3

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.627000+00:00	2026-09-11 19:38:58.040000+00:00

[T1095] Non-Application Layer Protocol

Current version: 2.4

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.713000+00:00	2026-09-03 19:46:48.129000+00:00
external_references[2]['description']	Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.	Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved September 3, 2026.
external_references[2]['url']	https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf	https://arxiv.org/pdf/1408.1136

[T1571] Non-Standard Port

Current version: 1.3

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.707000+00:00	2026-09-03 19:46:48.006000+00:00
external_references[1]['description']	Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.	Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved September 3, 2026.
external_references[1]['url']	https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf	https://arxiv.org/pdf/1408.1136

[T1027] Obfuscated Files or Information

Current version: 2.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.708000+00:00	2026-09-11 19:32:58.098000+00:00

[T1102.003] Web Service: One-Way Communication

Current version: 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2025-10-24 17:49:08.849000+00:00	2026-09-03 19:46:40.085000+00:00
external_references[1]['description']	Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.	Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved September 3, 2026.
external_references[1]['url']	https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf	https://arxiv.org/pdf/1408.1136
x_mitre_attack_spec_version	3.2.0	3.3.0

[T1057] Process Discovery

Current version: 1.6

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.705000+00:00	2026-09-11 19:40:13.112000+00:00

[T1055.012] Process Injection: Process Hollowing

Current version: 2.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.708000+00:00	2026-09-11 19:54:27.078000+00:00

[T1055] Process Injection

Current version: 2.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.629000+00:00	2026-09-11 20:00:48.048000+00:00

[T1572] Protocol Tunneling

Current version: 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.632000+00:00	2026-09-03 19:46:46.553000+00:00
external_references[2]['description']	Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.	Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved September 3, 2026.
external_references[2]['url']	https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf	https://arxiv.org/pdf/1408.1136

[T1001.003] Data Obfuscation: Protocol or Service Impersonation

Current version: 2.1

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.714000+00:00	2026-09-03 19:46:40.086000+00:00
external_references[2]['description']	Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.	Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved September 3, 2026.
external_references[2]['url']	https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf	https://arxiv.org/pdf/1408.1136

[T1090] Proxy

Current version: 3.2

	Old Description			New Description
t	1	Adversaries may use a connection proxy to direct network tra	t	1	Adversaries may use a connection proxy to direct network tra
	>	ffic between systems or act as an intermediary for network c		>	ffic between systems or act as an intermediary for network c
	>	ommunications to a command and control server to avoid direc		>	ommunications to a command and control server to avoid direc
	>	t connections to their infrastructure. Many tools exist that		>	t connections to their infrastructure. Many tools exist that
	>	enable traffic redirection through proxies or port redirect		>	enable traffic redirection through proxies or port redirect
	>	ion, including [HTRAN](https://attack.mitre.org/software/S00		>	ion, including [HTRAN](https://attack.mitre.org/software/S00
	>	40), ZXProxy, and ZXPortMap. (Citation: Trend Micro APT Atta		>	40), ZXProxy, and ZXPortMap.(Citation: Trend Micro APT Attac
	>	ck Tools) Adversaries use these types of proxies to manage c		>	k Tools) Adversaries use these types of proxies to manage co
	>	ommand and control communications, reduce the number of simu		>	mmand and control communications, reduce the number of simul
	>	ltaneous outbound network connections, provide resiliency in		>	taneous outbound network connections, provide resiliency in
	>	the face of connection loss, or to ride over existing trust		>	the face of connection loss, or to ride over existing truste
	>	ed communications paths between victims to avoid suspicion.		>	d communications paths between victims to avoid suspicion. A
	>	Adversaries may chain together multiple proxies to further d		>	dversaries may chain together multiple proxies to further di
	>	isguise the source of malicious traffic. Adversaries can al		>	sguise the source of malicious traffic. Adversaries can als
	>	so take advantage of routing schemes in Content Delivery Net		>	o take advantage of routing schemes in Content Delivery Netw
	>	works (CDNs) to proxy command and control traffic.		>	orks (CDNs) to proxy command and control traffic.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.641000+00:00	2026-09-08 20:28:07.390000+00:00
description	Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap. (Citation: Trend Micro APT Attack Tools) Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic. Adversaries can also take advantage of routing schemes in Content Delivery Networks (CDNs) to proxy command and control traffic.	Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap.(Citation: Trend Micro APT Attack Tools) Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic. Adversaries can also take advantage of routing schemes in Content Delivery Networks (CDNs) to proxy command and control traffic.

iterable_item_removed
STIX Field	Old value	New Value
external_references	{'source_name': 'University of Birmingham C2', 'description': 'Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.', 'url': 'https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf'}

[T1583.004] Acquire Infrastructure: Server

Current version: 1.3

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.635000+00:00	2026-09-18 00:31:18.339000+00:00
external_references[5]['description']	ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved October 12, 2021.	ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved September 17, 2026.
external_references[5]['url']	https://threatconnect.com/blog/infrastructure-research-hunting/	https://web.archive.org/web/20221130114004/https://threatconnect.com/blog/infrastructure-research-hunting/

[T1584.004] Compromise Infrastructure: Server

Current version: 1.2

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.722000+00:00	2026-09-18 00:31:18.340000+00:00
external_references[4]['description']	ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved October 12, 2021.	ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved September 17, 2026.
external_references[4]['url']	https://threatconnect.com/blog/infrastructure-research-hunting/	https://web.archive.org/web/20221130114004/https://threatconnect.com/blog/infrastructure-research-hunting/

[T1569.002] System Services: Service Execution

Current version: 1.3

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.723000+00:00	2026-09-11 19:43:47.298000+00:00

[T1489] Service Stop

Current version: 1.4

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.622000+00:00	2026-09-11 19:41:40.954000+00:00

[T1129] Shared Modules

Current version: 2.3

Details

values_changed
STIX Field	Old value	New Value
modified	2025-10-24 17:48:22.302000+00:00	2026-09-11 19:58:20.992000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0

[T1592.002] Gather Victim Host Information: Software

Current version: 1.2

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.710000+00:00	2026-09-18 00:31:18.340000+00:00
external_references[3]['description']	ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved October 12, 2021.	ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved September 17, 2026.
external_references[3]['url']	https://threatconnect.com/blog/infrastructure-research-hunting/	https://web.archive.org/web/20221130114004/https://threatconnect.com/blog/infrastructure-research-hunting/

[T1027.002] Obfuscated Files or Information: Software Packing

Current version: 2.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.722000+00:00	2026-09-11 19:21:13.428000+00:00

[T1566.001] Phishing: Spearphishing Attachment

Current version: 2.2

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.624000+00:00	2026-09-11 19:55:20.273000+00:00

[T1566.002] Phishing: Spearphishing Link

Current version: 2.8

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.623000+00:00	2026-09-11 19:55:38.427000+00:00

[T1132.001] Data Encoding: Standard Encoding

Current version: 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.620000+00:00	2026-09-03 19:46:40.081000+00:00
external_references[1]['description']	Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.	Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved September 3, 2026.
external_references[1]['url']	https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf	https://arxiv.org/pdf/1408.1136

[T1497.001] Virtualization/Sandbox Evasion: System Checks

Current version: 3.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.623000+00:00	2026-09-11 19:25:59.519000+00:00

[T1082] System Information Discovery

Current version: 3.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.625000+00:00	2026-09-11 19:56:24.154000+00:00

[T1614] System Location Discovery

Current version: 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.716000+00:00	2026-09-11 19:39:19.101000+00:00

[T1124] System Time Discovery

Current version: 1.5

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.724000+00:00	2026-09-11 19:39:36.116000+00:00

[T1055.003] Process Injection: Thread Execution Hijacking

Current version: 2.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.629000+00:00	2026-09-11 19:43:31.571000+00:00

[T1584.003] Compromise Infrastructure: Virtual Private Server

Current version: 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.627000+00:00	2026-09-18 00:31:18.338000+00:00
external_references[4]['description']	ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved October 12, 2021.	ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved September 17, 2026.
external_references[4]['url']	https://threatconnect.com/blog/infrastructure-research-hunting/	https://web.archive.org/web/20221130114004/https://threatconnect.com/blog/infrastructure-research-hunting/

[T1583.003] Acquire Infrastructure: Virtual Private Server

Current version: 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.643000+00:00	2026-09-18 00:31:18.339000+00:00
external_references[4]['description']	ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved October 12, 2021.	ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved September 17, 2026.
external_references[4]['url']	https://threatconnect.com/blog/infrastructure-research-hunting/	https://web.archive.org/web/20221130114004/https://threatconnect.com/blog/infrastructure-research-hunting/

[T1497] Virtualization/Sandbox Evasion

Current version: 2.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.672000+00:00	2026-09-11 19:27:14.200000+00:00

[T1071.001] Application Layer Protocol: Web Protocols

Current version: 1.5

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.722000+00:00	2026-09-11 19:29:05.359000+00:00
external_references[2]['description']	Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.	Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved September 3, 2026.
external_references[2]['url']	https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf	https://arxiv.org/pdf/1408.1136

[T1102] Web Service

Current version: 1.3

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.672000+00:00	2026-09-03 19:46:46.483000+00:00
external_references[2]['description']	Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.	Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved September 3, 2026.
external_references[2]['url']	https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf	https://arxiv.org/pdf/1408.1136

[T1583.006] Acquire Infrastructure: Web Services

Current version: 1.3

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.694000+00:00	2026-09-18 00:31:18.339000+00:00
external_references[3]['description']	ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved October 12, 2021.	ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved September 17, 2026.
external_references[3]['url']	https://threatconnect.com/blog/infrastructure-research-hunting/	https://web.archive.org/web/20221130114004/https://threatconnect.com/blog/infrastructure-research-hunting/

[T1584.006] Compromise Infrastructure: Web Services

Current version: 1.2

Details

values_changed
STIX Field	Old value	New Value
modified	2025-10-24 17:49:13.641000+00:00	2026-09-18 00:31:18.340000+00:00
external_references[2]['description']	ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved October 12, 2021.	ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved September 17, 2026.
external_references[2]['url']	https://threatconnect.com/blog/infrastructure-research-hunting/	https://web.archive.org/web/20221130114004/https://threatconnect.com/blog/infrastructure-research-hunting/
x_mitre_attack_spec_version	3.2.0	3.3.0

[T1222.001] File and Directory Permissions Modification: Windows Permissions

Current version: 2.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.625000+00:00	2026-09-11 19:58:37.542000+00:00

mobile-attack

Major Version Changes

[T1476] Deliver Malicious Application via Other Means

Current version: 2.0

Version changed from: 1.2 → 2.0

	Old Description			New Description
t	1	Malicious applications are a common attack vector used by ad	t	1	Adversaries may direct victims to download malicious applica
	>	versaries to gain a presence on mobile devices. This techniq		>	tions via ways that avoid an authorized application store (e
	>	ue describes installing a malicious application on targeted		>	.g. Google Play Store or Apple App Store). For example, vict
	>	mobile devices without involving an authorized app store (e.		>	ims may be directed to downloading a malicious APK directly
	>	g., Google Play Store or Apple App Store). Adversaries may w		>	from a domain. Adversaries may wish to avoid placing malici
	>	ish to avoid placing malicious applications in an authorized		>	ous applications in an authorized application store due to i
	>	app store due to increased potential risk of detection or o		>	ncreased potential risk of detection or other reasons. Deli
	>	ther reasons. However, mobile devices often are configured t		>	very methods for malicious applications include: * Spearphi
	>	o allow application installation only from an authorized app		>	shing Attachment: including the mobile application package a
	>	store which would prevent this technique from working. Del		>	s an attachment to an email * Spearphishing Link: including
	>	ivery methods for the malicious application include: * [Spe		>	a link to the mobile application package within an email, te
	>	arphishing Attachment](https://attack.mitre.org/techniques/T		>	xt message (e.g. SMS, iMessage, WhatsApp, etc.), web site, Q
	>	1566/001) - Including the mobile app package as an attachmen		>	R code, or other means. * Third-Party Application Store: ins
	>	t to an email message. * [Spearphishing Link](https://attack		>	talling the mobile application package from a third-party ap
	>	.mitre.org/techniques/T1566/002) - Including a link to the m		>	plication store, as opposed to an authorized app store that
	>	obile app package within an email, text message (e.g. SMS, i		>	the device implicitly trusts as part of its default behavior
	>	Message, Hangouts, WhatsApp, etc.), web site, QR code, or ot		>	. Third-party application stores may not apply the same leve
	>	her means. * Third-Party App Store - Installed from a third-		>	l of scrutiny to applications as enforced by an authorized a
	>	party app store (as opposed to an authorized app store that		>	pplication store.(Citation: IBTimes-ThirdParty)(Citation: Tr
	>	the device implicitly trusts as part of its default behavior		>	endMicro-RootingMalware)(Citation: TrendMicro-FlappyBird)
	>	), which may not apply the same level of scrutiny to apps as		>	Some Android malware comes with functionality to install add
	>	applied by an authorized app store.(Citation: IBTimes-Third		>	itional applications, either automatically or when the adver
	>	Party)(Citation: TrendMicro-RootingMalware)(Citation: TrendM		>	sary instructs it to.(Citation: android-trojan-steals-paypal
	>	icro-FlappyBird) Some Android malware comes with functional		>	-2fa)
	>	ity to install additional applications, either automatically
	>	or when the adversary instructs it to.(Citation: android-tr
	>	ojan-steals-paypal-2fa)

Details

values_changed
STIX Field	Old value	New Value
modified	2025-10-24 17:48:47.664000+00:00	2026-09-03 14:38:12.546000+00:00
name	Deliver Malicious App via Other Means	Deliver Malicious Application via Other Means
description	Malicious applications are a common attack vector used by adversaries to gain a presence on mobile devices. This technique describes installing a malicious application on targeted mobile devices without involving an authorized app store (e.g., Google Play Store or Apple App Store). Adversaries may wish to avoid placing malicious applications in an authorized app store due to increased potential risk of detection or other reasons. However, mobile devices often are configured to allow application installation only from an authorized app store which would prevent this technique from working. Delivery methods for the malicious application include: * [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001) - Including the mobile app package as an attachment to an email message. * [Spearphishing Link](https://attack.mitre.org/techniques/T1566/002) - Including a link to the mobile app package within an email, text message (e.g. SMS, iMessage, Hangouts, WhatsApp, etc.), web site, QR code, or other means. * Third-Party App Store - Installed from a third-party app store (as opposed to an authorized app store that the device implicitly trusts as part of its default behavior), which may not apply the same level of scrutiny to apps as applied by an authorized app store.(Citation: IBTimes-ThirdParty)(Citation: TrendMicro-RootingMalware)(Citation: TrendMicro-FlappyBird) Some Android malware comes with functionality to install additional applications, either automatically or when the adversary instructs it to.(Citation: android-trojan-steals-paypal-2fa)	Adversaries may direct victims to download malicious applications via ways that avoid an authorized application store (e.g. Google Play Store or Apple App Store). For example, victims may be directed to downloading a malicious APK directly from a domain. Adversaries may wish to avoid placing malicious applications in an authorized application store due to increased potential risk of detection or other reasons. Delivery methods for malicious applications include: * Spearphishing Attachment: including the mobile application package as an attachment to an email * Spearphishing Link: including a link to the mobile application package within an email, text message (e.g. SMS, iMessage, WhatsApp, etc.), web site, QR code, or other means. * Third-Party Application Store: installing the mobile application package from a third-party application store, as opposed to an authorized app store that the device implicitly trusts as part of its default behavior. Third-party application stores may not apply the same level of scrutiny to applications as enforced by an authorized application store.(Citation: IBTimes-ThirdParty)(Citation: TrendMicro-RootingMalware)(Citation: TrendMicro-FlappyBird) Some Android malware comes with functionality to install additional applications, either automatically or when the adversary instructs it to.(Citation: android-trojan-steals-paypal-2fa)
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_deprecated	True	False
x_mitre_version	1.2	2.0

Patches

[T1521.002] Encrypted Channel: Asymmetric Cryptography

Current version: 1.0

Details

dictionary_item_added
STIX Field	Old value	New Value
created_by_ref		identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5

values_changed
STIX Field	Old value	New Value
modified	2025-10-24 17:48:26.898000+00:00	2026-10-13 14:29:13.671000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0

ics-attack

New Techniques

[T1701] Command and Scripting Interpreter

Current version: 1.0

Description:

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms within industrial control system environments. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell. Some also have cross-platform interpreters such as Python, as well as those commonly associated with client applications such as JavaScript and Visual Basic. Many controllers have command-line interfaces for management purposes.

Adversaries may abuse these technologies in various ways as a means of executing arbitrary commands. Commands and scripts can be embedded in Initial Access payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2. Adversaries may also execute commands through interactive terminals/shells, as well as utilize various Remote Services (e.g., Telnet, SSH, RDP, etc.) often found in industrial control system environments to achieve remote Execution.(Citation: Powershell Remote Commands)(Citation: Cisco IOS Software Integrity Assurance - Command History)(Citation: Remote Shell Execution in Python)

Current version: 1.0

Description:

Adversaries may communicate using publish/subscribe (pub/sub) application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and broker.

Current version: 1.0

Description:

Adversaries may abuse the Windows command shell for execution. The Windows command shell (cmd) is the primary command prompt on Windows systems which is used in industrial control system environments. The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands. The command prompt can be invoked remotely via Remote Services (e.g., Telnet, SSH, RDP, etc.)

Batch files (ex: .bat or .cmd) also provide the shell with a list of sequential commands to run, as well as normal scripting operations such as conditionals and loops. Common uses of batch files include long or repetitive tasks, or the need to run the same set of commands on multiple systems.

Adversaries may leverage cmd to execute various commands and payloads. Common uses include cmd to execute a single command, or abusing cmd interactively with input and output forwarded over a command and control channel.

Within industrial control system networks, adversaries may abuse the use of Windows Command Shell on overlap assets that run on Microsoft Windows operating systems (Workstations, Data Historians, Human Machine Interfaces, Application Servers, Jump Hosts, etc.).

Major Version Changes

[T1692.001] Unauthorized Message: Command Message

Current version: 2.0

Version changed from: 1.0 → 2.0

	Old Description			New Description
t	1	Adversaries may send unauthorized command messages to instru	t	1	Adversaries may send unauthorized command messages to instru
	>	ct control system assets to perform actions outside of their		>	ct control system assets to perform actions outside of their
	>	intended functionality, or without the logical precondition		>	intended functionality, or without the logical precondition
	>	s to trigger their expected function. Command messages are u		>	s to trigger their expected function. Command messages are u
	>	sed in ICS networks to give direct instructions to control s		>	sed in ICS networks to give direct instructions to control s
	>	ystems devices. If an adversary can send an unauthorized com		>	ystems devices. If an adversary can send an unauthorized com
	>	mand message to a control system, then it can instruct the c		>	mand message to a control system, then it can instruct the c
	>	ontrol systems device to perform an action outside the norma		>	ontrol systems device to perform an action outside the norma
	>	l bounds of the device's actions. An adversary could potenti		>	l bounds of the device's actions. An adversary could potenti
	>	ally instruct a control systems device to perform an action		>	ally instruct a control systems device to perform an action
	>	that will cause an [Impact](https://attack.mitre.org/tactics		>	that will cause an [Impact](https://attack.mitre.org/tactics
	>	/TA0105).(Citation: Bonnie Zhu, Anthony Joseph, Shankar Sast		>	/TA0105).(Citation: Bonnie Zhu, Anthony Joseph, Shankar Sast
	>	ry 2011) In the Dallas Siren incident, adversaries were abl		>	ry 2011). An adversary could also misuse control system devi
	>	e to send command messages to activate tornado alarm systems		>	ces to store data collected from the network for later use.
	>	across the city without an impending tornado or other disas		>	In the Dallas Siren incident, adversaries were able to send
	>	ter.(Citation: Zack Whittaker April 2017)(Citation: Benjamin		>	command messages to activate tornado alarm systems across t
	>	Freed March 2019)		>	he city without an impending tornado or other disaster.(Cita
				>	tion: Zack Whittaker April 2017)(Citation: Benjamin Freed Ma
				>	rch 2019)

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_platforms		['Embedded', 'Windows', 'Linux']

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.629000+00:00	2026-10-13 17:48:51.581000+00:00
description	Adversaries may send unauthorized command messages to instruct control system assets to perform actions outside of their intended functionality, or without the logical preconditions to trigger their expected function. Command messages are used in ICS networks to give direct instructions to control systems devices. If an adversary can send an unauthorized command message to a control system, then it can instruct the control systems device to perform an action outside the normal bounds of the device's actions. An adversary could potentially instruct a control systems device to perform an action that will cause an [Impact](https://attack.mitre.org/tactics/TA0105).(Citation: Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011) In the Dallas Siren incident, adversaries were able to send command messages to activate tornado alarm systems across the city without an impending tornado or other disaster.(Citation: Zack Whittaker April 2017)(Citation: Benjamin Freed March 2019)	Adversaries may send unauthorized command messages to instruct control system assets to perform actions outside of their intended functionality, or without the logical preconditions to trigger their expected function. Command messages are used in ICS networks to give direct instructions to control systems devices. If an adversary can send an unauthorized command message to a control system, then it can instruct the control systems device to perform an action outside the normal bounds of the device's actions. An adversary could potentially instruct a control systems device to perform an action that will cause an [Impact](https://attack.mitre.org/tactics/TA0105).(Citation: Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011). An adversary could also misuse control system devices to store data collected from the network for later use. In the Dallas Siren incident, adversaries were able to send command messages to activate tornado alarm systems across the city without an impending tornado or other disaster.(Citation: Zack Whittaker April 2017)(Citation: Benjamin Freed March 2019)
x_mitre_version	1.0	2.0

Patches

[T0800] Activate Firmware Update Mode

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.622000+00:00	2026-10-13 17:48:54.157000+00:00
x_mitre_platforms[0]	None	Embedded

iterable_item_added
STIX Field	Old value	New Value
x_mitre_platforms		Windows
x_mitre_platforms		Linux
x_mitre_platforms		Network Devices

[T0830] Adversary-in-the-Middle

Current version: 2.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:26:16.777000+00:00	2026-10-13 17:48:43.971000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_platforms[0]	None	Embedded

iterable_item_added
STIX Field	Old value	New Value
x_mitre_platforms		Windows
x_mitre_platforms		Linux
x_mitre_platforms		Network Devices

[T0878] Alarm Suppression

Current version: 1.2

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:26:11.789000+00:00	2026-10-13 17:48:35.149000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_platforms[0]	None	Embedded

iterable_item_added
STIX Field	Old value	New Value
x_mitre_platforms		Windows
x_mitre_platforms		Linux
x_mitre_platforms		Network Devices

[T0802] Automated Collection

Current version: 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:24.843000+00:00	2026-10-13 17:48:36.361000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_platforms[0]	None	Embedded

iterable_item_added
STIX Field	Old value	New Value
x_mitre_platforms		Windows
x_mitre_platforms		Linux

[T0895] Autorun Image

Current version: 1.0

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_platforms		['Embedded', 'Windows', 'Linux']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:42.824000+00:00	2026-10-13 17:48:39.943000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0

[T1695] Block Communications

Current version: 1.0

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_platforms		['Embedded', 'Windows', 'Linux', 'Network Devices']

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.726000+00:00	2026-10-13 17:48:58.081000+00:00

[T1691] Block Operational Technology Message

Current version: 1.0

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_platforms		['Embedded', 'Windows', 'Linux']

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.624000+00:00	2026-10-13 17:48:55.761000+00:00

[T0846.002] Remote System Discovery: Broadcast Discovery

Current version: 1.0

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_platforms		['Embedded', 'Windows', 'Linux', 'Network Devices']

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.714000+00:00	2026-10-13 17:48:57.430000+00:00

[T0806] Brute Force I/O

Current version: 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:26:16.573000+00:00	2026-10-13 17:48:36.943000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_platforms[0]	None	Embedded

iterable_item_added
STIX Field	Old value	New Value
x_mitre_platforms		Windows
x_mitre_platforms		Linux

[T0892] Change Credential

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.726000+00:00	2026-10-13 17:48:45.931000+00:00
x_mitre_platforms[0]	None	Embedded

iterable_item_added
STIX Field	Old value	New Value
x_mitre_platforms		Windows
x_mitre_platforms		Linux
x_mitre_platforms		Network Devices

[T0858] Change Operating Mode

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.623000+00:00	2026-10-13 17:48:42.391000+00:00
x_mitre_platforms[0]	None	Embedded

[T1691.001] Block Operational Technology Message: Command Message

Current version: 1.0

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_platforms		['Embedded', 'Windows', 'Linux']

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.621000+00:00	2026-10-13 17:48:49.021000+00:00

[T0885] Commonly Used Port

Current version: 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.723000+00:00	2026-10-13 17:48:36.649000+00:00
x_mitre_platforms[0]	None	Embedded

iterable_item_added
STIX Field	Old value	New Value
x_mitre_platforms		Windows
x_mitre_platforms		Linux
x_mitre_platforms		Network Devices

[T0884] Connection Proxy

Current version: 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:26:19.127000+00:00	2026-10-13 17:48:43.335000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_platforms[0]	None	Embedded

iterable_item_added
STIX Field	Old value	New Value
x_mitre_platforms		Windows
x_mitre_platforms		Linux
x_mitre_platforms		Network Devices

[T0809] Data Destruction

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.630000+00:00	2026-10-13 17:48:43.027000+00:00
x_mitre_platforms[0]	None	Embedded

iterable_item_added
STIX Field	Old value	New Value
x_mitre_platforms		Windows
x_mitre_platforms		Linux
x_mitre_platforms		Network Devices

[T0811] Data from Information Repositories

Current version: 1.2

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:26:13.205000+00:00	2026-10-13 17:48:42.082000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_platforms[0]	None	Embedded

iterable_item_added
STIX Field	Old value	New Value
x_mitre_platforms		Windows
x_mitre_platforms		Linux

[T0893] Data from Local System

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:23.577000+00:00	2026-10-13 17:48:40.258000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_platforms[0]	None	Embedded

iterable_item_added
STIX Field	Old value	New Value
x_mitre_platforms		Windows
x_mitre_platforms		Linux
x_mitre_platforms		Network Devices

[T1694.001] Insecure Credentials: Default Credentials

Current version: 1.0

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_platforms		['Embedded', 'Windows', 'Linux', 'Network Devices']

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.634000+00:00	2026-10-13 17:48:42.708000+00:00

[T0814] Denial of Service

Current version: 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:10.656000+00:00	2026-10-13 17:48:33.649000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_platforms[0]	None	Embedded

iterable_item_added
STIX Field	Old value	New Value
x_mitre_platforms		Windows
x_mitre_platforms		Linux
x_mitre_platforms		Network Devices

[T0868] Detect Operating Mode

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:26:11.972000+00:00	2026-10-13 17:48:45.236000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_platforms[0]	None	Embedded

[T0816] Device Restart/Shutdown

Current version: 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.623000+00:00	2026-10-13 17:48:53.838000+00:00
x_mitre_platforms[0]	None	Embedded

iterable_item_added
STIX Field	Old value	New Value
x_mitre_platforms		Windows
x_mitre_platforms		Linux
x_mitre_platforms		Network Devices

[T0843.001] Program Download: Download All

Current version: 1.0

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_platforms		['Embedded']

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.642000+00:00	2026-10-13 17:48:59.072000+00:00

[T0817] Drive-by Compromise

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:26:15.525000+00:00	2026-10-13 17:48:48.399000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_platforms[0]	None	Windows

iterable_item_added
STIX Field	Old value	New Value
x_mitre_platforms		Linux

[T1695.002] Block Communications: Ethernet

Current version: 1.0

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_platforms		['Embedded', 'Windows', 'Linux', 'Network Devices']

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.635000+00:00	2026-10-13 17:48:58.412000+00:00

[T0871] Execution through API

Current version: 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:26:14.643000+00:00	2026-10-13 17:48:38.469000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_platforms[0]	None	Embedded

iterable_item_added
STIX Field	Old value	New Value
x_mitre_platforms		Windows
x_mitre_platforms		Linux
x_mitre_platforms		Network Devices

[T0819] Exploit Public-Facing Application

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:26:13.044000+00:00	2026-10-13 17:48:37.841000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_platforms[0]	None	Embedded

iterable_item_added
STIX Field	Old value	New Value
x_mitre_platforms		Windows
x_mitre_platforms		Linux
x_mitre_platforms		Network Devices

[T0820] Exploitation for Evasion

Current version: 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:26:16.960000+00:00	2026-10-13 17:48:51.921000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_platforms[0]	None	Embedded

iterable_item_added
STIX Field	Old value	New Value
x_mitre_platforms		Windows
x_mitre_platforms		Linux
x_mitre_platforms		Network Devices

[T0890] Exploitation for Privilege Escalation

Current version: 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:26:18.792000+00:00	2026-10-13 17:48:37.232000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_platforms[0]	None	Embedded

iterable_item_added
STIX Field	Old value	New Value
x_mitre_platforms		Windows
x_mitre_platforms		Linux
x_mitre_platforms		Network Devices

[T0866] Exploitation of Remote Services

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:26:16.054000+00:00	2026-10-13 17:48:44.918000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_platforms[0]	None	Embedded

iterable_item_added
STIX Field	Old value	New Value
x_mitre_platforms		Windows
x_mitre_platforms		Linux
x_mitre_platforms		Network Devices

[T0822] External Remote Services

Current version: 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.705000+00:00	2026-10-13 17:48:54.492000+00:00
x_mitre_platforms[0]	None	Embedded

iterable_item_added
STIX Field	Old value	New Value
x_mitre_platforms		Windows
x_mitre_platforms		Linux
x_mitre_platforms		Network Devices

[T0823] Graphical User Interface

Current version: 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.707000+00:00	2026-10-13 17:48:46.244000+00:00
x_mitre_platforms[0]	None	Embedded

iterable_item_added
STIX Field	Old value	New Value
x_mitre_platforms		Windows
x_mitre_platforms		Linux
x_mitre_platforms		Network Devices

[T1694.002] Insecure Credentials: Hardcoded Credentials

Current version: 1.0

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_platforms		['Embedded']

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.640000+00:00	2026-10-13 17:48:52.885000+00:00

[T0874] Hooking

Current version: 1.2

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:56.978000+00:00	2026-10-13 17:48:33.137000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_platforms[0]	None	Embedded

iterable_item_added
STIX Field	Old value	New Value
x_mitre_platforms		Windows
x_mitre_platforms		Linux
x_mitre_platforms		Network Devices

[T0877] I/O Image

Current version: 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:26:14.462000+00:00	2026-10-13 17:48:46.862000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_platforms[0]	None	Embedded

[T0872] Indicator Removal on Host

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 15:16:47.841000+00:00	2026-10-13 17:48:40.569000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_platforms[0]	None	Embedded

iterable_item_added
STIX Field	Old value	New Value
x_mitre_platforms		Windows
x_mitre_platforms		Linux
x_mitre_platforms		Network Devices

[T1694] Insecure Credentials

Current version: 1.0

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_platforms		['Embedded', 'Windows', 'Linux', 'Network Devices']

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.628000+00:00	2026-10-13 17:48:56.454000+00:00

[T0883] Internet Accessible Device

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:26:20.494000+00:00	2026-10-13 17:48:52.237000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_platforms[0]	None	Embedded

iterable_item_added
STIX Field	Old value	New Value
x_mitre_platforms		Windows
x_mitre_platforms		Linux
x_mitre_platforms		Network Devices

[T0867] Lateral Tool Transfer

Current version: 1.1

	Old Description			New Description
t	1	Adversaries may transfer tools or other files from one syste	t	1	Adversaries may transfer tools or other files from one syste
	>	m to another to stage adversary tools or other files over th		>	m to another to stage adversary tools or other files over th
	>	e course of an operation. (Citation: Enterprise ATT&CK) Copy		>	e course of an operation.(Citation: Enterprise ATT&CK) Copyi
	>	ing of files may also be performed laterally between interna		>	ng of files may also be performed laterally between internal
	>	l victim systems to support Lateral Movement with remote Exe		>	victim systems to support Lateral Movement with remote Exec
	>	cution using inherent file sharing protocols such as file sh		>	ution using inherent file sharing protocols such as file sha
	>	aring over SMB to connected network shares. (Citation: Enter		>	ring over SMB to connected network shares.(Citation: Enterpr
	>	prise ATT&CK) In control systems environments, malware may		>	ise ATT&CK) In control systems environments, malware may us
	>	use SMB and other file sharing protocols to move laterally t		>	e SMB and other file sharing protocols to move laterally thr
	>	hrough industrial networks.		>	ough industrial networks.

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:26:20.126000+00:00	2026-10-13 17:48:39.341000+00:00
description	Adversaries may transfer tools or other files from one system to another to stage adversary tools or other files over the course of an operation. (Citation: Enterprise ATT&CK) Copying of files may also be performed laterally between internal victim systems to support Lateral Movement with remote Execution using inherent file sharing protocols such as file sharing over SMB to connected network shares. (Citation: Enterprise ATT&CK) In control systems environments, malware may use SMB and other file sharing protocols to move laterally through industrial networks.	Adversaries may transfer tools or other files from one system to another to stage adversary tools or other files over the course of an operation.(Citation: Enterprise ATT&CK) Copying of files may also be performed laterally between internal victim systems to support Lateral Movement with remote Execution using inherent file sharing protocols such as file sharing over SMB to connected network shares.(Citation: Enterprise ATT&CK) In control systems environments, malware may use SMB and other file sharing protocols to move laterally through industrial networks.
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_platforms[0]	None	Embedded

iterable_item_added
STIX Field	Old value	New Value
x_mitre_platforms		Windows
x_mitre_platforms		Linux

[T0835] Manipulate I/O Image

Current version: 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:22.225000+00:00	2026-10-13 17:48:46.553000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_platforms[0]	None	Embedded

[T0849] Masquerading

Current version: 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:26:18.036000+00:00	2026-10-13 17:48:34.261000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_platforms[0]	None	Embedded

iterable_item_added
STIX Field	Old value	New Value
x_mitre_platforms		Windows
x_mitre_platforms		Linux
x_mitre_platforms		Network Devices

[T0838] Modify Alarm Settings

Current version: 1.2

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.723000+00:00	2026-10-13 17:48:47.496000+00:00
x_mitre_platforms[0]	None	Embedded

iterable_item_added
STIX Field	Old value	New Value
x_mitre_platforms		Windows
x_mitre_platforms		Linux
x_mitre_platforms		Network Devices

[T0821] Modify Controller Tasking

Current version: 1.2

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:26:10.230000+00:00	2026-10-13 17:48:38.152000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_platforms[0]	None	Embedded

[T1693] Modify Firmware

Current version: 1.0

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_platforms		['Embedded']

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.643000+00:00	2026-10-13 17:48:56.116000+00:00

[T0836] Modify Parameter

Current version: 1.3

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:26:10.077000+00:00	2026-10-13 17:48:47.174000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_platforms[0]	None	Embedded

iterable_item_added
STIX Field	Old value	New Value
x_mitre_platforms		Windows
x_mitre_platforms		Linux

[T0889] Modify Program

Current version: 1.2

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:24.213000+00:00	2026-10-13 17:48:48.701000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_platforms[0]	None	Embedded

[T1693.002] Modify Firmware: Module Firmware

Current version: 1.0

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_platforms		['Embedded']

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.642000+00:00	2026-10-13 17:48:50.273000+00:00

[T0801] Monitor Process State

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 15:16:45.982000+00:00	2026-10-13 17:48:34.856000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_platforms[0]	None	Embedded

iterable_item_added
STIX Field	Old value	New Value
x_mitre_platforms		Windows
x_mitre_platforms		Linux
x_mitre_platforms		Network Devices

[T0846.003] Remote System Discovery: Multicast Discovery

Current version: 1.0

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_platforms		['Embedded', 'Windows', 'Linux', 'Network Devices']

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.636000+00:00	2026-10-13 17:48:57.756000+00:00

[T0834] Native API

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:26:17.499000+00:00	2026-10-13 17:48:41.765000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_platforms[0]	None	Embedded

iterable_item_added
STIX Field	Old value	New Value
x_mitre_platforms		Windows
x_mitre_platforms		Linux
x_mitre_platforms		Network Devices

[T0840] Network Connection Enumeration

Current version: 1.2

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.723000+00:00	2026-10-13 17:48:45.539000+00:00
x_mitre_platforms[0]	None	Embedded

iterable_item_added
STIX Field	Old value	New Value
x_mitre_platforms		Windows
x_mitre_platforms		Linux
x_mitre_platforms		Network Devices

[T0842] Network Sniffing

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:26:13.380000+00:00	2026-10-13 17:48:53.525000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_platforms[0]	None	Embedded

iterable_item_added
STIX Field	Old value	New Value
x_mitre_platforms		Windows
x_mitre_platforms		Linux
x_mitre_platforms		Network Devices

[T0843.002] Program Download: Online Edit

Current version: 1.0

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_platforms		['Embedded']

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.721000+00:00	2026-10-13 17:48:59.738000+00:00

[T0861] Point & Tag Identification

Current version: 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:26:11.231000+00:00	2026-10-13 17:48:49.639000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_platforms[0]	None	Embedded

iterable_item_added
STIX Field	Old value	New Value
x_mitre_platforms		Windows
x_mitre_platforms		Linux
x_mitre_platforms		Network Devices

[T0846.001] Remote System Discovery: Port Scan

Current version: 1.0

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_platforms		['Embedded', 'Windows', 'Linux', 'Network Devices']

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.635000+00:00	2026-10-13 17:48:57.097000+00:00

[T0843.003] Program Download: Program Append

Current version: 1.0

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_platforms		['Embedded']

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.634000+00:00	2026-10-13 17:48:59.405000+00:00

[T0843] Program Download

Current version: 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.713000+00:00	2026-10-13 17:48:41.446000+00:00
x_mitre_platforms[0]	None	Embedded

[T0845] Program Upload

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 15:16:46.293000+00:00	2026-10-13 17:48:43.645000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_platforms[0]	None	Embedded

[T0873] Project File Infection

Current version: 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.723000+00:00	2026-10-13 17:48:44.597000+00:00
x_mitre_platforms[0]	None	Windows

iterable_item_added
STIX Field	Old value	New Value
x_mitre_platforms		Linux

[T0886] Remote Services

Current version: 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.722000+00:00	2026-10-13 17:48:54.826000+00:00
x_mitre_platforms[0]	None	Embedded

iterable_item_added
STIX Field	Old value	New Value
x_mitre_platforms		Windows
x_mitre_platforms		Linux
x_mitre_platforms		Network Devices

[T0846] Remote System Discovery

Current version: 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.718000+00:00	2026-10-13 17:48:37.554000+00:00
x_mitre_platforms[0]	None	Embedded

iterable_item_added
STIX Field	Old value	New Value
x_mitre_platforms		Windows
x_mitre_platforms		Linux
x_mitre_platforms		Network Devices

[T0888] Remote System Information Discovery

Current version: 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.624000+00:00	2026-10-13 17:48:49.322000+00:00
x_mitre_platforms[0]	None	Embedded

iterable_item_added
STIX Field	Old value	New Value
x_mitre_platforms		Windows
x_mitre_platforms		Linux
x_mitre_platforms		Network Devices

[T0847] Replication Through Removable Media

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:04.946000+00:00	2026-10-13 17:48:36.055000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_platforms[0]	None	Embedded

iterable_item_added
STIX Field	Old value	New Value
x_mitre_platforms		Windows
x_mitre_platforms		Linux
x_mitre_platforms		Network Devices

[T1692.002] Unauthorized Message: Reporting Message

Current version: 1.0

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_platforms		['Embedded', 'Windows', 'Linux', 'Network Devices']

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.633000+00:00	2026-10-13 17:48:39.649000+00:00

[T1691.002] Block Operational Technology Message: Reporting Message

Current version: 1.0

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_platforms		['Embedded', 'Windows', 'Linux', 'Network Devices']

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.643000+00:00	2026-10-13 17:48:49.952000+00:00

[T0848] Rogue Master

Current version: 1.2

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:26:17.326000+00:00	2026-10-13 17:48:50.906000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_platforms[0]	None	Embedded

iterable_item_added
STIX Field	Old value	New Value
x_mitre_platforms		Windows
x_mitre_platforms		Linux
x_mitre_platforms		Network Devices

[T0851] Rootkit

Current version: 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:26:13.542000+00:00	2026-10-13 17:48:47.792000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_platforms[0]	None	Embedded

iterable_item_added
STIX Field	Old value	New Value
x_mitre_platforms		Windows
x_mitre_platforms		Linux
x_mitre_platforms		Network Devices

[T0852] Screen Capture

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.715000+00:00	2026-10-13 17:48:40.879000+00:00
x_mitre_platforms[0]	None	Embedded

iterable_item_added
STIX Field	Old value	New Value
x_mitre_platforms		Windows
x_mitre_platforms		Linux

[T1695.001] Block Communications: Serial COM

Current version: 1.0

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_platforms		['Embedded', 'Windows', 'Linux', 'Network Devices']

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.634000+00:00	2026-10-13 17:48:52.564000+00:00

[T0881] Service Stop

Current version: 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:03.170000+00:00	2026-10-13 17:48:44.278000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_platforms[0]	None	Embedded

iterable_item_added
STIX Field	Old value	New Value
x_mitre_platforms		Windows
x_mitre_platforms		Linux
x_mitre_platforms		Network Devices

[T0873.001] Project File Infection: Siemens Project File Format

Current version: 1.0

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_platforms		['Windows', 'Linux']

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.625000+00:00	2026-10-13 17:48:56.775000+00:00

[T0865] Spearphishing Attachment

Current version: 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:26:15.346000+00:00	2026-10-13 17:48:48.102000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_platforms[0]	None	Embedded

iterable_item_added
STIX Field	Old value	New Value
x_mitre_platforms		Windows
x_mitre_platforms		Linux

[T0869] Standard Application Layer Protocol

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 15:16:52.173000+00:00	2026-10-13 17:48:53.199000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_platforms[0]	None	Embedded

iterable_item_added
STIX Field	Old value	New Value
x_mitre_platforms		Windows
x_mitre_platforms		Linux
x_mitre_platforms		Network Devices

[T0862] Supply Chain Compromise

Current version: 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:26:14.822000+00:00	2026-10-13 17:48:35.442000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_platforms[0]	None	Embedded

iterable_item_added
STIX Field	Old value	New Value
x_mitre_platforms		Windows
x_mitre_platforms		Linux
x_mitre_platforms		Network Devices

[T0894] System Binary Proxy Execution

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:11.559000+00:00	2026-10-13 17:48:51.235000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_platforms[0]	None	Embedded

iterable_item_added
STIX Field	Old value	New Value
x_mitre_platforms		Windows
x_mitre_platforms		Linux

[T1693.001] Modify Firmware: System Firmware

Current version: 1.0

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_platforms		['Embedded', 'Windows', 'Linux', 'Network Devices']

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.639000+00:00	2026-10-13 17:48:35.752000+00:00

[T0864] Transient Cyber Asset

Current version: 1.2

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:21.226000+00:00	2026-10-13 17:48:39.050000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_platforms[0]	None	Windows

iterable_item_added
STIX Field	Old value	New Value
x_mitre_platforms		Linux

[T1692] Unauthorized Message

Current version: 1.0

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_platforms		['Embedded', 'Windows', 'Linux']

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.722000+00:00	2026-10-13 17:48:55.183000+00:00

[T0863] User Execution

Current version: 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:15.054000+00:00	2026-10-13 17:48:50.591000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_platforms[0]	None	Embedded

iterable_item_added
STIX Field	Old value	New Value
x_mitre_platforms		Windows
x_mitre_platforms		Linux

[T0859] Valid Accounts

Current version: 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.717000+00:00	2026-10-13 17:48:33.956000+00:00
x_mitre_platforms[0]	None	Embedded

iterable_item_added
STIX Field	Old value	New Value
x_mitre_platforms		Windows
x_mitre_platforms		Linux
x_mitre_platforms		Network Devices

[T1695.003] Block Communications: Wi-Fi

Current version: 1.0

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_platforms		['Embedded', 'Windows', 'Linux', 'Network Devices']

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.641000+00:00	2026-10-13 17:48:58.743000+00:00

[T0860] Wireless Compromise

Current version: 1.2

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:15.610000+00:00	2026-10-13 17:48:34.560000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_platforms[0]	None	Embedded

iterable_item_added
STIX Field	Old value	New Value
x_mitre_platforms		Windows
x_mitre_platforms		Linux

[T0887] Wireless Sniffing

Current version: 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:26:10.392000+00:00	2026-10-13 17:48:38.761000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_platforms[0]	None	Embedded

iterable_item_added
STIX Field	Old value	New Value
x_mitre_platforms		Windows
x_mitre_platforms		Linux

Deprecations

[T0807] Command-Line Interface

Current version: 1.1

Description:

Adversaries may utilize command-line interfaces (CLIs) to interact with systems and execute commands. CLIs provide a means of interacting with computer systems and are a common feature across many types of platforms and devices within control systems environments. (Citation: Enterprise ATT&CK January 2018) Adversaries may also use CLIs to install and run new software, including malicious tools that may be installed over the course of an operation.

CLIs are typically accessed locally, but can also be exposed via services, such as SSH, Telnet, and RDP. Commands that are executed in the CLI execute with the current permissions level of the process running the terminal emulator, unless the command specifies a change in permissions context. Many controllers have CLI interfaces for management purposes.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.623000+00:00	2026-10-07 16:50:33.026000+00:00
x_mitre_deprecated	False	True

[T0853] Scripting

Current version: 1.0

Description:

Adversaries may use scripting languages to execute arbitrary code in the form of a pre-written script or in the form of user-supplied code to an interpreter. Scripting languages are programming languages that differ from compiled languages, in that scripting languages use an interpreter, instead of a compiler. These interpreters read and compile part of the source code just before it is executed, as opposed to compilers, which compile each and every line of code to an executable file. Scripting allows software developers to run their code on any system where the interpreter exists. This way, they can distribute one package, instead of precompiling executables for many different systems. Scripting languages, such as Python, have their interpreters shipped as a default with many Linux distributions.

In addition to being a useful tool for developers and administrators, scripting language interpreters may be abused by the adversary to execute code in the target environment. Due to the nature of scripting languages, this allows for weaponized code to be deployed to a target easily, and leaves open the possibility of on-the-fly scripting to perform a task.

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:26:12.511000+00:00	2026-10-07 16:51:17.493000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_deprecated	False	True

Software

Description:

Vidar is a Windows infostealer that was first advertised in November 2018. Written in C++, Vidar collects PII, cryptocurrency wallets, documents and other data within the compromised machine. Version 2 of Vidar was published in October 2025, and has been used in numerous operations since its release. Vidar has been observed alongside other malware strains, including STOP/Djvu ransomware, Mina.exe (an XMRIG miner), and Clip1.exe (a Laplas Clipper sample).(Citation: Intrinsec_Vidar_April2026)(Citation: LevelBlue_Vidar_May2026)(Citation: CyberAus_Vidar_May2026)(Citation: Unit42_Vidar_July2026)(Citation: Cyfirma_Vidar_June2024)(Citation: Logpoint_StealerMalwareFamilies_2024)(Citation: CISA Scattered Spider Advisory November 2023)(Citation: QuorumCyber_Vidar_March2023)

Major Version Changes

[S0491] StrongPity

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

values_changed
STIX Field	Old value	New Value
modified	2024-04-10 23:47:16.416000+00:00	2026-09-03 14:50:23.272000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

iterable_item_added
STIX Field	Old value	New Value
x_mitre_domains		mobile-attack
x_mitre_platforms		Android

mobile-attack

New Software

[S9040] NGate

Current version: 1.0

Description:

NGate is an Android malware that was first seen in November 2023 targeting Czech banks and Polish banks. NGate uses Near Field Communication (NFC) to relay a victim’s debit card and banking information from the compromised Android device to the adversary’s device, ultimately resulting in fraudulent ATM withdrawals by the adversary. NGate uses the legitimate tool called NFCGate, developed by students at the Technical University of Darmstadt, Germany.(Citation: ESETStefankoOsmani_NGate_Aug2024)(Citation: CERTPL_NGate_Nov2025)

A new variant of NGate that abuses the legitimate application HandyPay, potentially with AI-generated code, has been observed targeting users in Brazil since at least November 2025. This variant is capable of performing NFC transfers like previous iterations with new functionality for capturing and exfiltrating the victim’s payment card PIN.(Citation: ESETStefanko_NGateVariant_Apr2026)

[S0491] StrongPity

Current version: 2.0

Description:

StrongPity is an information stealing malware used by PROMETHIUM.(Citation: Bitdefender StrongPity June 2020)(Citation: Talos Promethium June 2020)

Patches

[S0440] Agent Smith

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:40:35.302000+00:00	2026-09-02 18:53:38.236000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0

[S0304] Android/Chuli.A

Current version: 1.2

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:40:40.920000+00:00	2026-09-02 18:54:14.710000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0

[S0524] AndroidOS/MalLocker.B

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:40:32.960000+00:00	2026-09-02 18:47:59.508000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0

[S0422] Anubis

Current version: 1.3

Details

values_changed
STIX Field	Old value	New Value
modified	2024-09-25 15:03:05.100000+00:00	2026-09-02 18:52:07.416000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0

[S0540] Asacub

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:40:35.670000+00:00	2026-09-02 18:51:59.902000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0

[S0480] Cerberus

Current version: 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:40:13.502000+00:00	2026-09-02 18:56:22.541000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0

[S0522] Exobot

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2024-10-01 15:53:53.833000+00:00	2026-09-02 18:51:23.098000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0

[S0509] FakeSpy

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:40:30.790000+00:00	2026-09-02 18:49:41.603000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0

[S0421] GolfSpy

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:40:37.700000+00:00	2026-09-02 18:45:46.709000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0

[S0406] Gustuff

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:40:47.835000+00:00	2026-09-02 18:52:35.430000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0

[S0544] HenBox

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:40:36.765000+00:00	2026-09-02 18:52:25.311000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0

[S0303] MazarBOT

Current version: 1.0

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_aliases		['MazarBOT']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:40:28.053000+00:00	2026-09-02 18:46:09.489000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0

[S0399] Pallas

Current version: 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:40:38.069000+00:00	2026-09-02 18:45:53.804000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0

[S0539] Red Alert 2.0

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:40:29.878000+00:00	2026-09-02 18:49:02.748000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0

[S0326] RedDrop

Current version: 1.2

Details

values_changed
STIX Field	Old value	New Value
modified	2024-11-17 14:24:44.696000+00:00	2026-09-02 18:50:30.051000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0

[S0403] Riltok

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:40:37.303000+00:00	2026-09-02 18:45:23.832000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0

[S0411] Rotexy

Current version: 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:40:14.047000+00:00	2026-09-02 18:52:15.929000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0

[S0313] RuMMS

Current version: 1.0

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_aliases		['RuMMS']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:40:31.880000+00:00	2026-09-02 18:51:51.539000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0

[S0419] SimBad

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:40:46.008000+00:00	2026-09-02 18:45:15.834000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0

[S0558] Tiktok Pro

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:40:38.825000+00:00	2026-09-02 18:48:17.007000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0

[S0302] Twitoor

Current version: 2.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:40:24.958000+00:00	2026-09-02 18:48:06.810000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0

[S0418] ViceLeaker

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:40:30.243000+00:00	2026-09-02 18:49:49.431000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0

[S0506] ViperRAT

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:40:45.280000+00:00	2026-09-02 18:46:02.947000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0

[S0318] XLoader for Android

Current version: 2.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:40:19.697000+00:00	2026-09-02 18:49:59.421000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0

[S0490] XLoader for iOS

Current version: 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:40:20.425000+00:00	2026-09-02 18:51:30.601000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0

[S0311] YiSpecter

Current version: 2.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:22:11.527000+00:00	2026-09-02 18:50:10.802000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0

[S0287] ZergHelper

Current version: 1.0

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_aliases		['ZergHelper']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:40:24.224000+00:00	2026-09-02 18:45:40.016000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0

[S0507] eSurv

Current version: 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2024-03-29 15:07:58.675000+00:00	2026-09-02 18:49:25.337000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0

ics-attack

New Software

[S9045] BACKUPOSINT v9.0 APEX PREDATOR

Current version: 1.0

Description:

[S9046] IOControl

Current version: 1.0

Description:

Groups

enterprise-attack

New Groups

[G1059] NIMBUS MANTICORE

Current version: 1.0

Description:

NIMBUS MANTICORE is a State Sponsored cyber espionage group associated with the Iranian Regime specifically the Iranian Revolutionary Guard Corps (IRGC). NIMBUS MANTICORE has employed social engineering attacks to include HR related themes and has leveraged custom malware against its victims. NIMBUS MANTICORE has sought sensitive information in victims’ environments to include network/IT documentation, intellectual property and emails. NIMBUS MANTICORE has also leveraged compromised organizations as pivot points to access other organizations of interest. NIMBUS MANTICORE has been active since 2021 and has targeted critical infrastructure organizations to include aviation, aerospace, telecommunications and defense and information technology related organizations within the United States, Australia, Midde East and Europe.(Citation: Mandiant_UNC1549TTPsTools_Nov2025)(Citation: CheckPoint_NimbusManticore_May2026)(Citation: CheckPoint_NimbusManticoreEurope_Sept2025)(Citation: Mandiant_UNC1549_Feb2024)

[G1058] The Gentlemen

Current version: 1.0

Description:

The Gentlemen is a group that maintains the The Gentlemen Ransomware-as-a-service (RaaS). The Gentlemen was first observed in mid-2025 who had posed The Gentlemen Ransomware as a closed ransomware and shortly later opened the ransomware as a RaaS to affiliates in September 2025. The Gentlemen has been affiliated with the threat group Storm-2697 and GOLD SHERWOOD.(Citation: MSTI_GentelmenRansomware_May2026)(Citation: Intel471_TheGentlemen_Aug2026)(Citation: Sophos_TheGentlemen_Sept2026)(Citation: SoučekESET_Gentlemen_Jun2026)(Citation: CheckPointResearch_TheGentlemen_April2026)(Citation: BradyUnit42_TheGentlemen_July2026)(Citation: CarveyODonnellWelchHuntress_TheGentlemen_May2026)(Citation: TrendAI_TheGentlemen_Sept2025)

Major Version Changes

[G0082] APT38

Current version: 4.0

Version changed from: 3.1 → 4.0

	Old Description			New Description
t	1	[APT38](https://attack.mitre.org/groups/G0082) is a North Ko	t	1	[APT38](https://attack.mitre.org/groups/G0082) is a North Ko
	>	rean state-sponsored threat group that specializes in financ		>	rean state-sponsored threat group that specializes in financ
	>	ial cyber operations; it has been attributed to the Reconnai		>	ial cyber operations; it has been attributed to the Reconnai
	>	ssance General Bureau.(Citation: CISA AA20-239A BeagleBoyz A		>	ssance General Bureau.(Citation: CISA AA20-239A BeagleBoyz A
	>	ugust 2020) Active since at least 2014, [APT38](https://atta		>	ugust 2020) Active since at least 2014, [APT38](https://atta
	>	ck.mitre.org/groups/G0082) has targeted banks, financial ins		>	ck.mitre.org/groups/G0082) has targeted banks, financial ins
	>	titutions, casinos, cryptocurrency exchanges, SWIFT system e		>	titutions, casinos, cryptocurrency exchanges, SWIFT system e
	>	ndpoints, and ATMs in at least 38 countries worldwide. Signi		>	ndpoints, and ATMs in at least 38 countries worldwide. Signi
	>	ficant operations include the 2016 Bank of Bangladesh heist,		>	ficant operations include the 2016 Bank of Bangladesh heist,
	>	during which [APT38](https://attack.mitre.org/groups/G0082)		>	Bancomext (Citation: FireEye APT38 Oct 2018) and Banco de C
	>	stole $81 million, as well as attacks against Bancomext (Ci		>	hile (Citation: FireEye APT38 Oct 2018), along with software
	>	tation: FireEye APT38 Oct 2018) and Banco de Chile (Citation		>	supply chain compromises and destructive malware attacks.(C
	>	: FireEye APT38 Oct 2018); some of their attacks have been d		>	itation: CISA AA20-239A BeagleBoyz August 2020)(Citation: Fi
	>	estructive.(Citation: CISA AA20-239A BeagleBoyz August 2020)		>	reEye APT38 Oct 2018)(Citation: DOJ North Korea Indictment F
	>	(Citation: FireEye APT38 Oct 2018)(Citation: DOJ North Korea		>	eb 2021)(Citation: Kaspersky Lazarus Under The Hood Blog 201
	>	Indictment Feb 2021)(Citation: Kaspersky Lazarus Under The		>	7)(Citation: Microsoft Axios Compromise APR 2026)(Citation:
	>	Hood Blog 2017) North Korean group definitions are known to		>	Microsoft Sapphire Sleet APR 2026)(Citation: MIcrosoft Mastr
	>	have significant overlap, and some security researchers rep		>	a npm Compromise JUN 2026) North Korean group definitions a
	>	ort all North Korean state-sponsored cyber activity under th		>	re known to have significant overlap, and some security rese
	>	e name [Lazarus Group](https://attack.mitre.org/groups/G0032		>	archers report all North Korean state-sponsored cyber activi
	>	) instead of tracking clusters or subgroups.		>	ty under the name [Lazarus Group](https://attack.mitre.org/g
				>	roups/G0032) instead of tracking clusters or subgroups.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-07-31 20:48:22.752000+00:00	2026-10-09 03:56:03.463000+00:00
description	[APT38](https://attack.mitre.org/groups/G0082) is a North Korean state-sponsored threat group that specializes in financial cyber operations; it has been attributed to the Reconnaissance General Bureau.(Citation: CISA AA20-239A BeagleBoyz August 2020) Active since at least 2014, [APT38](https://attack.mitre.org/groups/G0082) has targeted banks, financial institutions, casinos, cryptocurrency exchanges, SWIFT system endpoints, and ATMs in at least 38 countries worldwide. Significant operations include the 2016 Bank of Bangladesh heist, during which [APT38](https://attack.mitre.org/groups/G0082) stole $81 million, as well as attacks against Bancomext (Citation: FireEye APT38 Oct 2018) and Banco de Chile (Citation: FireEye APT38 Oct 2018); some of their attacks have been destructive.(Citation: CISA AA20-239A BeagleBoyz August 2020)(Citation: FireEye APT38 Oct 2018)(Citation: DOJ North Korea Indictment Feb 2021)(Citation: Kaspersky Lazarus Under The Hood Blog 2017) North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name [Lazarus Group](https://attack.mitre.org/groups/G0032) instead of tracking clusters or subgroups.	[APT38](https://attack.mitre.org/groups/G0082) is a North Korean state-sponsored threat group that specializes in financial cyber operations; it has been attributed to the Reconnaissance General Bureau.(Citation: CISA AA20-239A BeagleBoyz August 2020) Active since at least 2014, [APT38](https://attack.mitre.org/groups/G0082) has targeted banks, financial institutions, casinos, cryptocurrency exchanges, SWIFT system endpoints, and ATMs in at least 38 countries worldwide. Significant operations include the 2016 Bank of Bangladesh heist, Bancomext (Citation: FireEye APT38 Oct 2018) and Banco de Chile (Citation: FireEye APT38 Oct 2018), along with software supply chain compromises and destructive malware attacks.(Citation: CISA AA20-239A BeagleBoyz August 2020)(Citation: FireEye APT38 Oct 2018)(Citation: DOJ North Korea Indictment Feb 2021)(Citation: Kaspersky Lazarus Under The Hood Blog 2017)(Citation: Microsoft Axios Compromise APR 2026)(Citation: Microsoft Sapphire Sleet APR 2026)(Citation: MIcrosoft Mastra npm Compromise JUN 2026) North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name [Lazarus Group](https://attack.mitre.org/groups/G0032) instead of tracking clusters or subgroups.
x_mitre_version	3.1	4.0

iterable_item_added
STIX Field	Old value	New Value
external_references		{'source_name': 'Microsoft Axios Compromise APR 2026', 'description': 'Microsoft Threat Intelligence. (2026, April 1). Mitigating the Axios npm supply chain compromise. Retrieved September 30, 2026.', 'url': 'https://www.microsoft.com/en-us/security/blog/2026/04/01/mitigating-the-axios-npm-supply-chain-compromise/'}
external_references		{'source_name': 'Microsoft Sapphire Sleet APR 2026', 'description': 'Microsoft Threat Intelligence. (2026, April 16). Dissecting Sapphire Sleet’s macOS intrusion from lure to compromise. Retrieved September 30, 2026.', 'url': 'https://www.microsoft.com/en-us/security/blog/2026/04/16/dissecting-sapphire-sleets-macos-intrusion-from-lure-to-compromise/'}
external_references		{'source_name': 'MIcrosoft Mastra npm Compromise JUN 2026', 'description': 'Microsoft Threat Intelligence. (2026, June 17). From package to postinstall payload: Inside the Mastra npm supply chain compromise by Sapphire Sleet. Retrieved September 30, 2026.', 'url': 'https://www.microsoft.com/en-us/security/blog/2026/06/17/postinstall-payload-inside-mastra-npm-supply-chain-compromise/'}

[G1045] Salt Typhoon

Current version: 2.0

Version changed from: 1.0 → 2.0

	Old Description			New Description
t	1	[Salt Typhoon](https://attack.mitre.org/groups/G1045) is a P	t	1	[Salt Typhoon](https://attack.mitre.org/groups/G1045) is a P
	>	eople's Republic of China (PRC) state-backed actor that has		>	eople's Republic of China (PRC) state-backed actor that has
	>	been active since at least 2019 and responsible for numerous		>	been active since at least 2019 and responsible for numerous
	>	compromises of network infrastructure at major U.S. telecom		>	compromises of network infrastructure at major U.S. telecom
	>	munication and internet service providers (ISP).(Citation: U		>	munication and internet service providers (ISP). [Salt Typho
	>	S Dept. of Treasury Salt Typhoon JAN 2025)(Citation: Cisco S		>	on](https://attack.mitre.org/groups/G1045) has targeted and
	>	alt Typhoon FEB 2025)		>	leveraged public facing network edge devices to gain access
				>	to victim environments. [Salt Typhoon](https://attack.mitre.
				>	org/groups/G1045) has been publicly associated with activiti
				>	es resembling other security industry reported activity grou
				>	ps to include OPERATOR PANDA, RedMike, GhostEmperor, and UNC
				>	5807.(Citation: US Dept. of Treasury Salt Typhoon JAN 2025)(
				>	Citation: Cisco Salt Typhoon FEB 2025)(Citation: CISA_AA25-2
				>	39ASaltTyphoon_Sept2025)(Citation: CarySentinelLabs_CiscoSal
				>	tTyphoon_Dec2025)(Citation: CrowdStrike_OperatorPanda_NoDate
				>	)(Citation: RF_SaltTyphoon_Feb2025)(Citation: Microsoft_Thre
				>	atActorNaming_NoDate)(Citation: Mandiant_M-Trends2026_Mar202
				>	6)

Details

values_changed
STIX Field	Old value	New Value
modified	2026-07-31 18:47:41.313000+00:00	2026-09-23 16:05:01.158000+00:00
description	[Salt Typhoon](https://attack.mitre.org/groups/G1045) is a People's Republic of China (PRC) state-backed actor that has been active since at least 2019 and responsible for numerous compromises of network infrastructure at major U.S. telecommunication and internet service providers (ISP).(Citation: US Dept. of Treasury Salt Typhoon JAN 2025)(Citation: Cisco Salt Typhoon FEB 2025)	[Salt Typhoon](https://attack.mitre.org/groups/G1045) is a People's Republic of China (PRC) state-backed actor that has been active since at least 2019 and responsible for numerous compromises of network infrastructure at major U.S. telecommunication and internet service providers (ISP). [Salt Typhoon](https://attack.mitre.org/groups/G1045) has targeted and leveraged public facing network edge devices to gain access to victim environments. [Salt Typhoon](https://attack.mitre.org/groups/G1045) has been publicly associated with activities resembling other security industry reported activity groups to include OPERATOR PANDA, RedMike, GhostEmperor, and UNC5807.(Citation: US Dept. of Treasury Salt Typhoon JAN 2025)(Citation: Cisco Salt Typhoon FEB 2025)(Citation: CISA_AA25-239ASaltTyphoon_Sept2025)(Citation: CarySentinelLabs_CiscoSaltTyphoon_Dec2025)(Citation: CrowdStrike_OperatorPanda_NoDate)(Citation: RF_SaltTyphoon_Feb2025)(Citation: Microsoft_ThreatActorNaming_NoDate)(Citation: Mandiant_M-Trends2026_Mar2026)
x_mitre_version	1.0	2.0

iterable_item_added
STIX Field	Old value	New Value
external_references		{'source_name': 'CarySentinelLabs_CiscoSaltTyphoon_Dec2025', 'description': 'Cary, D. (2025, December 10). Malicious Apprentice \| How Two Hackers Went From Cisco Academy to Cisco CVEs. Retrieved September 22, 2026.', 'url': 'https://www.sentinelone.com/labs/malicious-apprentice-how-two-hackers-went-from-cisco-academy-to-cisco-cves/'}
external_references		{'source_name': 'CISA_AA25-239ASaltTyphoon_Sept2025', 'description': 'CISA. (2025, September 3). Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System. Retrieved September 22, 2026.', 'url': 'https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a'}
external_references		{'source_name': 'CrowdStrike_OperatorPanda_NoDate', 'description': 'CrowdStrike. (n.d.). Operator Panda. Retrieved September 22, 2026.', 'url': 'https://www.crowdstrike.com/en-us/adversaries/operator-panda/'}
external_references		{'source_name': 'RF_SaltTyphoon_Feb2025', 'description': 'Insikt Group. (2025, February 13). RedMike (Salt Typhoon) Exploits Cisco Vulnerabilities for Cyber Espionage. Retrieved September 22, 2026.', 'url': 'https://www.recordedfuture.com/research/redmike-salt-typhoon-exploits-vulnerable-devices'}
external_references		{'source_name': 'Mandiant_M-Trends2026_Mar2026', 'description': 'Kutscher, J. (2026, March 23). M-Trends 2026: Data, Insights, and Strategies From the Frontlines. Retrieved September 22, 2026.', 'url': 'https://cloud.google.com/blog/topics/threat-intelligence/m-trends-2026'}
external_references		{'source_name': 'Microsoft_ThreatActorNaming_NoDate', 'description': 'Microsoft. (n.d.). How Microsoft names threat actors. Retrieved September 22, 2026.', 'url': 'https://learn.microsoft.com/en-us/unified-secops/microsoft-threat-actor-naming'}

Minor Version Changes

[G1044] APT42

Current version: 1.1

Version changed from: 1.0 → 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2026-07-31 18:48:15.085000+00:00	2026-09-22 18:32:31.345000+00:00
x_mitre_version	1.0	1.1

[G0047] Gamaredon Group

Current version: 3.4

Version changed from: 3.3 → 3.4

Details

values_changed
STIX Field	Old value	New Value
modified	2026-07-31 18:47:46.487000+00:00	2026-10-01 23:37:12.271000+00:00
x_mitre_version	3.3	3.4

Patches

[G0070] Dark Caracal

Current version: 1.4

Details

values_changed
STIX Field	Old value	New Value
modified	2026-07-31 20:48:40.500000+00:00	2026-09-02 18:51:43.655000+00:00

[G1015] Scattered Spider

Current version: 3.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-07-31 20:48:33.778000+00:00	2026-09-11 19:37:15.760000+00:00

[G1056] TeamPCP

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-07-31 18:47:42.686000+00:00	2026-09-02 17:31:48.218000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_contributors		Alberto Arroba García

[G0112] Windshift

Current version: 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2026-07-31 20:48:43.267000+00:00	2026-09-02 18:52:46.473000+00:00

mobile-attack

Patches

[G0097] Bouncing Golf

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-07-31 20:48:23.673000+00:00	2026-09-02 18:45:29.545000+00:00

[G0070] Dark Caracal

Current version: 1.4

Details

values_changed
STIX Field	Old value	New Value
modified	2026-07-31 20:48:40.500000+00:00	2026-09-02 18:51:43.655000+00:00

[G1015] Scattered Spider

Current version: 3.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-07-31 20:48:33.778000+00:00	2026-09-11 19:37:15.760000+00:00

[G0112] Windshift

Current version: 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2026-07-31 20:48:43.267000+00:00	2026-09-02 18:52:46.473000+00:00

ics-attack

Major Version Changes

[G0082] APT38

Current version: 4.0

Version changed from: 3.1 → 4.0

	Old Description			New Description
t	1	[APT38](https://attack.mitre.org/groups/G0082) is a North Ko	t	1	[APT38](https://attack.mitre.org/groups/G0082) is a North Ko
	>	rean state-sponsored threat group that specializes in financ		>	rean state-sponsored threat group that specializes in financ
	>	ial cyber operations; it has been attributed to the Reconnai		>	ial cyber operations; it has been attributed to the Reconnai
	>	ssance General Bureau.(Citation: CISA AA20-239A BeagleBoyz A		>	ssance General Bureau.(Citation: CISA AA20-239A BeagleBoyz A
	>	ugust 2020) Active since at least 2014, [APT38](https://atta		>	ugust 2020) Active since at least 2014, [APT38](https://atta
	>	ck.mitre.org/groups/G0082) has targeted banks, financial ins		>	ck.mitre.org/groups/G0082) has targeted banks, financial ins
	>	titutions, casinos, cryptocurrency exchanges, SWIFT system e		>	titutions, casinos, cryptocurrency exchanges, SWIFT system e
	>	ndpoints, and ATMs in at least 38 countries worldwide. Signi		>	ndpoints, and ATMs in at least 38 countries worldwide. Signi
	>	ficant operations include the 2016 Bank of Bangladesh heist,		>	ficant operations include the 2016 Bank of Bangladesh heist,
	>	during which [APT38](https://attack.mitre.org/groups/G0082)		>	Bancomext (Citation: FireEye APT38 Oct 2018) and Banco de C
	>	stole $81 million, as well as attacks against Bancomext (Ci		>	hile (Citation: FireEye APT38 Oct 2018), along with software
	>	tation: FireEye APT38 Oct 2018) and Banco de Chile (Citation		>	supply chain compromises and destructive malware attacks.(C
	>	: FireEye APT38 Oct 2018); some of their attacks have been d		>	itation: CISA AA20-239A BeagleBoyz August 2020)(Citation: Fi
	>	estructive.(Citation: CISA AA20-239A BeagleBoyz August 2020)		>	reEye APT38 Oct 2018)(Citation: DOJ North Korea Indictment F
	>	(Citation: FireEye APT38 Oct 2018)(Citation: DOJ North Korea		>	eb 2021)(Citation: Kaspersky Lazarus Under The Hood Blog 201
	>	Indictment Feb 2021)(Citation: Kaspersky Lazarus Under The		>	7)(Citation: Microsoft Axios Compromise APR 2026)(Citation:
	>	Hood Blog 2017) North Korean group definitions are known to		>	Microsoft Sapphire Sleet APR 2026)(Citation: MIcrosoft Mastr
	>	have significant overlap, and some security researchers rep		>	a npm Compromise JUN 2026) North Korean group definitions a
	>	ort all North Korean state-sponsored cyber activity under th		>	re known to have significant overlap, and some security rese
	>	e name [Lazarus Group](https://attack.mitre.org/groups/G0032		>	archers report all North Korean state-sponsored cyber activi
	>	) instead of tracking clusters or subgroups.		>	ty under the name [Lazarus Group](https://attack.mitre.org/g
				>	roups/G0032) instead of tracking clusters or subgroups.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-07-31 20:48:22.752000+00:00	2026-10-09 03:56:03.463000+00:00
description	[APT38](https://attack.mitre.org/groups/G0082) is a North Korean state-sponsored threat group that specializes in financial cyber operations; it has been attributed to the Reconnaissance General Bureau.(Citation: CISA AA20-239A BeagleBoyz August 2020) Active since at least 2014, [APT38](https://attack.mitre.org/groups/G0082) has targeted banks, financial institutions, casinos, cryptocurrency exchanges, SWIFT system endpoints, and ATMs in at least 38 countries worldwide. Significant operations include the 2016 Bank of Bangladesh heist, during which [APT38](https://attack.mitre.org/groups/G0082) stole $81 million, as well as attacks against Bancomext (Citation: FireEye APT38 Oct 2018) and Banco de Chile (Citation: FireEye APT38 Oct 2018); some of their attacks have been destructive.(Citation: CISA AA20-239A BeagleBoyz August 2020)(Citation: FireEye APT38 Oct 2018)(Citation: DOJ North Korea Indictment Feb 2021)(Citation: Kaspersky Lazarus Under The Hood Blog 2017) North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name [Lazarus Group](https://attack.mitre.org/groups/G0032) instead of tracking clusters or subgroups.	[APT38](https://attack.mitre.org/groups/G0082) is a North Korean state-sponsored threat group that specializes in financial cyber operations; it has been attributed to the Reconnaissance General Bureau.(Citation: CISA AA20-239A BeagleBoyz August 2020) Active since at least 2014, [APT38](https://attack.mitre.org/groups/G0082) has targeted banks, financial institutions, casinos, cryptocurrency exchanges, SWIFT system endpoints, and ATMs in at least 38 countries worldwide. Significant operations include the 2016 Bank of Bangladesh heist, Bancomext (Citation: FireEye APT38 Oct 2018) and Banco de Chile (Citation: FireEye APT38 Oct 2018), along with software supply chain compromises and destructive malware attacks.(Citation: CISA AA20-239A BeagleBoyz August 2020)(Citation: FireEye APT38 Oct 2018)(Citation: DOJ North Korea Indictment Feb 2021)(Citation: Kaspersky Lazarus Under The Hood Blog 2017)(Citation: Microsoft Axios Compromise APR 2026)(Citation: Microsoft Sapphire Sleet APR 2026)(Citation: MIcrosoft Mastra npm Compromise JUN 2026) North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name [Lazarus Group](https://attack.mitre.org/groups/G0032) instead of tracking clusters or subgroups.
x_mitre_version	3.1	4.0

iterable_item_added
STIX Field	Old value	New Value
external_references		{'source_name': 'Microsoft Axios Compromise APR 2026', 'description': 'Microsoft Threat Intelligence. (2026, April 1). Mitigating the Axios npm supply chain compromise. Retrieved September 30, 2026.', 'url': 'https://www.microsoft.com/en-us/security/blog/2026/04/01/mitigating-the-axios-npm-supply-chain-compromise/'}
external_references		{'source_name': 'Microsoft Sapphire Sleet APR 2026', 'description': 'Microsoft Threat Intelligence. (2026, April 16). Dissecting Sapphire Sleet’s macOS intrusion from lure to compromise. Retrieved September 30, 2026.', 'url': 'https://www.microsoft.com/en-us/security/blog/2026/04/16/dissecting-sapphire-sleets-macos-intrusion-from-lure-to-compromise/'}
external_references		{'source_name': 'MIcrosoft Mastra npm Compromise JUN 2026', 'description': 'Microsoft Threat Intelligence. (2026, June 17). From package to postinstall payload: Inside the Mastra npm supply chain compromise by Sapphire Sleet. Retrieved September 30, 2026.', 'url': 'https://www.microsoft.com/en-us/security/blog/2026/06/17/postinstall-payload-inside-mastra-npm-supply-chain-compromise/'}

Minor Version Changes

[G1027] CyberAv3ngers

Current version: 1.1

Version changed from: 1.0 → 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2026-07-31 20:48:42.789000+00:00	2026-10-07 13:46:33.122000+00:00
x_mitre_version	1.0	1.1

Campaigns

enterprise-attack

New Campaigns

[C0064] AI-Assisted Breach of Mexico's Government Infrastructure

Current version: 1.0

Description:

The AI-Assisted Breach of Mexico's Government Infrastructure is a campaign where human operators used Claude Code AI and OpenAI GPT GPT-4.1 AI to perform reconnaissance, vulnerability exploitation, privilege escalation, discovery, credential harvesting, and exfiltration operations. The attack impacted several Mexican government institutions including the Federal Tax Authority (Servicio de Administracion Tributaria), Mexico State Government (Estado de Mexico), Mexico City Civil Registry (Registro Civil de CDMX), Jalisco State Government, National Electoral Institute (Instituto Nacional Electoral), Michoacan State Government, SADM Monterrey Municipal Water Utility (Agua y Drenaje), Tamaulipas State Government, and the Mexico City Health Department (Salud CDMX). The attack resulted in the theft of large amounts of sensitive government data and civilian records. Please note that due to the breadth of this campaign, public reporting only provides select details and as a result this campaign should not be considered comprehensive.(Citation: AI-Mexico-Govt-Compromise)

Patches

[C0060] Operation AkaiRyū

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-07-31 18:47:26.133000+00:00	2026-10-09 21:15:15.621000+00:00
first_seen	2004-06-01 04:00:00+00:00	2024-06-01 05:00:00+00:00
last_seen	2004-09-01 04:00:00+00:00	2024-09-01 05:00:00+00:00

[C0059] Salesforce Data Exfiltration

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-07-31 20:48:17.935000+00:00	2026-10-09 21:13:16.085000+00:00
first_seen	2004-10-01 04:00:00+00:00	2024-10-01 05:00:00+00:00

ics-attack

New Campaigns

[C0066] 2026 U.S. Water Utilities Attacks

Current version: 1.0

Description:

2026 U.S. Water Utilities Attacks was a campaign against more than 30 municipal water and wastewater utilities in Minnesota, beginning 27 July 2026, amid a wider pattern of similar activity the FBI and EPA reported across at least seven U.S. states.(Citation: Dragos Water Under Attack)(Citation: FBI Water and Wastewater) The adversary targeted internet-facing Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 series programmable logic controllers reachable through cellular gateways at water towers and sewer lift stations, remotely accessing them and reconfiguring their IP addresses and passwords to lock operators out of monitoring and control functions.(Citation: Tenable Minnesota Water Utilities)(Citation: Forescout Water Systems Attack) At least one victim organization's PLC program logic was altered, and reported operational effects included loss of water pressure and flooding, with one utility taking its treatment plant offline entirely.(Citation: Forescout Water Systems Attack)(Citation: FBI Water and Wastewater) The campaign has not been formally attributed; some reporting describes the broader pattern as consistent with Iranian-affiliated activity, but attribution for the Minnesota intrusions specifically remains unconfirmed.(Citation: Dragos Water Under Attack)

[C0064] AI-Assisted Breach of Mexico's Government Infrastructure

Current version: 1.0

Description:

Assets

ics-attack

Patches

[A0009] Data Gateway

Current version: 2.1

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.768000+00:00	2026-10-13 16:52:01.660000+00:00
x_mitre_platforms[3]	Network	Network Devices

[A0016] Firewall

Current version: 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 14:53:28.476000+00:00	2026-10-13 16:51:34.368000+00:00
x_mitre_platforms[3]	Network	Network Devices

[A0014] Routers

Current version: 2.1

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.768000+00:00	2026-10-13 16:50:45.686000+00:00
x_mitre_platforms[1]	Network	Network Devices

[A0015] Switch

Current version: 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.768000+00:00	2026-10-13 16:51:10.478000+00:00
x_mitre_platforms[1]	Network	Network Devices

Mitigations

enterprise-attack

Patches

[M1031] Network Intrusion Prevention

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2024-10-17 18:54:36.723000+00:00	2026-09-03 19:46:42.143000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0

ics-attack

New Mitigations

[M1061] Limit Software/Package Installation

Current version: 1.0

Description:

Prevent unauthorized installation of software on ICS assets.

Minor Version Changes

[M0942] Disable or Remove Feature or Program

Current version: 1.1

Version changed from: 1.0 → 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:26:32.177000+00:00	2026-10-07 17:50:45.716000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	1.1

[M0938] Execution Prevention

Current version: 1.1

Version changed from: 1.0 → 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:26:28.155000+00:00	2026-10-07 17:52:00.813000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	1.1

[M0950] Exploit Protection

Current version: 1.1

Version changed from: 1.0 → 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:26:27.827000+00:00	2026-10-07 17:50:11.297000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	1.1

[M0921] Restrict Web-Based Content

Current version: 1.1

Version changed from: 1.0 → 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:26:26.226000+00:00	2026-10-07 17:52:26.035000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	1.1

Data Components

enterprise-attack

Minor Version Changes

[DC0038] Application Log Content

Current version: 3.1

Version changed from: 3.0 → 3.1

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.776000+00:00	2026-10-13 17:43:41.733000+00:00
x_mitre_log_sources[173]['name']	saas:Airtable	WinEventLog:System
x_mitre_log_sources[173]['channel']	EXPORT: User-triggered data export via GUI or API	network adapter disabled on Industrial Control Systems (ICS) gateway host by process not in authorized network admins
x_mitre_version	3.0	3.1

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'm365:unified', 'channel': 'CopilotInteraction'}
x_mitre_log_sources		{'name': 'AWS:bedrock', 'channel': 'GuardrailTrace'}
x_mitre_log_sources		{'name': 'AWS:bedrock', 'channel': 'AgentTrace.FailureTrace'}
x_mitre_log_sources		{'name': 'AWS:bedrock', 'channel': 'AgentTrace.ModelInvocationInput'}
x_mitre_log_sources		{'name': 'AWS:bedrock', 'channel': 'AgentTrace.actionGroupInvocationInput'}
x_mitre_log_sources		{'name': 'AWS:bedrock', 'channel': 'AgentTrace.knowledgeBaseLookupInput'}
x_mitre_log_sources		{'name': 'casb:activity ', 'channel': 'Subsequent sensitive data access or outbound transfer occurs in the same SaaS session '}
x_mitre_log_sources		{'name': 'm365:unified', 'channel': 'Authentication/account audit event identifying app-password or applicable legacy-authentication activity '}
x_mitre_log_sources		{'name': 'saas:audit', 'channel': 'Actual send/share/upload/write operation'}
x_mitre_log_sources		{'name': 'engineeringworkstation:ApplicationLog', 'channel': 'firmware write session initiated without corresponding change ticket reference'}
x_mitre_log_sources		{'name': 'engineeringworkstation:ApplicationLog', 'channel': 'program download session logged without corresponding change ticket reference'}
x_mitre_log_sources		{'name': 'syslog:daemon', 'channel': 'Industrial Control Systems (ICS) daemon log entry indicating connection limit exceeded, out of memory, or watchdog timeout'}
x_mitre_log_sources		{'name': 'webserver:applog', 'channel': 'Web server/WAF access or request log: exploit-relevant URI/path/query/header/status pattern against ICS web interface; request-body claims require WAF/DPI logging'}
x_mitre_log_sources		{'name': 'syslog:auth', 'channel': 'Secure Shell (SSH) session with X11 forwarding from source not in approved admin Classless Inter-Domain Routing (CIDR) subnet'}
x_mitre_log_sources		{'name': 'edr:TelemetryCompare', 'channel': 'process enumeration discrepancy between Windows Management Instrumentation (WMI) and direct process listing'}
x_mitre_log_sources		{'name': 'historian:applog', 'channel': 'historian Structured Query Language (SQL) query returning above bulk query threshold rows from account not in approved historian clients'}
x_mitre_log_sources		{'name': 'scada:applog', 'channel': 'device communication-loss alarm generated within detection window of a corresponding network flood alert'}
x_mitre_log_sources		{'name': 'networkdevice:snmp', 'channel': 'ifInErrors or ifOutDiscards rate exceeds baseline combined with cpu5min exceeding utilization threshold'}
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'Network Address Translation (NAT)/route/Access Control List (ACL) configuration change from source not in approved net admins outside config change window'}
x_mitre_log_sources		{'name': 'vpn:applog', 'channel': 'session duration or command activity inconsistent with documented vendor support session profiles'}
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'configuration change logged without corresponding change ticket reference following anomalous authentication'}
x_mitre_log_sources		{'name': 'networkdevice:snmp', 'channel': 'Simple Network Management Protocol (SNMP) walk request from source not in approved Network Management System (NMS) Class Inter-Domain Routing (CIDR) subnet'}
x_mitre_log_sources		{'name': 'networkdevice:snmp', 'channel': 'Simple Network Management Protocol (SNMP) SET to alarm threshold Object Identifier (OID) from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet'}
x_mitre_log_sources		{'name': 'networkdevice:snmp', 'channel': 'Simple Network Management Protocol (SNMP) polling inconsistency or syslog sequence gap suggesting telemetry manipulation'}
x_mitre_log_sources		{'name': 'networkdevice:snmp', 'channel': 'Simple Network Management Protocol (SNMP) SET to power Management Information Base (MIB) restart Object Identifier (OID) or Command Line Interface (CLI) reload command from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet'}
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'Access Control List (ACL)/policy change affecting alarm notification traffic ports without corresponding change ticket'}
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'unexpected listening port or routing table change following firmware update event'}
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'new Media Access Control (MAC) address learned on a switch port previously unused or assigned to a different device, followed by Industrial Control Systems (ICS) protocol traffic to field devices'}
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'management command succeeds from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet, preceded by exploit-pattern traffic to management interface'}
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'syslog sequence number gap or forwarding interruption coinciding with suspicious activity window for the same device'}
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'Simple Network Management Protocol (SNMP) SET to service stop Object Identifier (OID) or Command Line Interface (CLI) command stopping critical service from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet'}
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'AAA/Simple Network Management Protocol (SNMP) credential change from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet, followed by authentication failures from legitimate NMS systems'}
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'remote console or web management session from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet'}
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'Access Control List (ACL) modification blocking Industrial Control Systems (ICS) reporting message ports while command ports remain open'}
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'unexpected restart or crash coinciding with anomalous traffic pattern on management interface'}
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'serial server configuration change altering port parameters for field device ports from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet'}
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'unauthorized Switched Port Analyzer (SPAN) session request or port mirroring configuration from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet'}
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'Switched Port Analayzer (SPAN) session or port mirroring configuration change from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet'}
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'Access Control List (ACL)/firewall/routing configuration change from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet outside change control window'}
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'interface shutdown command on Industrial Control Systems (ICS) device port from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet outside change control window'}
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'deauthentication targeting more than mass deauth threshold enrolled devices within deauth time window, or Media Access Control (MAC) address filter config change excluding enrolled devices, from source not in approved wireless admin list'}
x_mitre_log_sources		{'name': 'opc:applog', 'channel': 'client_id not in approved Open Platform Communications (OPC) clients issuing high-volume read requests'}
x_mitre_log_sources		{'name': 'opc:applog', 'channel': 'Open Platform Communications (OPC) client polling frequency for tag set exceeds documented Human-Machine Interface (HMI) refresh baseline from client not in approved application list'}
x_mitre_log_sources		{'name': 'opc:applog', 'channel': 'Open Platform Communications Data Access (OPC DA) write queue depth or write throughput to a single point exceeds configured baseline by a significant margin'}
x_mitre_log_sources		{'name': 'opcua:AuditEvent', 'channel': 'OPC UA AuditUpdateMethodEventType/AuditWriteUpdateEventType: ClientUserId, ClientApplicationUri, SourceNode/MethodId, Status and arguments for a state-changing method/write'}
x_mitre_log_sources		{'name': 'opc:applog', 'channel': 'write to setpoint tag from client not in approved Open Platform Communications (OPC) clients with value outside baseline value range'}
x_mitre_log_sources		{'name': 'opc:applog', 'channel': 'client_id not in approved Open Platform Communications (OPC) clients traversing entire tag tree rather than known fixed subset'}
x_mitre_log_sources		{'name': 'opc:applog', 'channel': 'Open Platform Communications (OPC) client not in approved OPC clients calling BrowseNamespace traversing entire tag tree'}
x_mitre_log_sources		{'name': 'opc:applog', 'channel': 'command call to field device output tag from process not matching recognized Supervisory Control and Data Acquisition (SCADA)/Distributed Control System (DCS) control application'}
x_mitre_log_sources		{'name': 'engineeringworkstation:ApplicationLog', 'channel': 'mode-change session logged without corresponding change ticket reference'}
x_mitre_log_sources		{'name': 'serialgw:syslog', 'channel': 'serial port parameter change (baud rate, parity, port disable) without corresponding change ticket reference'}
x_mitre_log_sources		{'name': 'engineeringworkstation:ApplicationLog', 'channel': 'firmware update mode entry logged without corresponding change ticket reference'}
x_mitre_log_sources		{'name': 'scada:applog', 'channel': 'write Application Programming Interface (API) call queue depth or throughput to a single point exceeds max write queue depth'}
x_mitre_log_sources		{'name': 'scada:applog', 'channel': 'parameter write logged without corresponding operator_id in the Human-Machine Interface (HMI) audit trail'}
x_mitre_log_sources		{'name': 'scada:applog', 'channel': 'command issued to device_ip with no corresponding state-change confirmation received within command confirmation window'}
x_mitre_log_sources		{'name': 'otndr:BehaviorAlert', 'channel': 'device Input/Output (I/O) state change inconsistent with programmed logic correlating temporally with operator terminal interaction'}
x_mitre_log_sources		{'name': 'device:VendorLog', 'channel': 'protected function (firmware write, memory protection mode change) succeeds for a session that did not complete the documented authentication/privilege-elevation sequence'}
x_mitre_log_sources		{'name': 'engineeringworkstation:ApplicationLog', 'channel': 'Engineering application audit/session log: controller program upload initiated outside approved backup/change window and without documented backup purpose'}
x_mitre_log_sources		{'name': 'engineeringworkstation:ApplicationLog', 'channel': 'full upload session outside backup window schedule without documented backup purpose'}
x_mitre_log_sources		{'name': 'engineeringworkstation:ApplicationLog', 'channel': 'online edit session logged without corresponding change ticket reference'}
x_mitre_log_sources		{'name': 'syslog:auth', 'channel': 'Secure Shell (SSH) connection from source Internet Protocol (IP) address that appeared on Industrial Control Systems (ICS) network within new device window, not in approved device inventory'}
x_mitre_log_sources		{'name': 'vendorapp:ApplicationLog', 'channel': 'Industrial Control Systems (ICS) vendor application log shows endpoint or certificate change without documented maintenance reference'}
x_mitre_log_sources		{'name': 'engineeringworkstation:ApplicationLog', 'channel': 'firmware session initiated outside maintenance window schedule without change ticket reference'}
x_mitre_log_sources		{'name': 'engineeringworkstation:ApplicationLog', 'channel': 'device restart command initiated outside change control window by account not in approved engineer list'}
x_mitre_log_sources		{'name': 'webproxy:applog', 'channel': 'file download from domain not matching verified vendor Transport Layer Security (TLS) certificate/domain history, immediately preceding the anomalous process spawn'}
x_mitre_log_sources		{'name': 'webserver:applog', 'channel': 'Web server/WAF access or request log: exploit-relevant URI/path/query/header/status pattern against ICS web interface from unapproved source; request-body claims require WAF/DPI logging'}
x_mitre_log_sources		{'name': 'WinEventLog:Application', 'channel': 'wireless controller management log: SSID or MAC filter config change from account not in authorized wireless admins'}
x_mitre_log_sources		{'name': 'WinEventLog:System', 'channel': 'Industrial Control Systems (ICS) service failing to start (authentication failure) within credential change impact window of the password change event'}

[DC0064] Command Execution

Current version: 2.2

Version changed from: 2.1 → 2.2

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.774000+00:00	2026-10-13 17:43:48.219000+00:00
x_mitre_log_sources[142]['name']	linus:syslog	linux:syslog
x_mitre_version	2.1	2.2

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'CLI command audit / configuration command history'}
x_mitre_log_sources		{'name': 'WinEventLog:PowerShell', 'channel': 'EventCode=4103/4104/4105/4106; command/script-block content '}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Unix shell process (sh, bash, busybox sh, toybox) spawns as child of app process with command-line arguments indicating scripted operation — shell with arguments confirms script execution not interactive terminal'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Shell or command-executing child process with arguments spawned under managed app context on supervised iOS device'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: pm uninstall OR rm -f called by process NOT IN $MDMAgentPackageList$ for package_count > $BulkUninstallThreshold$ within $DestructionWindow$ — command-line destruction activity'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App spawns sh, bash, toybox, toolbox, or su child process with command arguments within $ShellActivityWindow$ of shell launch — child shell process with arguments is the script execution signal'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Shell process (sh, bash) or command-executing child process spawned under app context on supervised iOS device — any shell spawn on stock iOS indicates jailbreak or kernel exploit'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): sequential reads across ICS data paths by uid not in authorized data access UIDs, followed by tar/zip invocation within a short window'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): execve of screenshot utility (scrot, import, xwd) on Industrial Control Systems (ICS) Human-Machine Interface (HMI) by User Identifier (UID) not in approved operator UIDs'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): system binary executing with command line piping or decoding external content, from Industrial Control Systems (ICS) service account User Identifier (UID)'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): raw socket creation (SOCK_RAW) or tcpdump/tshark execution by uid not in authorized capture User Identifiers (UIDs)'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): Industrial Control Systems (ICS) tool execution following Secure Shell (SSH) lateral movement session'}
x_mitre_log_sources		{'name': 'gpo:deployment', 'channel': 'destructive payload deployed via Group Policy Object (GPO) to multiple hosts simultaneously'}
x_mitre_log_sources		{'name': 'historian:applog', 'channel': 'bulk export query returning above bulk query threshold records from account not in approved historian clients'}
x_mitre_log_sources		{'name': 'WinEventLog:Security', 'channel': 'Windows Security Event ID 4688: EventCode=1102 correlated with any other Medium+ confidence alert on the same host within log clear lookback window'}

[DC0055] File Access

Current version: 3.1

Version changed from: 3.0 → 3.1

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.770000+00:00	2026-10-13 17:43:44.861000+00:00
x_mitre_version	3.0	3.1

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: open() for read on path IN /sdcard/ OR on path with file_permissions=777'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: opendir() or File.listFiles() on path IN $ExternalStoragePaths$ called > $FileEnumThreshold$ times within $EnumWindow$ by app NOT IN $FileEnumAllowList$'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': "Dynamic filesystem trace or acquired app-container/filesystem artifacts: opendir('/proc/') with recursive listdir by app NOT IN $ProcessDiscoveryAllowList$ on device with android_version < $HidepidVersion$"}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: open() for read on /proc/cpuinfo'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: App reads files across $MinDirectoryCount$+ distinct parent directories with file_read_count > $FileReadRateThreshold$ within $DataCollectionWindow$ in background or low-interaction state — bulk cross-directory read is the collection signal'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: App reads multiple files from Photos library, Files provider, or iCloud Drive in background or lock-adjacent state exceeding $FileReadRateThreshold$ within $DataCollectionWindow$'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: App loads executable or library from writable external directory (/sdcard/, app cache, /data/local/tmp/) — writable-path library load is exploitable hijack vector'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL+PATH', 'channel': 'Linux Audit SYSCALL+PATH records: PATH records show sequential reads of ICS documentation/configuration files by a UID not in the authorized engineering or backup account set'}
x_mitre_log_sources		{'name': 'WinEventLog:Security', 'channel': 'Windows Security Event ID 4663 (requires Object Access auditing and SACL on monitored paths): repeated ReadData/ListDirectory access across ICS data paths by an unapproved process/account'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'Sequential file reads across multiple Industrial Control Systems (ICS) data paths by image not in authorized ICS applications, exceeding bulk access threshold within a short window'}
x_mitre_log_sources		{'name': 'WinEventLog:Security', 'channel': 'Windows Security Event ID 4663 (requires Object Access auditing/SACL): engineering process reads/opens project file from unapproved repository/removable-media/network-share path'}
x_mitre_log_sources		{'name': 'WinEventLog:Security', 'channel': 'Windows Security Event ID 4663 (requires Object Access auditing/SACL): Siemens engineering process reads/opens project file from unapproved repository/removable-media/network-share path'}

[DC0039] File Creation

Current version: 3.1

Version changed from: 3.0 → 3.1

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.770000+00:00	2026-10-13 17:43:40.408000+00:00
x_mitre_version	3.0	3.1

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'MobileEDR:telemetry', 'channel': 'IPA binary written with signing cert matching user-trusted certificate NOT IN $EnterpriseCertList$ within $ProfileInstallWindow$'}
x_mitre_log_sources		{'name': 'MobileEDR:telemetry', 'channel': 'PackageInstaller.install() with signing_cert NOT IN $EnterpriseCertList$ within $PolicyViolationWindow$ of settings change'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: App writes asymmetric-encrypted blob or encoded ciphertext to local staging path before network transmission — encrypted staging artifact'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: Local file write between inbound retrieval'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': "Dynamic filesystem trace or acquired app-container/filesystem artifacts: open() with O_CREAT on path LIKE '/data/data/%/files/%' for binary or dex content by app_package NOT IN $LegitDynamicLoaders$"}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: open() with O_CREAT on binary-typed path in /data/data// within $StegoExecWindow$ of media file download from same session'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: open() with O_CREAT for file with audio MIME type (audio/mp4, audio/aac, audio/3gpp) in /data/data//files/ within $AudioCaptureWindow$ of recording API start'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: open() with O_CREAT for APK or binary file in /sdcard/ or /data/local/tmp/ by browser process within $DriveByWindow$ — payload drop confirms exploit code execution'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: PackageInstaller.install() with installer_source NOT IN $ApprovedInstallSources$ within $PolicyViolationWindow$ of settings change'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: app binary written to device with signing certificate matching manually-trusted enterprise cert NOT IN $EnterpriseCertAllowList$ within $ProfileInstallWindow$'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: PackageInstaller.install() with signing_cert NOT IN $EnterpriseCertList$ within $PolicyViolationWindow$ of settings change'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: IPA binary written with signing cert matching user-trusted certificate NOT IN $EnterpriseCertList$ within $ProfileInstallWindow$'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: app binary written to device storage as part of install — confirms impersonating app is being persisted'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: PackageInstaller.install() writes binary to device storage for impersonating app — install event is the enrollment of impersonating app'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: open() with O_CREAT for APK file in /sdcard/ or /data/local/tmp/ within $PhishingWindow$ of navigation to flagged URL — APK drop confirms malware delivery phase'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: File with binary signature (.apk, .dex, .so, .sh) written to app storage or /data/local/tmp/ from USB-mounted path or external storage within $USBInstallWindow$'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: Compromised app writes staging, cache, or export artifacts inconsistent with its declared function within $PostInstallWindow$'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: App stages or caches content retrieved from web-service platform locally before initiating secondary network connection'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: App writes high-entropy blob (Shannon entropy > $EntropyThreshold$) to local staging path immediately before outbound transmission — encrypted staging artifact confirms app-layer encryption occurred'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: App writes newly retrieved binary, archive, native library (.so), DEX, or script to /data/data//files/, cache, or shared storage within $IngressWriteWindow$ of network retrieval from non-CDN source'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: Managed app writes newly retrieved container-local file, dylib-like resource, or opaque payload after download from non-CDN source'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: APK, DEX, or native library written to app installation path outside MDM-authorized update mechanism — binary replacement is the persistence artifact'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: App reads files across multiple directories or databases in background state (collection phase) then invokes archive or compression routines on collected content — read-then-archive sequence is the staging chain'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: App writes archive-like container, high-entropy packaged blob, or .zip/.gz output to app-private or cache path after bulk data collection — archive artifact in private storage is the staging evidence'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: App writes large container, temp package, or high-entropy blob to container-local storage after clustered data access — staged archive artifact'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: App writes to or modifies protected configuration files or local control structures of deployed security tools'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=11 of alarm config paths by image not in Human-Machine Interface (HMI) alarm parent allowlist'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL+PATH', 'channel': 'Linux Audit SYSCALL+PATH records: file transfer (scp, sftp, rsync, etc.) placing executable on Industrial Control Systems (ICS) Linux asset, followed by execve of the transferred file within tool transfer window'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=11 with executable/script extension from remote-sourced write operation'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=11 from removable media path to Industrial Control Systems (ICS) engineering working directory'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=11 where an unrecognized process creates a staging/output file after bulk ICS data access activity'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=11 by same process within capture to file window of the Application Programming Interface (API) call'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=11 to alarm threshold config path by image not in Human-Machine Interface (HMI) alarm parent allowlist'}

[DC0018] Host Status

Current version: 2.2

Version changed from: 2.1 → 2.2

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.775000+00:00	2026-10-13 17:40:35.821000+00:00
x_mitre_version	2.1	2.2

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'iOS:MDMLog', 'channel': 'jailbreak_status=true on device where Keychain path file access was observed — stock iOS Keychain sandbox prevents direct file access; jailbreak is the prerequisite'}
x_mitre_log_sources		{'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported'}
x_mitre_log_sources		{'name': 'iOS:MDM', 'channel': 'DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries'}

[DC0067] Logon Session Creation

Current version: 2.1

Version changed from: 2.0 → 2.1

Details

values_changed
STIX Field	Old value	New Value
modified	2025-11-12 22:03:39.105000+00:00	2026-10-13 17:43:46.287000+00:00
x_mitre_version	2.0	2.1

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'device:auth', 'channel': 'SSH/Telnet/console or vendor remote-management session '}
x_mitre_log_sources		{'name': 'idp:session ', 'channel': 'New session established from source/device inconsistent with account baseline '}
x_mitre_log_sources		{'name': 'linux:syslog', 'channel': 'auth.log/secure.log; SSH or console session context '}
x_mitre_log_sources		{'name': 'networkdevice:auth', 'channel': 'SSH/Telnet/console authentication and session creation'}
x_mitre_log_sources		{'name': 'saas:session ', 'channel': 'New authenticated session associated with changed source/client context '}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): sudo/su success for Industrial Control Systems (ICS) service account UID without the expected automated invocation pattern'}
x_mitre_log_sources		{'name': 'syslog:auth', 'channel': 'Secure Shell (SSH) session between Industrial Control Systems (ICS) hosts not in approved lateral movement pairs'}
x_mitre_log_sources		{'name': 'WinEventLog:Security', 'channel': 'Windows Security Event ID 4624/4625: EventCode=4624 by account not in authorized engineer accounts'}
x_mitre_log_sources		{'name': 'wireless:radius', 'channel': 'Extensible Authentication Protocol (EAP) authentication success for device Media Access Control (MAC)/certificate not in approved wireless device inventory'}
x_mitre_log_sources		{'name': 'WinEventLog:Security', 'channel': 'Windows Security Event ID 4624/4625: EventCode=4624 from a device Media Access Control (MAC) address/hardware-ID first observed on the network, not in approved device inventory'}
x_mitre_log_sources		{'name': 'syslog:auth', 'channel': 'sshd Accepted for username matching default vendor credential list from source not in approved admin Classless Inter-Domain Routing (CIDR) subnet'}
x_mitre_log_sources		{'name': 'syslog:auth', 'channel': 'sshd Accepted for username matching default or hardcoded credential patterns from source not in approved admin Classless Inter-Domain Routing (CIDR) subnet'}
x_mitre_log_sources		{'name': 'WinEventLog:Security', 'channel': 'Windows Security Event ID 4624/4625: EventCode=4624 for Industrial Control Systems (ICS)-role account from workstation not in approved host list or outside office hours window'}
x_mitre_log_sources		{'name': 'WinEventLog:Security', 'channel': 'Windows Security Event ID 4624/4625: EventCode=4624 for account matching default vendor credential list from source not in approved host list'}
x_mitre_log_sources		{'name': 'WinEventLog:Security', 'channel': 'Windows Security Event ID 4624/4625: EventCode=4624, Type 2/10 to Industrial Control Systems (ICS) host from source not in approved operator workstations or account not in approved operator list'}
x_mitre_log_sources		{'name': 'WinEventLog:Security', 'channel': 'Windows Security Event ID 4624/4625: EventCode=4624 for Industrial Control Systems (ICS)-role account from Virtual Private Network (VPN)-assigned Internet Protocol (IP) address correlated with remote access authentication anomaly'}
x_mitre_log_sources		{'name': 'WinEventLog:Security', 'channel': 'Windows Security Event ID 4624/4625: EventCode=4624, Type 3/10 between Industrial Control Systems (ICS) hosts not in approved lateral movement pairs'}
x_mitre_log_sources		{'name': 'WinEventLog:Security', 'channel': 'Windows Security Event ID 4624/4625: EventCode=4624 for account matching default or hardcoded credential patterns from source not in approved host list'}

[DC0016] Module Load

Current version: 3.1

Version changed from: 3.0 → 3.1

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.778000+00:00	2026-10-13 17:43:48.544000+00:00
x_mitre_version	3.0	3.1

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=7; scripting-engine module loads when useful '}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=7; System.Management.Automation or unusual PowerShell-related modules'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: DexClassLoader() or dlopen() called with path argument matching file written in preceding $DecryptExecWindow$'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: DexClassLoader() or dlopen() on path written within $StegoExecWindow$ of media download event — download-write-load chain confirms steganographic payload delivery'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: DexClassLoader() called at runtime with path NOT matching any file in original APK manifest within $PackerExecWindow$ of app launch'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': "Dynamic API/runtime trace: DexClassLoader() or System.load() or WebView.loadUrl(javascript:) called with content_source='network_download' within $CodeDownloadWindow$ of download event"}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=init_module/finit_module; kernel module loaded from a path or hash not in the authorized ICS host module baseline'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=7 of Industrial Control Systems (ICS) vendor communication Dynamic Link Library (DLL) with hash not in signed baseline'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=7 where an ICS/vendor DLL is loaded by an image outside the authorized ICS application baseline'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=7 of GDI32.dll/User32.dll by process not in authorized screen capture tools on Human-Machine Interface (HMI)-classified host'}

[DC0082] Network Connection Creation

Current version: 2.2

Version changed from: 2.1 → 2.2

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.770000+00:00	2026-10-13 17:43:42.443000+00:00
x_mitre_version	2.1	2.2

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'linux:osquery', 'channel': 'socket_events to broker/service, where deployed'}
x_mitre_log_sources		{'name': 'linux:osquery', 'channel': 'socket_events to DNS/DoH/DoT destinations, where deployed'}
x_mitre_log_sources		{'name': 'linux:osquery', 'channel': 'socket_events for Python-originated connections, where deployed'}
x_mitre_log_sources		{'name': 'linux:osquery', 'channel': 'socket_events for runtime-originated connections, where deployed '}
x_mitre_log_sources		{'name': 'NetworkDevice:Syslog', 'channel': 'Permitted/denied connection creation where network devices record it'}
x_mitre_log_sources		{'name': 'NSM:Connections', 'channel': 'New device-to-broker relationship outside documented profile'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=3; process-to-broker connection'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=3; connection to DNS/DoH destination with process identity'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=3; Python-originated connection to OT or external destination'}
x_mitre_log_sources		{'name': 'android:EnterpriseNetworkLog', 'channel': 'DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata'}
x_mitre_log_sources		{'name': 'iOS:NetworkExtension', 'channel': 'NEFilterFlow / per-app VPN / secure-web-gateway flow metadata'}
x_mitre_log_sources		{'name': 'NSM:Connections', 'channel': 'device establishes new network connections or activates protocols not seen in pre-reboot baseline'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): bind/listen/connect syscalls show one process accepting ICS-protocol connections while also initiating an outbound connection to a non-ICS destination'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): execve of scripting interpreter with sustained network connect() calls to device subnet at rate exceeding poll baseline, by User Identifier (UID) not in service account allowlist'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): firmware updater connecting to device on firmware port, by User Identifier (UID) not in authorized firmware manager UIDs, outside maintenance window schedule'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): connect() syscall on port (e.g., 80, 443, 8080, etc.) to destination not in approved vendor domains, from Industrial Control Systems (ICS) service process'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): write Application Programming Interface (API) invocation rate to single Input/Output (I/O) point from Industrial Control Systems (ICS) service User Identifier (UID) exceeds max write rate per point'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): connect syscalls show a host outside the approved SCADA/master set opening ICS-protocol connections to multiple field devices'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): connect syscall from an ICS service/application process to a destination outside the approved network or vendor-service baseline'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): socket/connect activity from a process outside the approved ICS monitoring-tool baseline to an ICS multicast destination/group'}
x_mitre_log_sources		{'name': 'NSM:Connections', 'channel': 'device process crash or unexpected restart immediately followed by privileged protocol command succeeding from same source session'}
x_mitre_log_sources		{'name': 'NSM:Connections', 'channel': 'rapid sequential connection attempts to same device Internet Protocol (IP) address across multiple Industrial Control System (ICS) protocol ports from source not in approved Supervisory Control and Data Acquisition (SCADA) servers'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=3 process holds connections to both device subnet and external/inter-zone destination simultaneously, combined with proxy-capable process spawn'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=3 to device subnet within auth-to-device window of the anomalous logon'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=3 network connection to an RDP/VNC service on an ICS Windows host from a source outside the approved management CIDR baseline'}
x_mitre_log_sources		{'name': 'WinEventLog:Security', 'channel': 'EventCode=5157 or firewall rule changes blocking Industrial Control Systems (ICS) command message traffic'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=3 on remote service ports (e.g., 22, 445, 3389, 5985/5986) between hosts not in approved communication matrix'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'Microsoft-Windows-Sysmon/Operational Event ID 3 NetworkConnect: inbound connection rate to Industrial Control Systems (ICS) application port exceeds threshold per minute from unexpected sources'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=3 on port 80/443/8080 from process not matching Industrial Control Systems (ICS) vendor update process allowlist'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=3 same process holding connections to both device subnet and external Internet Protocol (IP) address simultaneously'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=3 from resulting process to destinations not in approved destinations list'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=3 unexpected Windows host opening Industrial Control Systems (ICS) protocol connections to multiple field device Internet Protocol (IP) addresses in polling pattern characteristic of master station'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=3 on Hypertext Transfer Protocol (HTTP)/Hypertext Transfer Protocol Secure (HTTPS)/Domain Name System (DNS) port from process not recognized as Industrial Control Systems (ICS) vendor application'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=3 to device subnet from process not in authorized Industrial Control Systems (ICS) applications'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=3 outbound User Datagram Protocol (UDP) broadcast traffic from process not in recognized Industrial Control Systems (ICS) asset management tools'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=3 outbound connection from a process outside the approved ICS monitoring-tool baseline to an ICS multicast destination'}

[DC0085] Network Traffic Content

Current version: 2.2

Version changed from: 2.1 → 2.2

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.771000+00:00	2026-10-13 17:43:41.384000+00:00
x_mitre_version	2.1	2.2

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'Pub/sub protocol, client ID, topic/queue and message metadata when observable'}
x_mitre_log_sources		{'name': 'NetworkDevice:IDS', 'channel': 'DoH/DoT identification, SNI/HTTP host when observable, DNS tunneling signatures'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'Protocol identification; MQTT CONNECT/SUBSCRIBE/PUBLISH, AMQP/DDS metadata where parsable'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'MQTT/AMQP/DDS protocol and message metadata when visible'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'MQTT/AMQP/DDS protocol identification, broker/topic/client metadata when visible'}
x_mitre_log_sources		{'name': 'NSM:DNS', 'channel': 'Native DNS query/response content: long/encoded labels, TXT use, unusual query structure'}
x_mitre_log_sources		{'name': 'NSM:DNS', 'channel': 'Native DNS query/response content'}
x_mitre_log_sources		{'name': 'NSM:DNS', 'channel': 'DNS query/response metadata and content'}
x_mitre_log_sources		{'name': 'NSM:DNS', 'channel': 'Device DNS query/response content'}
x_mitre_log_sources		{'name': 'NSM:TLS/HTTP', 'channel': 'SNI/HTTP host or resolver endpoint identification when observable'}
x_mitre_log_sources		{'name': 'webproxy:applog', 'channel': 'DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'session on firmware-capable port exceeds session size threshold from source not in engineering workstation list outside change control window'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'firmware write service targeting specific slot/rack address from source not in engineering workstation list outside change control window'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'large session on firmware-capable port from source not in engineering workstation list outside change control window'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'write/control command traffic from source not in approved Supervisory Control and Data Acquisition (SCADA) servers directed at multiple distinct device IPs within rogue master time window'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'task/organization-block modification service from source not in engineering workstation list outside change control window'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'S7comm Download Block / Common Industrial Protocol (CIP) Download Program / Distributed Network Protocol (DNP3) program file transfer to device_ip from source not in engineering workstation list within mode change to download window of mode-change event'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'write to existing program block address from source not in engineering workstation list outside change control window'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'download of block address not previously present in device program inventory, from source not in engineering workstation list'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'decoded ICS protocol unsolicited response or OPC UA data-change message for a device/address not normally owned by the observed source'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'decoded ICS protocol write/setpoint operation to a control/output address from a client identity or source not in the approved control-application baseline'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'OPC UA Browse/BrowseNext request to namespace or system-information objects from a client identity or source not in the approved monitoring baseline'}
x_mitre_log_sources		{'name': 'dns:querylog', 'channel': 'Domain Name System (DNS) query from Industrial Control Systems (ICS) host to domain not in approved vendor domains, particularly domains exhibiting Domain Generation Algorithm (DGA)-like patterns'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'source not in approved Supervisory Control and Data Acquisition (SCADA) servers issuing reads covering sequential address ranges across multiple device Internet Protocol (IP) addresses within auto collection time window'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'malformed Protocol Data Unit (PDU) rate to device_ip exceeds threshold within detection window from source not in approved Supervisory Control and Data Acquisition (SCADA) server list'}
x_mitre_log_sources		{'name': 'zeek:ssl', 'channel': 'Transport Layer Security (TLS) Server Name Indication (SNI) or certificate issuer does not match approved vendor domains or recognized Content Delivery Network (CDN) serving vendor content'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'EtherNet/IP ListIdentity broadcast or sequential Industrial Control System (ICS) protocol connection attempts across Internet Protocol (IP) range from source not in approved Supervisory Control and Data Acqusition (SCADA) servers'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'structurally valid Industrial Control System (ICS) protocol message from source not in approved communication baseline for the destination device_ip'}
x_mitre_log_sources		{'name': 'otids:ProtocolDecoder', 'channel': 'SNMP request/response decoder: OID, operation type, source/destination; flag access to undocumented/vendor-internal OIDs from non-approved NMS sources'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'read-only function codes from source not in approved Supervisory Control and Data Acquisition (SCADA) servers at rate exceeding baseline poll rate or covering address ranges outside known tag ranges'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'Open Platform Communications Unified Architecture (OPC UA) BrowseNamespace or Distributed Network Protocol 3 (DNP3) object 0 all-variation read or Common Industrial Protocol (CIP) Get_Attributes_All from source not in approved Supervisory Control and Data Acquisition (SCADA) servers, covering above namespace coverage threshold percent of device tag space'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'Generic Object Oriented Substation Event (GOOSE) dataset stNum value decreases (replay indicator) or test-mode bit asserted on protection relay without scheduled maintenance'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'mode-change service from source not in engineering workstation list outside change control window'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'write to alarm threshold address range from source not in approved write sources with new value outside safe alarm threshold range'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'write/operate command targeting safety-critical output addresses from source not in approved Supervisory Control and Data Acquisition (SCADA) servers'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'restart/reset service from source not in engineering workstation list outside change control window'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'firmware-update-mode activation service from source not in engineering workstation list outside change control window'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'write function code to same register address at rate exceeding max write rate per point within brute force detection window'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'write function code (FC 6/16) to setpoint address range with value outside baseline value range, or from source not in approved write sources'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'device authentication session from source Media Access Control (MAC)/Internet Protocol (IP) address not enrolled as authorized engineering workstation, with valid credential'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'authentication success using credential matching default vendor credential list from source not in engineering workstation list'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'credential/access code change command from source not in approved security admin list'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'device authentication success using credential pattern matching known hardcoded credential patterns from source not in approved access list'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'authentication success using credential matching default vendor credential list or known hardcoded credential patterns from source not in engineering workstation list'}
x_mitre_log_sources		{'name': 'otids:ProtocolDecoder', 'channel': 'Decoded OT/file-transfer transaction: transfer operation, source/destination, object/file identifier where exposed by the protocol, outside approved engineering/change window'}
x_mitre_log_sources		{'name': 'otids:ProtocolDecoder', 'channel': 'Decoded DNP3/IEC 61850 file-transfer transaction: source/destination and file/object identifier where exposed; correlate with approved engineering source and change window'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'restart/reset service from source not in engineering workstation list, with more than one device receiving the command within bulk restart time window'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'GetIdentity/Identity Object response vendor/product string does not match enrolled asset inventory for device_ip'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'CIP Port Object Get_Attribute_All or topology query from source not in approved Supervisory Control and Data Acquisition (SCADA) servers'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'EtherNet/IP ListIdentity or Modbus broadcast from source Media Access Control (MAC) address not in approved device inventory'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'Internet Group Management Protocol (IGMP) join or Generic Object Oriented Substation Event (GOOSE) multicast subscription from source Media Access Control (MAC) address not in approved device inventory'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'Hypertext Transfer Protocol (HTTP) request to device management web interface with exploit-pattern payload from source not in engineering workstation list'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'protocol-level latency inconsistent with direct communication, or Media Access Control (MAC)/Internet Protocol (IP) address binding change for device_ip'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'transaction identifier reuse pattern or function-code distribution deviates from established per-device baseline within Adversary in the Middle (AiTM) correlation window of the Media Access Control (MAC) address binding change'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'single session reads address range covering above full image coverage threshold percent of device total Input/Output (I/O) space, from source not in approved Supervisory Control and Data Acquisition (SCADA) servers'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'write/control method invocation from client identity not in approved application list'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'malformed or oversized Industrial Control System (ICS) protocol message from unexpected source followed by device behavioral anomaly (reboot, mode change) within a short window'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'malformed or exploit-payload data via built-in communication interface from external source'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'vendor diagnostic function code with payload matching code execution pattern from source not in engineering workstation list'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'anomalous protocol exchange preceding device behavioral change (reboot, altered configuration)'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': "deterministic function code response content diverges from the device's established per-function response baseline without a corresponding firmware update event"}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'bulk read of configuration/data dictionary objects from source with no prior session history with this device'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'event buffer clear or log clear service from source not in engineering workstation list, correlated with preceding suspicious activity on the same device'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'reserved or vendor-specific function code accessing device registers directly from source not in engineering workstation list'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'bulk configuration/program object read from source with no prior configuration-read session history'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'Initialize_Memory or MEMORY_RESET service from source not in engineering workstation list'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'S7comm Upload Block / Common Industrial Protocol (CIP) Read Program session from source not in engineering workstation list with bytes_recv exceeding program upload size threshold'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'S7comm SZL Central Processing Unit (CPU)-state read or Common Industrial Protocol (CIP) Identity Object state attribute read from source not in approved Supervisory Control and Data Acquisition (SCADA) servers'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'SZL module inventory, Identity Object, or Device Attributes query from source not in approved Supervisory Control and Data Acquisition (SCADA) servers'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'S7comm Upload ALL or Common Industrial Protocol (CIP) full program upload from source not in engineering workstation list, bytes_recv exceeding full upload size threshold'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'online block edit service from source not in engineering workstation list outside change control window, with device remaining in RUN mode throughout'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'Virtual Network Computing (VNC) connection or screen-capture Hypertext Transfer Protocol (HTTP) request to embedded Human-Machine Interface (HMI) panel from source not in approved operator workstation list'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'Virtual Network Computing (VNC) or remote console session to embedded Human-Machine Interface (HMI) panel from source not in approved management Classless Inter-Domain Routing (CIDR) subnet'}
x_mitre_log_sources		{'name': 'otids:ProtocolDecoder', 'channel': 'Protocol decoder/IDS transaction: traffic on an ICS service port fails expected protocol parsing/conformance or decodes as a different application protocol'}
x_mitre_log_sources		{'name': 'otids:ProtocolDecoder', 'channel': 'Protocol decoder/IDS transaction/signature: exploit-relevant request against ICS remote service from unexpected source, correlated with subsequent endpoint/device anomaly'}
x_mitre_log_sources		{'name': 'zeek:conn', 'channel': 'exploit-pattern traffic to Industrial Control Systems (ICS) server/device Internet Protocol (IP) from unexpected source, followed by behavioral anomaly within a short window'}

[DC0078] Network Traffic Flow

Current version: 2.2

Version changed from: 2.1 → 2.2

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.777000+00:00	2026-10-13 17:43:50.375000+00:00
x_mitre_version	2.1	2.2

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'NSM:Flow', 'channel': 'Device-to-broker flow metadata'}
x_mitre_log_sources		{'name': 'NetworkProxy:HTTPSFlow', 'channel': 'bytes_out in range $CredentialDumpMin$..$CredentialDumpMax$ to dest NOT IN $AppCDNList$ within $ExfilWindow$ of MDM jailbreak detection — credential dump size range (small but dense) to novel destination indicates Keychain exfiltration'}
x_mitre_log_sources		{'name': 'NSM:Flow', 'channel': 'Source/destination/port/session metadata'}
x_mitre_log_sources		{'name': 'NSM:Flow', 'channel': 'Client/broker flow metadata'}
x_mitre_log_sources		{'name': 'NSM:Flow', 'channel': 'Client/broker connection metadata and periodicity'}
x_mitre_log_sources		{'name': 'NSM:Flow', 'channel': 'Direct external DNS or HTTPS/TLS flow bypassing designated resolver/proxy'}
x_mitre_log_sources		{'name': 'NSM:Flow', 'channel': 'External DNS/HTTPS/TLS flow bypassing approved resolver/proxy'}
x_mitre_log_sources		{'name': 'NSM:Flow', 'channel': 'Client-to-resolver or client-to-DoH endpoint flow'}
x_mitre_log_sources		{'name': 'NSM:Flow', 'channel': 'Device-to-resolver/DoH destination flow'}
x_mitre_log_sources		{'name': 'android:EnterpriseNetworkLog', 'channel': 'DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata'}
x_mitre_log_sources		{'name': 'iOS:NetworkExtension', 'channel': 'NEFilterFlow / per-app VPN / secure-web-gateway flow metadata'}
x_mitre_log_sources		{'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): connection rate to device_ip exceeds Denial of Service (DoS) threshold per minute from single or distributed sources'}
x_mitre_log_sources		{'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): flow volume to Industrial Control Systems (ICS) device subnet exceeds Denial of Service (DoS) flow threshold per minute'}
x_mitre_log_sources		{'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): traffic from newly-authenticated device to Industrial Control System (ICS) application server within onboard window of association'}
x_mitre_log_sources		{'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): source not in approved Supervisory Control and Data Acquisition (SCADA) servers generating high volume of short-duration flows to device subnet at regular intervals'}
x_mitre_log_sources		{'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): Trivial File Transfer Protocol (TFTP) session to device Internet Protocol (IP) address from source not in engineering workstation list followed by device reboot syslog within firmware transfer window'}
x_mitre_log_sources		{'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): egress flow on port 443/80/8080/53 from Industrial Control Systems (ICS) host in no-external-connectivity role list to destination not in approved vendor domains'}
x_mitre_log_sources		{'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): source generates flows to every IP in device subnet in sequential order within discovery time window'}
x_mitre_log_sources		{'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): Internet Control Message Protocol (ICMP) echo requests or Address Resolution Protocol (ARP) broadcasts to all Internet Protocol (IP) addresses in subnet sequentially from single source within discovery time window'}
x_mitre_log_sources		{'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): inbound exploit-pattern traffic to Industrial Control Systems (ICS) Demilitarized Zone (DMZ) server followed by outbound connection from same Internet Protocol (IP) address to internal ICS network'}
x_mitre_log_sources		{'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): connection from newly-observed device to Industrial Control Systems (ICS) application server within new device window of first network appearance'}
x_mitre_log_sources		{'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): sustained high-byte-count flow from Industrial Control Systems (ICS) server Internet Protocol (IP) address to destination outside ICS zone following bulk read activity'}
x_mitre_log_sources		{'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): host maintains simultaneous flows to device subnet and external destination with timing/byte-count correlation indicating relay'}
x_mitre_log_sources		{'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): next-hop change for device subnet traffic or unexpected path through new gateway not in expected next-hop baseline'}
x_mitre_log_sources		{'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): sequential connections from single source to multiple device Internet Protocol (IP) addresses resulting in large response payloads characteristic of directory listing'}
x_mitre_log_sources		{'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): new device Media Access Control (MAC) address on Industrial Control Systems (ICS) network generating ICS master-pattern traffic such as polling multiple device Internet Protocol (IP) addresses on ICS protocol ports'}
x_mitre_log_sources		{'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): firmware-mode activation protocol session from source not in engineering workstation list'}
x_mitre_log_sources		{'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): connection from Virtual Private Network (VPN)-assigned Internet Protocol (IP) address into device subnet within remote access to Industrial Control Systems (ICS) window of the anomalous authentication'}
x_mitre_log_sources		{'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): new east-west connection between Industrial Control Systems (ICS) hosts on remote service ports not in approved communication matrix'}
x_mitre_log_sources		{'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): first-seen connection from a source to an Industrial Control System (ICS) device outside the documented approved communication matrix'}
x_mitre_log_sources		{'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): source generates short-lived flows to single dst across multiple Industrial Control Systems (ICS) protocol ports (502,102,44818,20000,4840) within port scan time window, source not in approved Supervisory Control and Data Acquisition (SCADA) servers'}
x_mitre_log_sources		{'name': 'networkdevice:snmp', 'channel': 'Simple Network Management Protocol (SNMP) GET to system info OID from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet'}
x_mitre_log_sources		{'name': 'networkdevice:snmp', 'channel': 'new Internet Group Management Protocol (IGMP) join or broadcast traffic spike on Industrial Control Systems (ICS) Virtual Local Area Network (VLAN) from source not in approved device inventory'}
x_mitre_log_sources		{'name': 'networkdevice:snmp', 'channel': 'Internet Group Management Protocol (IGMP) membership report for Industrial Control Systems (ICS) multicast group from source not in approved device inventory'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'write function code targeting alarm config address range from source not in approved write sources within suppress grace period of the alarm status change'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'non-standard or malformed packet to device-specific diagnostic port immediately preceding a device-offline alarm'}
x_mitre_log_sources		{'name': 'NSM:Connections', 'channel': 'one Industrial Control System (ICS) traffic type (command or reporting) to/from device_ip ceases while other traffic types continue normally'}
x_mitre_log_sources		{'name': 'NSM:Flow', 'channel': 'reporting message for device_ip originates from src_mac not matching enrolled hardware address for that Internet Protocol (IP)'}
x_mitre_log_sources		{'name': 'NSM:Connections', 'channel': 'command-type traffic to device_ip absent while other traffic types (polling, reporting) to the same device continue normally'}
x_mitre_log_sources		{'name': 'NSM:Connections', 'channel': 'device_ip generates no outbound unsolicited traffic while responding normally to inbound polls'}
x_mitre_log_sources		{'name': 'NSM:Connections', 'channel': 'embedded device_ip initiates outbound connection on port 443/80/8080 to destination outside documented operational profile'}
x_mitre_log_sources		{'name': 'NSM:Connections', 'channel': 'inbound connection to field device Internet Protocol (IP) address from source outside RFC1918/organizational IP space on Industrial Control System (ICS) protocol port'}
x_mitre_log_sources		{'name': 'NSM:Connections', 'channel': 'Connection/session metadata: embedded device opens HTTP/HTTPS/DNS session to destination outside approved ICS communication baseline'}
x_mitre_log_sources		{'name': 'NSM:Connections', 'channel': 'Connection/session metadata: management-port session to field device originates through external remote-access infrastructure rather than approved internal management path'}
x_mitre_log_sources		{'name': 'NSM:Connections', 'channel': 'field device Internet Protocol (IP) initiates connection to another field device IP, not in approved device-to-device communication matrix'}
x_mitre_log_sources		{'name': 'NSM:Connections', 'channel': 'multiple device Internet Protocol (IP) addresses become unreachable simultaneously following network infrastructure config change event'}
x_mitre_log_sources		{'name': 'NSM:Flow', 'channel': 'unsolicited response message source identity does not match the enrolled device for those data points'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'device_ip observed with src_mac differing from enrolled hardware address without corresponding topology change ticket'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'write function code to output register address range from source not in approved write sources'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'deauthentication flood targeting enrolled Industrial Control Systems (ICS) wireless device Media Access Control (MAC) addresses from source not in approved wireless infrastructure'}
x_mitre_log_sources		{'name': 'perimeter:firewall', 'channel': 'inbound connection to Industrial Control Systems (ICS) device/server Internet Protocol (IP) address on ICS protocol port from source not in organizational IP space'}
x_mitre_log_sources		{'name': 'wireless:spectrum', 'channel': 'Radio Frequency (RF) signal detected on Industrial Control Systems (ICS) wireless frequencies from Media Access Control (MAC) address not in approved wireless device inventory without completed association sequence'}
x_mitre_log_sources		{'name': 'zeek:ssl', 'channel': 'Zeek ssl.log/TLS metadata: server_name (SNI), certificate chain/issuer/subject where available; compare with approved vendor domains/certificates'}

[DC0021] OS API Execution

Current version: 2.2

Version changed from: 2.1 → 2.2

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.775000+00:00	2026-10-13 17:43:47.873000+00:00
x_mitre_version	2.1	2.2

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'MobileEDR:telemetry', 'channel': 'UIDevice.current.model AND CMMotionManager.isDeviceMotionAvailable AND UIScreen.main.scale all read within $EnvCheckWindow$ at cold launch by app NOT IN $SystemEnumAllowList$'}
x_mitre_log_sources		{'name': 'MobileEDR:telemetry', 'channel': 'System.getProperty() AND SensorManager.getSensorList() AND getNetworkInterfaces() all called > $EnvCheckThreshold$ calls within $EnvCheckWindow$ by app NOT IN $SystemEnumAllowList$ where app_state=background'}
x_mitre_log_sources		{'name': 'iOS:unifiedlog', 'channel': 'kernel fault referencing ptrace OR task_for_pid OR get-task-allow outside developer-signed build + MDM integrity_check=fail within KernelFaultWindow where no developer entitlement justifies kernel-level process access'}
x_mitre_log_sources		{'name': 'MobileEDR:telemetry', 'channel': 'PackageInstaller.install() with install_initiator NOT IN ApprovedInstallSources + MDM policy_violation raised within InstallWindow where approved sources do not include this installer origin'}
x_mitre_log_sources		{'name': 'MobileEDR:telemetry', 'channel': 'ptrace with action IN (PTRACE_ATTACH, PTRACE_POKETEXT, PTRACE_POKEDATA, PTRACE_SETREGS) where caller_uid != target_uid + MDM developer_mode=false within PtraceWindow where no debug session justifies memory write to unrelated process'}
x_mitre_log_sources		{'name': 'MobileEDR:telemetry', 'channel': 'process accesses memory region or task port beyond declared entitlement set + MDM integrity_check=fail within same device session where declared entitlements do not justify observed resource access'}
x_mitre_log_sources		{'name': 'MobileEDR:telemetry', 'channel': 'ptrace(PTRACE_ATTACH) from caller_pid where caller is NOT parent of target AND NOT in DebuggerAllowList + MDM usb_debug=false within PtraceWindow where developer context does not justify cross-process attach'}
x_mitre_log_sources		{'name': 'MobileEDR:telemetry', 'channel': 'dylib loaded into process address space with path OR behavioral hash matching KnownJailbreakLibPatterns + MDM compliance=pass within same device session where compliance posture does not justify library presence'}
x_mitre_log_sources		{'name': 'MobileEDR:telemetry', 'channel': 'execve/execveat with effective UID=0 from path NOT IN KnownSystemBinPaths + MDM compliance root_status=false within same device context where compliance state does not justify elevated execution'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes DevicePolicyManager.lockNow(), creates persistent fullscreen overlay (TYPE_APPLICATION_OVERLAY covering full screen), or uses accessibility to block UI interaction — lock or UI-denial API invocation'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Background work scheduler or persistent service triggered the platform retrieval without user interaction'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Background task or networking subsystem event immediately before platform retrieval'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes DevicePolicyManager.resetPassword(), lockNow(), wipeData(), or setCameraDisabled() immediately after Device Admin activation without MDM-initiated policy context or user interaction'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes file management, storage-clear, or wipe operations in background state following network upload without user-initiated delete action'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes custom TLS trust evaluation, OkHttp CertificatePinner, or custom-anchor TrustManager NOT IN $ApprovedPinningApps$ — custom pin validation is the evasion mechanism'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes RSA/ECC keypair generation, public-key import, or asymmetric encryption operations (KeyPairGenerator, Cipher.RSA, ECDH) NOT IN $ApprovedCryptoApps$ before network transmission'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Keypair generation, import, or private-key access events occurring prior to outbound communication not matching app declared secure-communication function'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: MediaProjection capture session, accessibility-based foreground content observation, or privileged screencap/screenrecord invocation from app while different app is foregrounded — cross-app screen content access'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Multiple applications invoking core system APIs (sensor, permission, telephony, PackageManager) show inconsistent, suppressed, or modified return values compared to OS-expected behavior — cross-app API result inconsistency is the runtime hi'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Device integrity degradation (root detected, system partition modification, SafetyNet/Play Integrity failure) coincident with anomalous system API behavior affecting runtime resolution'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes PackageInstaller uninstall or pm uninstall for own package or companion package NOT IN $ProtectedPackageList$ without user-initiated UI flow matching'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Background scheduler or persistent service triggers retrieve-then-write cycle'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Background task activation immediately before retrieve-then-write cycle on supervised device'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Application registers BroadcastReceiver via registerReceiver() or manifest-declared receiver for sensitive system intents (BOOT_COMPLETED, SMS_RECEIVED, ACTION_PACKAGE_REPLACED, CONNECTIVITY_CHANGE, USER_PRESENT) NOT IN $ApprovedReceiverApp'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes PackageManager.setComponentEnabledSetting() to COMPONENT_ENABLED_STATE_DISABLED on its own LAUNCHER activity while continuing active background or foreground-service execution'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Unified Log entry at level=fault in subsystem com.apple.kernel or com.apple.sandbox within $KernelFaultWindow$ of integrity_check failure — kernel-level fault coincident with integrity failure is the exploit-execution signal; requires super'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: ConnectivityManager, TelephonyManager, or WifiManager framework callbacks report repeated failure, disable, or oscillation events outside expected coverage-transition pattern'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: ContentResolver, DocumentProvider, StorageAccessFramework, or bulk stream I/O invocations exceed $FileModificationRateThreshold$ operations per minute across distinct file paths — API-level operation rate distinguishes ransomware from norma'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Known application begins first-seen or expanded use of content providers, account services, accessibility, or network destinations not in $AppBehaviorBaseline$ post-update'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Known app begins first-seen use of protected framework categories (location, microphone, contacts) or background task patterns post-update'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App begins first-seen network connections to destinations matching known-malicious SDK C2 patterns or outside $SDKBaselineEndpoints$ for embedded SDK namespace'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Known app begins first-seen use of protected categories (analytics, location, contacts) matching known-SDK behavior patterns post-update'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Recently updated trusted app invokes special-access paths, account services, or accessibility not present in prior version baseline'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Launch services, extension-handling, or framework subsystem anomalies occur near install or first launch of recently updated trusted app on supervised device'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App uses background work scheduler, JobScheduler, or persistent service to trigger web-service resolver fetch without user interaction'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Background task or networking subsystem event occurs immediately before web-service resolver fetch'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Background work scheduler, foreground service, or persistent service activates'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Background task or persistent networking event activates'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Accessibility-enabled app NOT IN $AccessibilityAllowList$ invokes performAction() click, global action (GLOBAL_ACTION_BACK/HOME/RECENTS), or insertText() on a UI element belonging to a different foregrounded app — cross-app UI action is the'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App intercepts notification content from source_app IN $HighValueNotifApps$ (banking, auth, messaging) while AppState=background'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes cryptographic functions (javax.crypto.Cipher, Android KeyStore, AES/RSA/ECC operations) on data buffer followed by encode-then-transmit sequence NOT matching app declared network function — app-layer crypto on data before transm'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes ContentResolver or SAF (Storage Access Framework) queries across multiple user-data paths outside its own sandbox in background state'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Managed app accesses broad local data scope without user-initiated document picker interaction on supervised device'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes startForegroundService() or startForeground() NOT IN $ApprovedForegroundServiceApps$'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes DownloadManager, URLConnection, or OkHttp download to write retrieved content to app-controlled path outside original APK scope — programmatic download of executable artifact'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Managed app performs post-download processing, dynamic resource handling, or module preparation immediately after retrieval from non-CDN source on supervised device'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App loads native library (.so) or resolves JNI bridge NOT IN $ApprovedNativeLibraries$ immediately before suspicious lower-level activity (sensor access, file write, network connection) — native code loading before anomalous activity is the'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App transitions from managed-code execution into JNI/native function context or attaches native thread,'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App is replaced or reinstalled'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App enqueues WorkManager work, schedules JobScheduler job, or sets AlarmManager with repeating interval NOT IN $ApprovedSchedulerApps$'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Managed app creates NSBackgroundActivityScheduler activity or registers BGTask with repeating=true or deferred interval outside $ApprovedSchedulerApps$ function'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App initializes proxy-capable or raw-socket networking constructs (ServerSocket, SOCKS proxy client, bidirectional relay) NOT IN $ApprovedProxyApps$ — proxy initialization is the technique enabler'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes TelecomManager.answerCall(), placeCall(), endCall(), or ConnectionService call-handling operations without corresponding user-initiated call UI interaction'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App process loads external code module or native library from non-system path injected into zygote or app_process runtime — abnormal library injection path is the hooking mechanism indicator'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes SensorManager.registerListener() for TYPE_ACCELEROMETER or TYPE_GYROSCOPE NOT IN $ApprovedMotionApps$ followed by conditional execution branching correlated with sensor readings — motion sensing followed by behavioral conditiona'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes ZIP, GZIP, or bulk-buffer packaging routines (ZipOutputStream, DeflaterOutputStream, similar) on previously accessed local data in background state'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App applies encryption to newly created archive or staged data blob before network transmission — encrypt-after-archive confirms adversary-controlled packing for exfil'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App performs bulk data transformation or packaging-like processing on collected records prior to outbound transfer on supervised device'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App registers BroadcastReceiver or schedules job for system events (BOOT_COMPLETED, SMS_RECEIVED, ACTION_PACKAGE_REPLACED, CONNECTIVITY_CHANGE, ACTION_USER_PRESENT) NOT IN $ApprovedEventTriggerApps$ — sensitive system event registration is'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App loads library or executes component'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes privileged framework APIs (accessibility performAction, WindowManager.addView TYPE_APPLICATION_OVERLAY, PackageInstaller) immediately after acquiring elevation control mechanism without expected user settings navigation time'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App performs burst of environmental check APIs (Build properties, TelephonyManager IMSI, PackageManager security-tool query) at cold launch before user interaction — multi-category environment fingerprint is the guardrail setup'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App performs UIDevice model + iOS version + enrollment state checks at cold launch before user interaction — device fingerprinting guardrail setup'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes package management, DevicePolicyManager, or settings operations capable of disabling security tooling — API invocation to disable security control'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes accessibility global actions (back, home, recents) or DevicePolicyManager removal-resistance operations when package-management or uninstall UI is in foreground — active uninstall interference'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes package manager operations (disable component, clear data, request uninstall) or settings modifications targeting security tool packages IN $SecurityToolPackageList$'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes file deletion, database truncation, log clearing, or app-data-clear operations within $CleanupWindow$ of prior data access or network exfiltration event — post-exfil cleanup chain'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes file deletion, container-local database truncation, or cache-clear operations on supervised device within $CleanupWindow$ of prior data access or upload event'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Protected resource use, privileged API invocation, or telephony/accessibility/overlay access occurs from system-app context while device is locked or before normal setup completion'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Supplemental baseband, IOKit, accessory, security, or activation-related subsystem anomalies on supervised device at activation — Unified Log supplemental confirmation'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): dlopen() of Industrial Control Systems (ICS) vendor shared library by process not in authorized ICS applications, followed by write-capable network connection to device subnet'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): ioctl or mmap syscall against Industrial Control Systems (ICS) hardware device file from process not in authorized ICS applications'}
x_mitre_log_sources		{'name': 'edr:Syscall', 'channel': 'DeviceIoControl or raw socket creation to Industrial Control Systems (ICS) protocol port from process not in authorized ICS applications, bypassing documented vendor Software Development Kit (SDK) call pattern'}

[DC0032] Process Creation

Current version: 2.2

Version changed from: 2.1 → 2.2

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.773000+00:00	2026-10-13 17:43:45.184000+00:00
x_mitre_version	2.1	2.2

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'execve for python/python3 and script path/arguments'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'execve for node/nodejs or JavaScript runtime and child processes '}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'execve for shell/interpreter and child commands '}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'syscall=execve; command or executable associated with the technique runs outside the approved ICS administrative/application baseline'}
x_mitre_log_sources		{'name': 'WinEventLog:Security', 'channel': 'EventCode=4688; cmd.exe/batch execution with parent and command line '}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1; Python interpreter/script execution and lineage'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1; process lineage and command line'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1; powershell/pwsh or suspicious parent-child chain'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon ', 'channel': 'EventCode=1; wscript.exe/cscript.exe/mshta.exe and child-process lineage '}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Application invokes Runtime.exec(), ProcessBuilder.start(), or JNI-backed launcher with sh, bash, toybox, toolbox, or su as command argument NOT IN $ApprovedShellApps$ — explicit Unix shell invocation'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Managed iOS app invokes process-launch behavior resulting in sh, bash, or equivalent shell child process on supervised device — any shell spawn on stock iOS is a jailbreak indicator'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'execve()'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'com.apple.WebKit or com.apple.WebContent process fault at level=fault within $DriveByWindow$ of navigation to flagged URL — kernel fault in WebKit subsystem is the exploit-execution signal'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'execve() of modified binary (hash != baseline) — execution of modified binary is the persistence activation'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'com.apple.WebContent or com.apple.imagent process shows unexpected child spawn or memory fault at level=fault in Unified Log — kernel fault in message-processing subsystem is exploit execution signal'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'execve() from APK installed within $PhishingWindow$ of navigation to flagged URL — first execution confirms malware activation'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': "sh or cmd process spawned with arguments containing 'pm uninstall' or 'rm' by parent NOT IN $MDMAgentPackageList$ — shell invocation for destruction commands"}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'kernel fault or unexpected child spawn in subsystem IN (com.apple.WebKit, com.apple.imtransferagent, com.apple.imagent) at level=fault in Unified Log'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Application installed with install_source=adb or install_source=sideload from USB-connected host within $USBInstallWindow$ of USB mode change'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'App invokes Runtime.exec(), ProcessBuilder.start(), or JNI-backed command execution framework to spawn shell or command interpreter process NOT IN $ApprovedShellApps$ — programmatic shell spawn is the interpreter invocation'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Managed iOS app invokes lower-level process-launch behavior or command-execution-equivalent activity outside sandbox-permitted APIs on supervised device'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'App execution triggered with unexpected parent context or via indirect invocation (intent redirect, implicit intent resolution to unexpected handler) — indirect invocation path is the flow hijack confirmation'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; command line invokes iptables/nftables to change ICS traffic filtering or redirection outside the authorized network-administration baseline'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; mount/udisksctl invoked to mount a removable block device on an ICS asset outside the approved removable-media workflow'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): execve with path under /media/ or /mnt/ removable mount point within Universial Serial Bus (USB) execution window of mount event'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): execve of network discovery tool (nmap, arp-scan, PLCScan) by User Identifier (UID) not in authorized net admin UIDs'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): unexpected process creation from web server daemon User Identifier (UID) spawning shell process'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): Secure Shell (SSH)-based propagation pattern (connection to multiple hosts followed by file transfer and execution) within a short window'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; systemctl/kill command targets a critical ICS service from a UID not in the authorized service-administration set'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; shell/interpreter process is spawned by an ICS network-facing service or other unexpected parent process'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; network-enumeration utility launched by a UID not in the authorized network-administration set'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; passwd/chpasswd targets an ICS service account outside the approved credential-rotation workflow'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; ICS HMI/GUI application launched from an SSH-associated process/session outside the approved remote-administration baseline'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; browser process spawns a command shell, script interpreter, or executable child inconsistent with the approved browser-child baseline'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; SSH/SNMP/remote-management command includes a remote target host and queries system identity/inventory from an account outside the authorized management set'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; document/viewer process launches a child process outside the expected viewer-child baseline'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; device restart/shutdown command invoked outside the approved change-control window by an unauthorized UID'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; firmware-update utility invoked outside the approved maintenance window or by a UID not in the authorized firmware-management set'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): execve of nmap/masscan with arguments targeting Industrial Control Systems (ICS) protocol port ranges'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; command or executable associated with the technique runs outside the approved ICS administrative/application baseline'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; iptables/nftables command adds a rule that blocks ICS protocol traffic outside the authorized network-administration baseline'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; ip link command disables an interface on an ICS gateway outside the authorized network-administration baseline'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; hostapd/wireless-controller configuration command disables or alters an ICS wireless network outside the authorized wireless-administration baseline'}
x_mitre_log_sources		{'name': 'WinEventLog:System', 'channel': 'System crash or unexpected halt occurring within wiper crash window of the bulk deletion event'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 firmware-update utility spawned by an account outside the authorized firmware-management set or outside the approved maintenance window'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 where a browser process spawns cmd.exe, powershell.exe, wscript.exe, or another executable outside the approved browser-child baseline'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 with parent matching web/application server process and image matching shell/script interpreter within exploit-to-shell window of anomalous request'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 of the newly-created file within tool transfer window of its creation'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 process execution associated with a remote session targets ICS application directories or initiates device-subnet activity'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'Microsoft-Windows-Sysmon/Operational Event ID 1 ProcessCreate: Process execution within the remote session targeting Industrial Control Systems (ICS) application directories or device subnet connections'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 with image path on removable drive letter within Universal Serial Bus (USB) execution window of insertion event'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 of network discovery tool (nmap, PLCScan) from process not in authorized network tools list'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 of archive utility immediately following bulk file access pattern from same parent process tree'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 sc.exe/net.exe invocation targeting a critical ICS service from an account outside the authorized service-administration set'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 network enumeration command from account not in approved network admins, with more than one distinct command within enumeration time window'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 parent matches outlook.exe/winword.exe/excel.exe and image matches cmd.exe/powershell.exe/wscript.exe/mshta.exe on host in Industrial Control Systems (ICS) workstation inventory'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 remote-management command (for example wmic /node, winrs, or PowerShell/CIM with -ComputerName) includes a remote target and queries system identity/inventory outside the authorized management baseline'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 chain originating from user-invoked file open or link click action, spawning processes not in expected document viewer children'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 image matches certutil.exe/regsvr32.exe/mshta.exe/rundll32.exe and command line matches Living-off-the-Land Binary (LOLBin) abuse patterns on host in Industrial Control Systems (ICS) workstation inventory'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 capture utility execution from account not in approved network analysts'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 firmware update tool process activating firmware mode, by account not in authorized firmware managers, outside maintenance window schedule'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 of port scanning utility with arguments targeting Industrial Control Systems (ICS) protocol port ranges'}

[DC0034] Process Metadata

Current version: 2.2

Version changed from: 2.1 → 2.2

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.778000+00:00	2026-10-13 17:43:44.003000+00:00
x_mitre_version	2.1	2.2

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'WinEventLog:PowerShell', 'channel': 'EventCode=400/403; engine lifecycle/context'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: running process names read from /proc//status or /proc//cmdline by app NOT IN $ProcessDiscoveryAllowList$'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: process executing with effective UID=0'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): execve with env containing LD_PRELOAD where exe matches Industrial Control Systems (ICS) service binary list and preload library not in vendor package manifest'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): execve where exe basename matches Industrial Control Systems (ICS) daemon names but path outside vendor install paths'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): execve of wireless configuration utility setting monitor/promiscuous mode outside change management window'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): setuid/setgid to root from a process owned by Industrial Control Systems (ICS) service User Identifier (UID) that was not invoked via sudo'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): execve of wireless configuration utility setting monitor mode on Industrial Control Systems (ICS) Linux asset by User Identifier (UID) not in authorized wireless admin UIDs'}
x_mitre_log_sources		{'name': 'edr:ProcessIntegrity', 'channel': 'Process integrity/hash mismatch detected on Industrial Control Systems (ICS) communication process post-hook-install event'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 where image filename matches Industrial Control Systems (ICS) vendor process names but hash not in vendor hash baseline or current directory outside vendor install paths'}

Patches

[DC0083] Cloud Service Enumeration

Current version: 3.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.775000+00:00	2026-10-13 17:40:40.732000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'cloud:AuditLog', 'channel': 'Instrumented app API trace and corresponding cloud-service audit/API telemetry'}

[DC0042] Drive Creation

Current version: 2.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-11-12 22:03:39.105000+00:00	2026-10-13 17:43:56.655000+00:00
x_mitre_log_sources[16]['name']	maos:osquery	macos:osquery

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'WinEventLog:System', 'channel': 'EventCode=20001, 2003 not in authorized Universal Serial Bus (USB) allowlist on Industrial Control Systems (ICS) host'}
x_mitre_log_sources		{'name': 'WinEventLog:System', 'channel': 'EventCode=20001 correlated with autorun registry modification within autorun modification window'}

[DC0079] Driver Load

Current version: 2.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-11-12 22:03:39.105000+00:00	2026-10-13 17:43:49.098000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=6 kernel driver load from path not in trusted driver paths, not signed by trusted signer list'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=6 of a known vulnerable third-party driver immediately preceding privilege escalation indicators'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=6 for wireless capture driver on host not in designated wireless management station list'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode= 6 Npcap/WinPcap driver loaded by image not in authorized capture software'}

[DC0040] File Deletion

Current version: 3.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.778000+00:00	2026-10-13 17:43:44.580000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: App deletes, truncates, or removes files that were recently written by the same app (collected data, staged exfil artifacts, operation logs) within $PostExfilCleanupWindow$ of network upload event — post-exfil cleanup chain'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: App deletes package files or local state immediately before package inventory disappearance — pre-removal evidence cleanup'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: unlink() or rmdir() on path IN /data/data/ OR /data/user/ OR /sdcard/ by process NOT IN $MDMAgentPackageList$ at rate > $DeletionRateThreshold$ within $DestructionWindow$'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL+PATH', 'channel': 'Linux Audit SYSCALL+PATH records: truncate/shred/rm on Industrial Control Systems (ICS) application log files or auth.log by User Identifier (UID) not in authorized log admin UIDs'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL+PATH', 'channel': 'Linux Audit SYSCALL+PATH records: rm/shred/dd operations across multiple Industrial Control Systems (ICS) data directories exceeding bulk deletion threshold, by User Identifier (UID) not in authorized data management UIDs'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=23 across multiple Industrial Control Systems (ICS) data directories exceeding bulk deletion threshold within data destruction time window, by process not in authorized data management tools'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=23 or wevtutil/Clear-EventLog invocation deleting Industrial Control Systems (ICS) vendor application log file by process not in authorized log management tools'}
x_mitre_log_sources		{'name': 'WinEventLog:System', 'channel': 'EventCode=104 outside scheduled log rotation window'}

[DC0059] File Metadata

Current version: 2.1

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.774000+00:00	2026-10-13 17:43:44.279000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: DEX file entropy > $PackerEntropyThreshold$ at install time for app NOT IN $MDMApprovedCatalog$'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: app_version in MDM == prior_version while dynamic code load from network is observed — confirms this is not a legitimate update'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: binary with file_permissions including setuid bit (mode & 04000) at path NOT IN $KnownSystemBinPaths$ — setuid outside system bin directories is the renamed-root-binary indicator'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: file hash changes for binary at $SystemBinaryPaths$ relative to known-good baseline — hash deviation confirms modification'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: MDM supervised integrity_check=fail following jailbreak detection — integrity check failure on supervised Jamf/Intune enrolled device indicates filesystem modifications beyond passive jailbreak presence'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: installed app package_name Levenshtein distance <= $NameDistanceThreshold$ to entry in $KnownAppCatalog$'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: bundle_id LIKE $KnownSystemNamespace$'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: app package_name distance <= $NameDistanceThreshold$ from $KnownAppCatalog$ entry'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: display_name Levenshtein distance <= $NameDistanceThreshold$ from $KnownIOSAppCatalog$ entry'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL+PATH', 'channel': 'Linux Audit SYSCALL+PATH records: package installation creates files outside the documented package manifest'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL+PATH', 'channel': 'Linux Audit SYSCALL+PATH records: write to Industrial Control Systems (ICS) project file path by uid not in authorized engineering User Identifiers (UIDs) or from path not in approved project sources'}
x_mitre_log_sources		{'name': 'linux:pkgintegrity', 'channel': 'rpm -V/dpkg --verify checksum mismatch for installed Industrial Control Systems (ICS) package binary'}
x_mitre_log_sources		{'name': 'fim:hashcompare', 'channel': 'installed binary hash does not match vendor-published checksum for claimed version'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'Microsoft-Windows-Sysmon/Operational Event ID 11 FileCreate/overwrite or Event ID 2 FileCreateTime, as applicable: Process creation and file creation correlation: vendor installer creates files outside vendor install manifest or spawns undocumented child process'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=11 matching Industrial Control Systems (ICS) vendor binary name in a path outside vendor install paths'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'Microsoft-Windows-Sysmon/Operational Event ID 11 FileCreate/overwrite or Event ID 2 FileCreateTime, as applicable: Engineering tool process opens project file from path not in approved project repository (removable media, email attachment cache, untrusted network share)'}

[DC0061] File Modification

Current version: 3.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.775000+00:00	2026-10-13 17:43:40.092000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: write() to /sdcard/ path'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: ContentResolver.update() or write() to path owned by target_app IN $HighValueAppList$ by writer_app != target_app — cross-app data modification'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: write() to path IN $SystemBinaryPaths$ by process NOT IN $TrustedUpdateSources$'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: app version change detected in MDM inventory for app_package — update is the binary modification event'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: app version change in MDM inventory for bundle_id'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: App inserts, updates, or deletes call log records via CallLog.Calls ContentProvider immediately after call-control action — call log tampering to conceal interception'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL+PATH', 'channel': 'Linux Audit SYSCALL+PATH records: write to Industrial Control Systems (ICS) alarm configuration file by User Identifier (UID) not in authorized alarm admin UIDs'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL+PATH', 'channel': 'Linux Audit SYSCALL+PATH records: write to /etc/ld.so.preload by User Identifier (UID) outside authorized admin list'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL+PATH', 'channel': 'Linux Audit SYSCALL+PATH records: PATH record shows modification of udev/autofs configuration that references an executable or script outside the authorized ICS software inventory'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL+PATH', 'channel': 'Linux Audit SYSCALL+PATH records: modification of bash_history file by uid not normally performing interactive shell sessions'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL+PATH', 'channel': 'Linux Audit SYSCALL+PATH records: write to alarm threshold config file by uid not in authorized alarm admin User Identifiers (UIDs)'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL+PATH', 'channel': 'Linux Audit SYSCALL+PATH records: PATH record shows modification of a serial-device configuration file by a UID not in the authorized serial-administration set'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL+PATH', 'channel': 'Linux Audit SYSCALL+PATH records: write to Siemens project file path by User Identifier (UID) not in authorized Siemens engineering UIDs'}
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'write erase or factory-reset command from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'Siemens engineering tool opens project file from path not in approved project repository'}

[DC0053] Firewall Metadata

Current version: 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		[{'name': 'WinEventLog:Security', 'channel': 'Windows Security Windows Filtering Platform / Firewall audit events (policy-dependent): Windows Firewall rule added blocking Industrial Control Systems (ICS) protocol ports by account not in authorized firewall admins'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:43:55.329000+00:00

[DC0051] Firewall Rule Modification

Current version: 2.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:14:37.073000+00:00	2026-10-13 17:43:54.279000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'WinEventLog:Security', 'channel': 'Windows Security Windows Filtering Platform / Firewall audit events (policy-dependent): firewall rule change blocking unsolicited Industrial Control Systems (ICS) reporting traffic while command/polling traffic continues'}
x_mitre_log_sources		{'name': 'WinEventLog:Security', 'channel': 'Windows Security Windows Filtering Platform / Firewall audit events (policy-dependent): firewall rule change selectively blocking one Industrial Control Systems (ICS) traffic type from Supervisory Control and Data Acquisition (SCADA)/Distributed Control System (DCS) host without corresponding change ticket'}

[DC0004] Firmware Modification

Current version: 2.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:14:38.020000+00:00	2026-10-13 17:43:40.707000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'assetinventory:FirmwareHash', 'channel': 'post-update firmware hash does not match vendor-published checksum for the claimed version'}
x_mitre_log_sources		{'name': 'assetinventory:FirmwareHash', 'channel': 'reported firmware hash post-reboot not in authorized firmware inventory'}
x_mitre_log_sources		{'name': 'assetinventory:FirmwareHash', 'channel': 'device firmware hash does not match authorized firmware inventory following a reboot event'}
x_mitre_log_sources		{'name': 'assetinventory:FirmwareHash', 'channel': 'device-reported firmware hash/version does not match independently verified value obtained through vendor integrity tool or physical inspection'}
x_mitre_log_sources		{'name': 'assetinventory:FirmwareHash', 'channel': 'module-specific firmware hash post-write does not match authorized module firmware inventory'}
x_mitre_log_sources		{'name': 'assetinventory:FirmwareHash', 'channel': 'post-reboot firmware hash (main processor or specific module) not in authorized firmware inventory'}
x_mitre_log_sources		{'name': 'assetinventory:FirmwareHash', 'channel': 'independently acquired firmware/module hash or vendor integrity measurement differs from approved baseline; protocol-response anomalies are corroboration only'}

[DC0088] Logon Session Metadata

Current version: 2.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-11-12 22:03:39.105000+00:00	2026-10-13 17:43:51.337000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'vpn:authlog', 'channel': 'Industrial Control Systems (ICS)-role account authentication from source geolocation/Autonomous System Number (ASN) not in approved remote access origins or outside expected session pattern'}
x_mitre_log_sources		{'name': 'syslog:auth', 'channel': 'authentication attempt or success from internet-sourced Internet Protocol (IP) address not in organizational IP space'}
x_mitre_log_sources		{'name': 'syslog:auth', 'channel': 'Secure Shell (SSH) session from Virtual Private Network (VPN)-assigned Internet Protocol (IP) address correlated with remote access authentication anomaly'}
x_mitre_log_sources		{'name': 'WinEventLog:Security', 'channel': 'Windows Security Event ID 4624/4625: EventCode=4672 for Industrial Control Systems (ICS)-role account from anomalous session'}
x_mitre_log_sources		{'name': 'WinEventLog:Security', 'channel': 'Windows Security Event ID 4624/4625: EventCode=4672 for Industrial Control Systems (ICS)-role account without corresponding admin-group logon in preceding session'}
x_mitre_log_sources		{'name': 'WinEventLog:Security', 'channel': 'Windows Security Event ID 4624/4625: inbound authentication attempt or successful session from internet-sourced Internet Protocol (IP) address to Industrial Control Systems (ICS) application port'}

[DC0102] Network Share Access

Current version: 2.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-11-12 22:03:39.105000+00:00	2026-10-13 17:43:49.731000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'fileserver:audit', 'channel': 'sequential access to above bulk document access threshold files within information repository time window from single session'}
x_mitre_log_sources		{'name': 'WinEventLog:Security', 'channel': 'Windows Security Event ID 5140/5145: EventCode=5145 for file write to Industrial Control Systems (ICS) host, source not in authorized file sources'}

[DC0035] Process Access

Current version: 3.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.770000+00:00	2026-10-13 17:43:48.812000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: accessibility_service or notification_listener appears attributed to a bundle IN $LegitimateSystemProcesses$ within $InjectionWindow$ of root detection — injected code requesting special permissions under a legitimate system process identit'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: kernel log entry at level=fault referencing task_for_pid or get-task-allow violation on SUPERVISED device with Unified Log forwarding — kernel records entitlement violations at fault level; requires supervised MDM with Unified Log export'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: process in $TargetProcessList$ shows unexpected behavior change (new network destinations, new permission accesses) within $InjectionWindow$ of root status change — behavioral delta in target process post-injection is the anomaly indicator'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: kernel log at level=fault referencing task_for_pid, mach_vm_write, or get-task-allow outside developer build on SUPERVISED device — Apple Unified Log kernel subsystem records these violations at fault level; supervised MDM with Unified Log'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=ptrace/process_vm_readv; process accesses an ICS service process PID from an image or UID not in the debugger/diagnostic allowlist'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=10 where SourceImage outside the approved ICS vendor/process baseline accesses TargetImage associated with an ICS application or service'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=10 cross-process memory access into Industrial Control Systems (ICS) vendor process from image not in trusted security tool list, followed by unexpected termination within exploit crash correlation window'}

[DC0033] Process Termination

Current version: 2.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-11-12 22:03:39.105000+00:00	2026-10-13 17:43:45.560000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): Industrial Control Systems (ICS) service process terminated (SIGKILL/SIGSEGV) following high-rate inbound connections recorded in netflow within the same window'}

[DC0001] Scheduled Job Creation

Current version: 3.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.778000+00:00	2026-10-13 17:43:53.278000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: Scheduled task execution creates file, accesses sensor, or initiates network connection immediately after firing, with no recent user interaction triggering the task'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: Scheduled task execution produces network, local-write, or sensor artifact while app_state=background or device_locked=true without user trigger'}
x_mitre_log_sources		{'name': 'WinEventLog:Security', 'channel': 'Windows Security Event ID 4698/4702: EventCode=4698 referencing Industrial Control Systems (ICS) vendor binary name from unauthorized process'}

[DC0029] Script Execution

Current version: 2.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-11-12 22:03:39.105000+00:00	2026-10-13 17:43:47.221000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): execve of scripting interpreter making sequential Industrial Control Systems (ICS) protocol reads with output to file, by User Identifier (UID) not in authorized scripting UIDs'}

[DC0060] Service Creation

Current version: 2.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-11-12 22:03:39.105000+00:00	2026-10-13 17:43:53.579000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'WinEventLog:System', 'channel': 'EventCode=7045 where ServiceName/ImagePath references Industrial Control Systems (ICS) vendor application with hash/path mismatch'}
x_mitre_log_sources		{'name': 'WinEventLog:System', 'channel': 'EventCode=7045 enabling Transmission Control Protocol (TCP) port forwarding on Industrial Control Systems (ICS) protocol port not in known ICS services'}

[DC0041] Service Metadata

Current version: 2.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.774000+00:00	2026-10-13 17:43:56.009000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'WinEventLog:System', 'channel': 'EventCode=7034, 7036 for Industrial Control Systems (ICS) service within detection window of connection flood'}
x_mitre_log_sources		{'name': 'WinEventLog:System', 'channel': 'EventCode=7036 critical Industrial Control Systems (ICS) service transitions to Stopped without preceding change ticket reference'}

[DC0002] User Account Authentication

Current version: 3.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.777000+00:00	2026-10-13 17:43:46.928000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'saas:audit ', 'channel': 'Successful application-specific/legacy credential authentication where exposed '}
x_mitre_log_sources		{'name': 'azure:signinlogs', 'channel': 'Successful account authentication with authentication/client properties inconsistent with normal MFA-backed access '}
x_mitre_log_sources		{'name': 'idp:authentication ', 'channel': 'Successful authentication associated with legacy/application-specific credential flow '}
x_mitre_log_sources		{'name': 'idp:AuditLog', 'channel': 'App authentication flow instrumentation or IdP sign-in/audit events'}
x_mitre_log_sources		{'name': 'syslog:auth', 'channel': 'sshd Accepted publickey/password for Industrial Control Systems (ICS)-role account from source not in approved admin CIDR'}
x_mitre_log_sources		{'name': 'networkdevice:aaa', 'channel': 'TACACS+/RADIUS authentication success for Industrial Control Systems (ICS) network admin account from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet'}
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'Device authentication/audit log: successful authentication using a vendor-default or prohibited account from a non-approved management source'}
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'Device authentication/audit log: successful authentication using a default/hardcoded/prohibited account from a non-approved management source'}
x_mitre_log_sources		{'name': 'WinEventLog:Security', 'channel': 'Windows Security Event ID 4624/4625: EventCode=4648 for Industrial Control Systems (ICS)-role account from process outside approved ICS vendor process list'}
x_mitre_log_sources		{'name': 'WinEventLog:Security', 'channel': 'Windows Security Event ID 4624/4625: EventCode=4723, 4724 for Industrial Control Systems (ICS) service/operator account by account not in authorized credential admins outside credential rotation schedule'}

[DC0010] User Account Modification

Current version: 2.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-11-12 22:03:39.105000+00:00	2026-09-23 22:07:09.981000+00:00
x_mitre_log_sources[11]['channel']	user.lifecycle.delete, user.account.lock	user.lifecycle.deactivate, user.lifecycle.suspend, user.lifecycle.delete.initiated, user.lifecycle.delete.completed

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'idp:audit', 'channel': 'ASP added/created where exposed by provider'}
x_mitre_log_sources		{'name': 'idp:audit', 'channel': 'Application-specific password created/added for account '}
x_mitre_log_sources		{'name': 'saas:audit', 'channel': 'ASP creation/modification event where supported '}

[DC0063] Windows Registry Key Modification

Current version: 2.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.778000+00:00	2026-10-13 17:43:52.610000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'opc:applog', 'channel': 'Open Platform Communications (OPC) server data change notification or value write from client_id not matching authorized data acquisition service'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=13 to Communication (COM) port configuration key by process not in authorized serial port management tools'}

mobile-attack

Minor Version Changes

[DC0038] Application Log Content

Current version: 3.1

Version changed from: 3.0 → 3.1

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.776000+00:00	2026-10-13 17:43:41.733000+00:00
x_mitre_log_sources[173]['name']	saas:Airtable	WinEventLog:System
x_mitre_log_sources[173]['channel']	EXPORT: User-triggered data export via GUI or API	network adapter disabled on Industrial Control Systems (ICS) gateway host by process not in authorized network admins
x_mitre_version	3.0	3.1

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'm365:unified', 'channel': 'CopilotInteraction'}
x_mitre_log_sources		{'name': 'AWS:bedrock', 'channel': 'GuardrailTrace'}
x_mitre_log_sources		{'name': 'AWS:bedrock', 'channel': 'AgentTrace.FailureTrace'}
x_mitre_log_sources		{'name': 'AWS:bedrock', 'channel': 'AgentTrace.ModelInvocationInput'}
x_mitre_log_sources		{'name': 'AWS:bedrock', 'channel': 'AgentTrace.actionGroupInvocationInput'}
x_mitre_log_sources		{'name': 'AWS:bedrock', 'channel': 'AgentTrace.knowledgeBaseLookupInput'}
x_mitre_log_sources		{'name': 'casb:activity ', 'channel': 'Subsequent sensitive data access or outbound transfer occurs in the same SaaS session '}
x_mitre_log_sources		{'name': 'm365:unified', 'channel': 'Authentication/account audit event identifying app-password or applicable legacy-authentication activity '}
x_mitre_log_sources		{'name': 'saas:audit', 'channel': 'Actual send/share/upload/write operation'}
x_mitre_log_sources		{'name': 'engineeringworkstation:ApplicationLog', 'channel': 'firmware write session initiated without corresponding change ticket reference'}
x_mitre_log_sources		{'name': 'engineeringworkstation:ApplicationLog', 'channel': 'program download session logged without corresponding change ticket reference'}
x_mitre_log_sources		{'name': 'syslog:daemon', 'channel': 'Industrial Control Systems (ICS) daemon log entry indicating connection limit exceeded, out of memory, or watchdog timeout'}
x_mitre_log_sources		{'name': 'webserver:applog', 'channel': 'Web server/WAF access or request log: exploit-relevant URI/path/query/header/status pattern against ICS web interface; request-body claims require WAF/DPI logging'}
x_mitre_log_sources		{'name': 'syslog:auth', 'channel': 'Secure Shell (SSH) session with X11 forwarding from source not in approved admin Classless Inter-Domain Routing (CIDR) subnet'}
x_mitre_log_sources		{'name': 'edr:TelemetryCompare', 'channel': 'process enumeration discrepancy between Windows Management Instrumentation (WMI) and direct process listing'}
x_mitre_log_sources		{'name': 'historian:applog', 'channel': 'historian Structured Query Language (SQL) query returning above bulk query threshold rows from account not in approved historian clients'}
x_mitre_log_sources		{'name': 'scada:applog', 'channel': 'device communication-loss alarm generated within detection window of a corresponding network flood alert'}
x_mitre_log_sources		{'name': 'networkdevice:snmp', 'channel': 'ifInErrors or ifOutDiscards rate exceeds baseline combined with cpu5min exceeding utilization threshold'}
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'Network Address Translation (NAT)/route/Access Control List (ACL) configuration change from source not in approved net admins outside config change window'}
x_mitre_log_sources		{'name': 'vpn:applog', 'channel': 'session duration or command activity inconsistent with documented vendor support session profiles'}
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'configuration change logged without corresponding change ticket reference following anomalous authentication'}
x_mitre_log_sources		{'name': 'networkdevice:snmp', 'channel': 'Simple Network Management Protocol (SNMP) walk request from source not in approved Network Management System (NMS) Class Inter-Domain Routing (CIDR) subnet'}
x_mitre_log_sources		{'name': 'networkdevice:snmp', 'channel': 'Simple Network Management Protocol (SNMP) SET to alarm threshold Object Identifier (OID) from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet'}
x_mitre_log_sources		{'name': 'networkdevice:snmp', 'channel': 'Simple Network Management Protocol (SNMP) polling inconsistency or syslog sequence gap suggesting telemetry manipulation'}
x_mitre_log_sources		{'name': 'networkdevice:snmp', 'channel': 'Simple Network Management Protocol (SNMP) SET to power Management Information Base (MIB) restart Object Identifier (OID) or Command Line Interface (CLI) reload command from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet'}
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'Access Control List (ACL)/policy change affecting alarm notification traffic ports without corresponding change ticket'}
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'unexpected listening port or routing table change following firmware update event'}
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'new Media Access Control (MAC) address learned on a switch port previously unused or assigned to a different device, followed by Industrial Control Systems (ICS) protocol traffic to field devices'}
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'management command succeeds from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet, preceded by exploit-pattern traffic to management interface'}
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'syslog sequence number gap or forwarding interruption coinciding with suspicious activity window for the same device'}
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'Simple Network Management Protocol (SNMP) SET to service stop Object Identifier (OID) or Command Line Interface (CLI) command stopping critical service from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet'}
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'AAA/Simple Network Management Protocol (SNMP) credential change from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet, followed by authentication failures from legitimate NMS systems'}
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'remote console or web management session from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet'}
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'Access Control List (ACL) modification blocking Industrial Control Systems (ICS) reporting message ports while command ports remain open'}
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'unexpected restart or crash coinciding with anomalous traffic pattern on management interface'}
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'serial server configuration change altering port parameters for field device ports from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet'}
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'unauthorized Switched Port Analyzer (SPAN) session request or port mirroring configuration from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet'}
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'Switched Port Analayzer (SPAN) session or port mirroring configuration change from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet'}
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'Access Control List (ACL)/firewall/routing configuration change from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet outside change control window'}
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'interface shutdown command on Industrial Control Systems (ICS) device port from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet outside change control window'}
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'deauthentication targeting more than mass deauth threshold enrolled devices within deauth time window, or Media Access Control (MAC) address filter config change excluding enrolled devices, from source not in approved wireless admin list'}
x_mitre_log_sources		{'name': 'opc:applog', 'channel': 'client_id not in approved Open Platform Communications (OPC) clients issuing high-volume read requests'}
x_mitre_log_sources		{'name': 'opc:applog', 'channel': 'Open Platform Communications (OPC) client polling frequency for tag set exceeds documented Human-Machine Interface (HMI) refresh baseline from client not in approved application list'}
x_mitre_log_sources		{'name': 'opc:applog', 'channel': 'Open Platform Communications Data Access (OPC DA) write queue depth or write throughput to a single point exceeds configured baseline by a significant margin'}
x_mitre_log_sources		{'name': 'opcua:AuditEvent', 'channel': 'OPC UA AuditUpdateMethodEventType/AuditWriteUpdateEventType: ClientUserId, ClientApplicationUri, SourceNode/MethodId, Status and arguments for a state-changing method/write'}
x_mitre_log_sources		{'name': 'opc:applog', 'channel': 'write to setpoint tag from client not in approved Open Platform Communications (OPC) clients with value outside baseline value range'}
x_mitre_log_sources		{'name': 'opc:applog', 'channel': 'client_id not in approved Open Platform Communications (OPC) clients traversing entire tag tree rather than known fixed subset'}
x_mitre_log_sources		{'name': 'opc:applog', 'channel': 'Open Platform Communications (OPC) client not in approved OPC clients calling BrowseNamespace traversing entire tag tree'}
x_mitre_log_sources		{'name': 'opc:applog', 'channel': 'command call to field device output tag from process not matching recognized Supervisory Control and Data Acquisition (SCADA)/Distributed Control System (DCS) control application'}
x_mitre_log_sources		{'name': 'engineeringworkstation:ApplicationLog', 'channel': 'mode-change session logged without corresponding change ticket reference'}
x_mitre_log_sources		{'name': 'serialgw:syslog', 'channel': 'serial port parameter change (baud rate, parity, port disable) without corresponding change ticket reference'}
x_mitre_log_sources		{'name': 'engineeringworkstation:ApplicationLog', 'channel': 'firmware update mode entry logged without corresponding change ticket reference'}
x_mitre_log_sources		{'name': 'scada:applog', 'channel': 'write Application Programming Interface (API) call queue depth or throughput to a single point exceeds max write queue depth'}
x_mitre_log_sources		{'name': 'scada:applog', 'channel': 'parameter write logged without corresponding operator_id in the Human-Machine Interface (HMI) audit trail'}
x_mitre_log_sources		{'name': 'scada:applog', 'channel': 'command issued to device_ip with no corresponding state-change confirmation received within command confirmation window'}
x_mitre_log_sources		{'name': 'otndr:BehaviorAlert', 'channel': 'device Input/Output (I/O) state change inconsistent with programmed logic correlating temporally with operator terminal interaction'}
x_mitre_log_sources		{'name': 'device:VendorLog', 'channel': 'protected function (firmware write, memory protection mode change) succeeds for a session that did not complete the documented authentication/privilege-elevation sequence'}
x_mitre_log_sources		{'name': 'engineeringworkstation:ApplicationLog', 'channel': 'Engineering application audit/session log: controller program upload initiated outside approved backup/change window and without documented backup purpose'}
x_mitre_log_sources		{'name': 'engineeringworkstation:ApplicationLog', 'channel': 'full upload session outside backup window schedule without documented backup purpose'}
x_mitre_log_sources		{'name': 'engineeringworkstation:ApplicationLog', 'channel': 'online edit session logged without corresponding change ticket reference'}
x_mitre_log_sources		{'name': 'syslog:auth', 'channel': 'Secure Shell (SSH) connection from source Internet Protocol (IP) address that appeared on Industrial Control Systems (ICS) network within new device window, not in approved device inventory'}
x_mitre_log_sources		{'name': 'vendorapp:ApplicationLog', 'channel': 'Industrial Control Systems (ICS) vendor application log shows endpoint or certificate change without documented maintenance reference'}
x_mitre_log_sources		{'name': 'engineeringworkstation:ApplicationLog', 'channel': 'firmware session initiated outside maintenance window schedule without change ticket reference'}
x_mitre_log_sources		{'name': 'engineeringworkstation:ApplicationLog', 'channel': 'device restart command initiated outside change control window by account not in approved engineer list'}
x_mitre_log_sources		{'name': 'webproxy:applog', 'channel': 'file download from domain not matching verified vendor Transport Layer Security (TLS) certificate/domain history, immediately preceding the anomalous process spawn'}
x_mitre_log_sources		{'name': 'webserver:applog', 'channel': 'Web server/WAF access or request log: exploit-relevant URI/path/query/header/status pattern against ICS web interface from unapproved source; request-body claims require WAF/DPI logging'}
x_mitre_log_sources		{'name': 'WinEventLog:Application', 'channel': 'wireless controller management log: SSID or MAC filter config change from account not in authorized wireless admins'}
x_mitre_log_sources		{'name': 'WinEventLog:System', 'channel': 'Industrial Control Systems (ICS) service failing to start (authentication failure) within credential change impact window of the password change event'}

[DC0114] Application Permission

Current version: 2.2

Version changed from: 2.1 → 2.2

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.778000+00:00	2026-10-13 17:40:29.734000+00:00
x_mitre_version	2.1	2.2

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'android:MDMLog', 'channel': 'policy_violation WHERE install_unknown_apps changed to enabled + MobileEDR app_install with signing_cert NOT IN EnterpriseCertList within TimeWindow where enterprise policy does not permit this cert or install source'}
x_mitre_log_sources		{'name': 'android:MDMLog', 'channel': 'policy_violation WHERE unknown_sources=enabled OR play_protect_status=disabled + MobileEDR app_install event from non-com.android.vending source within PolicyViolationWindow where MDM policy does not permit unknown source installs'}
x_mitre_log_sources		{'name': 'android:MDMLog', 'channel': 'root_status=false AND MobileEDR reports UID=0 binary execution within ComplianceCheckWindow where MDM-reported state does not justify observed privilege'}
x_mitre_log_sources		{'name': 'iOS:MDMLog', 'channel': 'MDM integrity_check=fail AND jailbreak_status=true — active integrity failure on jailbroken device confirms exploitation beyond passive jailbreak presence'}
x_mitre_log_sources		{'name': 'iOS:MDMLog', 'channel': 'certificate trust status = user_trusted for cert NOT IN $EnterpriseCertList$ within $ProfileInstallWindow$'}
x_mitre_log_sources		{'name': 'iOS:MDMLog', 'channel': 'profile_install where install_initiator != MDM_SERVER + cert_trust_type=enterprise within ProfileInstallWindow where MDM provisioning does not justify out-of-band profile installation'}
x_mitre_log_sources		{'name': 'iOS:MDMLog', 'channel': 'compliance_status=pass AND MobileEDR dylib load event with lib_path matching KnownJailbreakLibPatterns within same device session where clean compliance does not justify jailbreak library presence'}
x_mitre_log_sources		{'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}
x_mitre_log_sources		{'name': 'mobile:ApplicationVetting', 'channel': 'Code-signing entitlements and Info.plist privacy usage-description keys'}

[DC0123] Application State

Current version: 1.1

Version changed from: 1.0 → 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.773000+00:00	2026-10-13 17:40:32.511000+00:00
x_mitre_version	1.0	1.1

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'MobileEDR:telemetry', 'channel': 'environment API reads occur before any user interaction at cold launch — precondition check timing'}
x_mitre_log_sources		{'name': 'MobileEDR:telemetry', 'channel': 'environment check API burst occurs at app cold-launch or in background before user interaction — precondition check timing distinguishes guardrail from feature use'}
x_mitre_log_sources		{'name': 'android:EMM', 'channel': 'Managed package inventory/status and package metadata'}
x_mitre_log_sources		{'name': 'iOS:MDM', 'channel': 'InstalledApplicationList / ManagedApplicationList'}

[DC0064] Command Execution

Current version: 2.2

Version changed from: 2.1 → 2.2

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.774000+00:00	2026-10-13 17:43:48.219000+00:00
x_mitre_log_sources[142]['name']	linus:syslog	linux:syslog
x_mitre_version	2.1	2.2

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'CLI command audit / configuration command history'}
x_mitre_log_sources		{'name': 'WinEventLog:PowerShell', 'channel': 'EventCode=4103/4104/4105/4106; command/script-block content '}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Unix shell process (sh, bash, busybox sh, toybox) spawns as child of app process with command-line arguments indicating scripted operation — shell with arguments confirms script execution not interactive terminal'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Shell or command-executing child process with arguments spawned under managed app context on supervised iOS device'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: pm uninstall OR rm -f called by process NOT IN $MDMAgentPackageList$ for package_count > $BulkUninstallThreshold$ within $DestructionWindow$ — command-line destruction activity'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App spawns sh, bash, toybox, toolbox, or su child process with command arguments within $ShellActivityWindow$ of shell launch — child shell process with arguments is the script execution signal'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Shell process (sh, bash) or command-executing child process spawned under app context on supervised iOS device — any shell spawn on stock iOS indicates jailbreak or kernel exploit'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): sequential reads across ICS data paths by uid not in authorized data access UIDs, followed by tar/zip invocation within a short window'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): execve of screenshot utility (scrot, import, xwd) on Industrial Control Systems (ICS) Human-Machine Interface (HMI) by User Identifier (UID) not in approved operator UIDs'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): system binary executing with command line piping or decoding external content, from Industrial Control Systems (ICS) service account User Identifier (UID)'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): raw socket creation (SOCK_RAW) or tcpdump/tshark execution by uid not in authorized capture User Identifiers (UIDs)'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): Industrial Control Systems (ICS) tool execution following Secure Shell (SSH) lateral movement session'}
x_mitre_log_sources		{'name': 'gpo:deployment', 'channel': 'destructive payload deployed via Group Policy Object (GPO) to multiple hosts simultaneously'}
x_mitre_log_sources		{'name': 'historian:applog', 'channel': 'bulk export query returning above bulk query threshold records from account not in approved historian clients'}
x_mitre_log_sources		{'name': 'WinEventLog:Security', 'channel': 'Windows Security Event ID 4688: EventCode=1102 correlated with any other Medium+ confidence alert on the same host within log clear lookback window'}

[DC0055] File Access

Current version: 3.1

Version changed from: 3.0 → 3.1

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.770000+00:00	2026-10-13 17:43:44.861000+00:00
x_mitre_version	3.0	3.1

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: open() for read on path IN /sdcard/ OR on path with file_permissions=777'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: opendir() or File.listFiles() on path IN $ExternalStoragePaths$ called > $FileEnumThreshold$ times within $EnumWindow$ by app NOT IN $FileEnumAllowList$'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': "Dynamic filesystem trace or acquired app-container/filesystem artifacts: opendir('/proc/') with recursive listdir by app NOT IN $ProcessDiscoveryAllowList$ on device with android_version < $HidepidVersion$"}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: open() for read on /proc/cpuinfo'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: App reads files across $MinDirectoryCount$+ distinct parent directories with file_read_count > $FileReadRateThreshold$ within $DataCollectionWindow$ in background or low-interaction state — bulk cross-directory read is the collection signal'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: App reads multiple files from Photos library, Files provider, or iCloud Drive in background or lock-adjacent state exceeding $FileReadRateThreshold$ within $DataCollectionWindow$'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: App loads executable or library from writable external directory (/sdcard/, app cache, /data/local/tmp/) — writable-path library load is exploitable hijack vector'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL+PATH', 'channel': 'Linux Audit SYSCALL+PATH records: PATH records show sequential reads of ICS documentation/configuration files by a UID not in the authorized engineering or backup account set'}
x_mitre_log_sources		{'name': 'WinEventLog:Security', 'channel': 'Windows Security Event ID 4663 (requires Object Access auditing and SACL on monitored paths): repeated ReadData/ListDirectory access across ICS data paths by an unapproved process/account'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'Sequential file reads across multiple Industrial Control Systems (ICS) data paths by image not in authorized ICS applications, exceeding bulk access threshold within a short window'}
x_mitre_log_sources		{'name': 'WinEventLog:Security', 'channel': 'Windows Security Event ID 4663 (requires Object Access auditing/SACL): engineering process reads/opens project file from unapproved repository/removable-media/network-share path'}
x_mitre_log_sources		{'name': 'WinEventLog:Security', 'channel': 'Windows Security Event ID 4663 (requires Object Access auditing/SACL): Siemens engineering process reads/opens project file from unapproved repository/removable-media/network-share path'}

[DC0039] File Creation

Current version: 3.1

Version changed from: 3.0 → 3.1

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.770000+00:00	2026-10-13 17:43:40.408000+00:00
x_mitre_version	3.0	3.1

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'MobileEDR:telemetry', 'channel': 'IPA binary written with signing cert matching user-trusted certificate NOT IN $EnterpriseCertList$ within $ProfileInstallWindow$'}
x_mitre_log_sources		{'name': 'MobileEDR:telemetry', 'channel': 'PackageInstaller.install() with signing_cert NOT IN $EnterpriseCertList$ within $PolicyViolationWindow$ of settings change'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: App writes asymmetric-encrypted blob or encoded ciphertext to local staging path before network transmission — encrypted staging artifact'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: Local file write between inbound retrieval'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': "Dynamic filesystem trace or acquired app-container/filesystem artifacts: open() with O_CREAT on path LIKE '/data/data/%/files/%' for binary or dex content by app_package NOT IN $LegitDynamicLoaders$"}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: open() with O_CREAT on binary-typed path in /data/data// within $StegoExecWindow$ of media file download from same session'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: open() with O_CREAT for file with audio MIME type (audio/mp4, audio/aac, audio/3gpp) in /data/data//files/ within $AudioCaptureWindow$ of recording API start'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: open() with O_CREAT for APK or binary file in /sdcard/ or /data/local/tmp/ by browser process within $DriveByWindow$ — payload drop confirms exploit code execution'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: PackageInstaller.install() with installer_source NOT IN $ApprovedInstallSources$ within $PolicyViolationWindow$ of settings change'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: app binary written to device with signing certificate matching manually-trusted enterprise cert NOT IN $EnterpriseCertAllowList$ within $ProfileInstallWindow$'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: PackageInstaller.install() with signing_cert NOT IN $EnterpriseCertList$ within $PolicyViolationWindow$ of settings change'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: IPA binary written with signing cert matching user-trusted certificate NOT IN $EnterpriseCertList$ within $ProfileInstallWindow$'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: app binary written to device storage as part of install — confirms impersonating app is being persisted'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: PackageInstaller.install() writes binary to device storage for impersonating app — install event is the enrollment of impersonating app'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: open() with O_CREAT for APK file in /sdcard/ or /data/local/tmp/ within $PhishingWindow$ of navigation to flagged URL — APK drop confirms malware delivery phase'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: File with binary signature (.apk, .dex, .so, .sh) written to app storage or /data/local/tmp/ from USB-mounted path or external storage within $USBInstallWindow$'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: Compromised app writes staging, cache, or export artifacts inconsistent with its declared function within $PostInstallWindow$'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: App stages or caches content retrieved from web-service platform locally before initiating secondary network connection'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: App writes high-entropy blob (Shannon entropy > $EntropyThreshold$) to local staging path immediately before outbound transmission — encrypted staging artifact confirms app-layer encryption occurred'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: App writes newly retrieved binary, archive, native library (.so), DEX, or script to /data/data//files/, cache, or shared storage within $IngressWriteWindow$ of network retrieval from non-CDN source'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: Managed app writes newly retrieved container-local file, dylib-like resource, or opaque payload after download from non-CDN source'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: APK, DEX, or native library written to app installation path outside MDM-authorized update mechanism — binary replacement is the persistence artifact'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: App reads files across multiple directories or databases in background state (collection phase) then invokes archive or compression routines on collected content — read-then-archive sequence is the staging chain'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: App writes archive-like container, high-entropy packaged blob, or .zip/.gz output to app-private or cache path after bulk data collection — archive artifact in private storage is the staging evidence'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: App writes large container, temp package, or high-entropy blob to container-local storage after clustered data access — staged archive artifact'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: App writes to or modifies protected configuration files or local control structures of deployed security tools'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=11 of alarm config paths by image not in Human-Machine Interface (HMI) alarm parent allowlist'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL+PATH', 'channel': 'Linux Audit SYSCALL+PATH records: file transfer (scp, sftp, rsync, etc.) placing executable on Industrial Control Systems (ICS) Linux asset, followed by execve of the transferred file within tool transfer window'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=11 with executable/script extension from remote-sourced write operation'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=11 from removable media path to Industrial Control Systems (ICS) engineering working directory'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=11 where an unrecognized process creates a staging/output file after bulk ICS data access activity'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=11 by same process within capture to file window of the Application Programming Interface (API) call'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=11 to alarm threshold config path by image not in Human-Machine Interface (HMI) alarm parent allowlist'}

[DC0018] Host Status

Current version: 2.2

Version changed from: 2.1 → 2.2

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.775000+00:00	2026-10-13 17:40:35.821000+00:00
x_mitre_version	2.1	2.2

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'iOS:MDMLog', 'channel': 'jailbreak_status=true on device where Keychain path file access was observed — stock iOS Keychain sandbox prevents direct file access; jailbreak is the prerequisite'}
x_mitre_log_sources		{'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported'}
x_mitre_log_sources		{'name': 'iOS:MDM', 'channel': 'DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries'}

[DC0016] Module Load

Current version: 3.1

Version changed from: 3.0 → 3.1

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.778000+00:00	2026-10-13 17:43:48.544000+00:00
x_mitre_version	3.0	3.1

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=7; scripting-engine module loads when useful '}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=7; System.Management.Automation or unusual PowerShell-related modules'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: DexClassLoader() or dlopen() called with path argument matching file written in preceding $DecryptExecWindow$'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: DexClassLoader() or dlopen() on path written within $StegoExecWindow$ of media download event — download-write-load chain confirms steganographic payload delivery'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: DexClassLoader() called at runtime with path NOT matching any file in original APK manifest within $PackerExecWindow$ of app launch'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': "Dynamic API/runtime trace: DexClassLoader() or System.load() or WebView.loadUrl(javascript:) called with content_source='network_download' within $CodeDownloadWindow$ of download event"}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=init_module/finit_module; kernel module loaded from a path or hash not in the authorized ICS host module baseline'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=7 of Industrial Control Systems (ICS) vendor communication Dynamic Link Library (DLL) with hash not in signed baseline'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=7 where an ICS/vendor DLL is loaded by an image outside the authorized ICS application baseline'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=7 of GDI32.dll/User32.dll by process not in authorized screen capture tools on Human-Machine Interface (HMI)-classified host'}

[DC0082] Network Connection Creation

Current version: 2.2

Version changed from: 2.1 → 2.2

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.770000+00:00	2026-10-13 17:43:42.443000+00:00
x_mitre_version	2.1	2.2

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'linux:osquery', 'channel': 'socket_events to broker/service, where deployed'}
x_mitre_log_sources		{'name': 'linux:osquery', 'channel': 'socket_events to DNS/DoH/DoT destinations, where deployed'}
x_mitre_log_sources		{'name': 'linux:osquery', 'channel': 'socket_events for Python-originated connections, where deployed'}
x_mitre_log_sources		{'name': 'linux:osquery', 'channel': 'socket_events for runtime-originated connections, where deployed '}
x_mitre_log_sources		{'name': 'NetworkDevice:Syslog', 'channel': 'Permitted/denied connection creation where network devices record it'}
x_mitre_log_sources		{'name': 'NSM:Connections', 'channel': 'New device-to-broker relationship outside documented profile'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=3; process-to-broker connection'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=3; connection to DNS/DoH destination with process identity'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=3; Python-originated connection to OT or external destination'}
x_mitre_log_sources		{'name': 'android:EnterpriseNetworkLog', 'channel': 'DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata'}
x_mitre_log_sources		{'name': 'iOS:NetworkExtension', 'channel': 'NEFilterFlow / per-app VPN / secure-web-gateway flow metadata'}
x_mitre_log_sources		{'name': 'NSM:Connections', 'channel': 'device establishes new network connections or activates protocols not seen in pre-reboot baseline'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): bind/listen/connect syscalls show one process accepting ICS-protocol connections while also initiating an outbound connection to a non-ICS destination'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): execve of scripting interpreter with sustained network connect() calls to device subnet at rate exceeding poll baseline, by User Identifier (UID) not in service account allowlist'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): firmware updater connecting to device on firmware port, by User Identifier (UID) not in authorized firmware manager UIDs, outside maintenance window schedule'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): connect() syscall on port (e.g., 80, 443, 8080, etc.) to destination not in approved vendor domains, from Industrial Control Systems (ICS) service process'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): write Application Programming Interface (API) invocation rate to single Input/Output (I/O) point from Industrial Control Systems (ICS) service User Identifier (UID) exceeds max write rate per point'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): connect syscalls show a host outside the approved SCADA/master set opening ICS-protocol connections to multiple field devices'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): connect syscall from an ICS service/application process to a destination outside the approved network or vendor-service baseline'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): socket/connect activity from a process outside the approved ICS monitoring-tool baseline to an ICS multicast destination/group'}
x_mitre_log_sources		{'name': 'NSM:Connections', 'channel': 'device process crash or unexpected restart immediately followed by privileged protocol command succeeding from same source session'}
x_mitre_log_sources		{'name': 'NSM:Connections', 'channel': 'rapid sequential connection attempts to same device Internet Protocol (IP) address across multiple Industrial Control System (ICS) protocol ports from source not in approved Supervisory Control and Data Acquisition (SCADA) servers'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=3 process holds connections to both device subnet and external/inter-zone destination simultaneously, combined with proxy-capable process spawn'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=3 to device subnet within auth-to-device window of the anomalous logon'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=3 network connection to an RDP/VNC service on an ICS Windows host from a source outside the approved management CIDR baseline'}
x_mitre_log_sources		{'name': 'WinEventLog:Security', 'channel': 'EventCode=5157 or firewall rule changes blocking Industrial Control Systems (ICS) command message traffic'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=3 on remote service ports (e.g., 22, 445, 3389, 5985/5986) between hosts not in approved communication matrix'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'Microsoft-Windows-Sysmon/Operational Event ID 3 NetworkConnect: inbound connection rate to Industrial Control Systems (ICS) application port exceeds threshold per minute from unexpected sources'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=3 on port 80/443/8080 from process not matching Industrial Control Systems (ICS) vendor update process allowlist'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=3 same process holding connections to both device subnet and external Internet Protocol (IP) address simultaneously'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=3 from resulting process to destinations not in approved destinations list'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=3 unexpected Windows host opening Industrial Control Systems (ICS) protocol connections to multiple field device Internet Protocol (IP) addresses in polling pattern characteristic of master station'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=3 on Hypertext Transfer Protocol (HTTP)/Hypertext Transfer Protocol Secure (HTTPS)/Domain Name System (DNS) port from process not recognized as Industrial Control Systems (ICS) vendor application'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=3 to device subnet from process not in authorized Industrial Control Systems (ICS) applications'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=3 outbound User Datagram Protocol (UDP) broadcast traffic from process not in recognized Industrial Control Systems (ICS) asset management tools'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=3 outbound connection from a process outside the approved ICS monitoring-tool baseline to an ICS multicast destination'}

[DC0085] Network Traffic Content

Current version: 2.2

Version changed from: 2.1 → 2.2

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.771000+00:00	2026-10-13 17:43:41.384000+00:00
x_mitre_version	2.1	2.2

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'Pub/sub protocol, client ID, topic/queue and message metadata when observable'}
x_mitre_log_sources		{'name': 'NetworkDevice:IDS', 'channel': 'DoH/DoT identification, SNI/HTTP host when observable, DNS tunneling signatures'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'Protocol identification; MQTT CONNECT/SUBSCRIBE/PUBLISH, AMQP/DDS metadata where parsable'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'MQTT/AMQP/DDS protocol and message metadata when visible'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'MQTT/AMQP/DDS protocol identification, broker/topic/client metadata when visible'}
x_mitre_log_sources		{'name': 'NSM:DNS', 'channel': 'Native DNS query/response content: long/encoded labels, TXT use, unusual query structure'}
x_mitre_log_sources		{'name': 'NSM:DNS', 'channel': 'Native DNS query/response content'}
x_mitre_log_sources		{'name': 'NSM:DNS', 'channel': 'DNS query/response metadata and content'}
x_mitre_log_sources		{'name': 'NSM:DNS', 'channel': 'Device DNS query/response content'}
x_mitre_log_sources		{'name': 'NSM:TLS/HTTP', 'channel': 'SNI/HTTP host or resolver endpoint identification when observable'}
x_mitre_log_sources		{'name': 'webproxy:applog', 'channel': 'DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'session on firmware-capable port exceeds session size threshold from source not in engineering workstation list outside change control window'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'firmware write service targeting specific slot/rack address from source not in engineering workstation list outside change control window'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'large session on firmware-capable port from source not in engineering workstation list outside change control window'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'write/control command traffic from source not in approved Supervisory Control and Data Acquisition (SCADA) servers directed at multiple distinct device IPs within rogue master time window'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'task/organization-block modification service from source not in engineering workstation list outside change control window'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'S7comm Download Block / Common Industrial Protocol (CIP) Download Program / Distributed Network Protocol (DNP3) program file transfer to device_ip from source not in engineering workstation list within mode change to download window of mode-change event'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'write to existing program block address from source not in engineering workstation list outside change control window'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'download of block address not previously present in device program inventory, from source not in engineering workstation list'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'decoded ICS protocol unsolicited response or OPC UA data-change message for a device/address not normally owned by the observed source'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'decoded ICS protocol write/setpoint operation to a control/output address from a client identity or source not in the approved control-application baseline'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'OPC UA Browse/BrowseNext request to namespace or system-information objects from a client identity or source not in the approved monitoring baseline'}
x_mitre_log_sources		{'name': 'dns:querylog', 'channel': 'Domain Name System (DNS) query from Industrial Control Systems (ICS) host to domain not in approved vendor domains, particularly domains exhibiting Domain Generation Algorithm (DGA)-like patterns'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'source not in approved Supervisory Control and Data Acquisition (SCADA) servers issuing reads covering sequential address ranges across multiple device Internet Protocol (IP) addresses within auto collection time window'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'malformed Protocol Data Unit (PDU) rate to device_ip exceeds threshold within detection window from source not in approved Supervisory Control and Data Acquisition (SCADA) server list'}
x_mitre_log_sources		{'name': 'zeek:ssl', 'channel': 'Transport Layer Security (TLS) Server Name Indication (SNI) or certificate issuer does not match approved vendor domains or recognized Content Delivery Network (CDN) serving vendor content'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'EtherNet/IP ListIdentity broadcast or sequential Industrial Control System (ICS) protocol connection attempts across Internet Protocol (IP) range from source not in approved Supervisory Control and Data Acqusition (SCADA) servers'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'structurally valid Industrial Control System (ICS) protocol message from source not in approved communication baseline for the destination device_ip'}
x_mitre_log_sources		{'name': 'otids:ProtocolDecoder', 'channel': 'SNMP request/response decoder: OID, operation type, source/destination; flag access to undocumented/vendor-internal OIDs from non-approved NMS sources'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'read-only function codes from source not in approved Supervisory Control and Data Acquisition (SCADA) servers at rate exceeding baseline poll rate or covering address ranges outside known tag ranges'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'Open Platform Communications Unified Architecture (OPC UA) BrowseNamespace or Distributed Network Protocol 3 (DNP3) object 0 all-variation read or Common Industrial Protocol (CIP) Get_Attributes_All from source not in approved Supervisory Control and Data Acquisition (SCADA) servers, covering above namespace coverage threshold percent of device tag space'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'Generic Object Oriented Substation Event (GOOSE) dataset stNum value decreases (replay indicator) or test-mode bit asserted on protection relay without scheduled maintenance'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'mode-change service from source not in engineering workstation list outside change control window'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'write to alarm threshold address range from source not in approved write sources with new value outside safe alarm threshold range'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'write/operate command targeting safety-critical output addresses from source not in approved Supervisory Control and Data Acquisition (SCADA) servers'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'restart/reset service from source not in engineering workstation list outside change control window'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'firmware-update-mode activation service from source not in engineering workstation list outside change control window'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'write function code to same register address at rate exceeding max write rate per point within brute force detection window'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'write function code (FC 6/16) to setpoint address range with value outside baseline value range, or from source not in approved write sources'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'device authentication session from source Media Access Control (MAC)/Internet Protocol (IP) address not enrolled as authorized engineering workstation, with valid credential'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'authentication success using credential matching default vendor credential list from source not in engineering workstation list'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'credential/access code change command from source not in approved security admin list'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'device authentication success using credential pattern matching known hardcoded credential patterns from source not in approved access list'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'authentication success using credential matching default vendor credential list or known hardcoded credential patterns from source not in engineering workstation list'}
x_mitre_log_sources		{'name': 'otids:ProtocolDecoder', 'channel': 'Decoded OT/file-transfer transaction: transfer operation, source/destination, object/file identifier where exposed by the protocol, outside approved engineering/change window'}
x_mitre_log_sources		{'name': 'otids:ProtocolDecoder', 'channel': 'Decoded DNP3/IEC 61850 file-transfer transaction: source/destination and file/object identifier where exposed; correlate with approved engineering source and change window'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'restart/reset service from source not in engineering workstation list, with more than one device receiving the command within bulk restart time window'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'GetIdentity/Identity Object response vendor/product string does not match enrolled asset inventory for device_ip'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'CIP Port Object Get_Attribute_All or topology query from source not in approved Supervisory Control and Data Acquisition (SCADA) servers'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'EtherNet/IP ListIdentity or Modbus broadcast from source Media Access Control (MAC) address not in approved device inventory'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'Internet Group Management Protocol (IGMP) join or Generic Object Oriented Substation Event (GOOSE) multicast subscription from source Media Access Control (MAC) address not in approved device inventory'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'Hypertext Transfer Protocol (HTTP) request to device management web interface with exploit-pattern payload from source not in engineering workstation list'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'protocol-level latency inconsistent with direct communication, or Media Access Control (MAC)/Internet Protocol (IP) address binding change for device_ip'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'transaction identifier reuse pattern or function-code distribution deviates from established per-device baseline within Adversary in the Middle (AiTM) correlation window of the Media Access Control (MAC) address binding change'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'single session reads address range covering above full image coverage threshold percent of device total Input/Output (I/O) space, from source not in approved Supervisory Control and Data Acquisition (SCADA) servers'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'write/control method invocation from client identity not in approved application list'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'malformed or oversized Industrial Control System (ICS) protocol message from unexpected source followed by device behavioral anomaly (reboot, mode change) within a short window'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'malformed or exploit-payload data via built-in communication interface from external source'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'vendor diagnostic function code with payload matching code execution pattern from source not in engineering workstation list'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'anomalous protocol exchange preceding device behavioral change (reboot, altered configuration)'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': "deterministic function code response content diverges from the device's established per-function response baseline without a corresponding firmware update event"}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'bulk read of configuration/data dictionary objects from source with no prior session history with this device'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'event buffer clear or log clear service from source not in engineering workstation list, correlated with preceding suspicious activity on the same device'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'reserved or vendor-specific function code accessing device registers directly from source not in engineering workstation list'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'bulk configuration/program object read from source with no prior configuration-read session history'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'Initialize_Memory or MEMORY_RESET service from source not in engineering workstation list'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'S7comm Upload Block / Common Industrial Protocol (CIP) Read Program session from source not in engineering workstation list with bytes_recv exceeding program upload size threshold'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'S7comm SZL Central Processing Unit (CPU)-state read or Common Industrial Protocol (CIP) Identity Object state attribute read from source not in approved Supervisory Control and Data Acquisition (SCADA) servers'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'SZL module inventory, Identity Object, or Device Attributes query from source not in approved Supervisory Control and Data Acquisition (SCADA) servers'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'S7comm Upload ALL or Common Industrial Protocol (CIP) full program upload from source not in engineering workstation list, bytes_recv exceeding full upload size threshold'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'online block edit service from source not in engineering workstation list outside change control window, with device remaining in RUN mode throughout'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'Virtual Network Computing (VNC) connection or screen-capture Hypertext Transfer Protocol (HTTP) request to embedded Human-Machine Interface (HMI) panel from source not in approved operator workstation list'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'Virtual Network Computing (VNC) or remote console session to embedded Human-Machine Interface (HMI) panel from source not in approved management Classless Inter-Domain Routing (CIDR) subnet'}
x_mitre_log_sources		{'name': 'otids:ProtocolDecoder', 'channel': 'Protocol decoder/IDS transaction: traffic on an ICS service port fails expected protocol parsing/conformance or decodes as a different application protocol'}
x_mitre_log_sources		{'name': 'otids:ProtocolDecoder', 'channel': 'Protocol decoder/IDS transaction/signature: exploit-relevant request against ICS remote service from unexpected source, correlated with subsequent endpoint/device anomaly'}
x_mitre_log_sources		{'name': 'zeek:conn', 'channel': 'exploit-pattern traffic to Industrial Control Systems (ICS) server/device Internet Protocol (IP) from unexpected source, followed by behavioral anomaly within a short window'}

[DC0078] Network Traffic Flow

Current version: 2.2

Version changed from: 2.1 → 2.2

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.777000+00:00	2026-10-13 17:43:50.375000+00:00
x_mitre_version	2.1	2.2

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'NSM:Flow', 'channel': 'Device-to-broker flow metadata'}
x_mitre_log_sources		{'name': 'NetworkProxy:HTTPSFlow', 'channel': 'bytes_out in range $CredentialDumpMin$..$CredentialDumpMax$ to dest NOT IN $AppCDNList$ within $ExfilWindow$ of MDM jailbreak detection — credential dump size range (small but dense) to novel destination indicates Keychain exfiltration'}
x_mitre_log_sources		{'name': 'NSM:Flow', 'channel': 'Source/destination/port/session metadata'}
x_mitre_log_sources		{'name': 'NSM:Flow', 'channel': 'Client/broker flow metadata'}
x_mitre_log_sources		{'name': 'NSM:Flow', 'channel': 'Client/broker connection metadata and periodicity'}
x_mitre_log_sources		{'name': 'NSM:Flow', 'channel': 'Direct external DNS or HTTPS/TLS flow bypassing designated resolver/proxy'}
x_mitre_log_sources		{'name': 'NSM:Flow', 'channel': 'External DNS/HTTPS/TLS flow bypassing approved resolver/proxy'}
x_mitre_log_sources		{'name': 'NSM:Flow', 'channel': 'Client-to-resolver or client-to-DoH endpoint flow'}
x_mitre_log_sources		{'name': 'NSM:Flow', 'channel': 'Device-to-resolver/DoH destination flow'}
x_mitre_log_sources		{'name': 'android:EnterpriseNetworkLog', 'channel': 'DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata'}
x_mitre_log_sources		{'name': 'iOS:NetworkExtension', 'channel': 'NEFilterFlow / per-app VPN / secure-web-gateway flow metadata'}
x_mitre_log_sources		{'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): connection rate to device_ip exceeds Denial of Service (DoS) threshold per minute from single or distributed sources'}
x_mitre_log_sources		{'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): flow volume to Industrial Control Systems (ICS) device subnet exceeds Denial of Service (DoS) flow threshold per minute'}
x_mitre_log_sources		{'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): traffic from newly-authenticated device to Industrial Control System (ICS) application server within onboard window of association'}
x_mitre_log_sources		{'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): source not in approved Supervisory Control and Data Acquisition (SCADA) servers generating high volume of short-duration flows to device subnet at regular intervals'}
x_mitre_log_sources		{'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): Trivial File Transfer Protocol (TFTP) session to device Internet Protocol (IP) address from source not in engineering workstation list followed by device reboot syslog within firmware transfer window'}
x_mitre_log_sources		{'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): egress flow on port 443/80/8080/53 from Industrial Control Systems (ICS) host in no-external-connectivity role list to destination not in approved vendor domains'}
x_mitre_log_sources		{'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): source generates flows to every IP in device subnet in sequential order within discovery time window'}
x_mitre_log_sources		{'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): Internet Control Message Protocol (ICMP) echo requests or Address Resolution Protocol (ARP) broadcasts to all Internet Protocol (IP) addresses in subnet sequentially from single source within discovery time window'}
x_mitre_log_sources		{'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): inbound exploit-pattern traffic to Industrial Control Systems (ICS) Demilitarized Zone (DMZ) server followed by outbound connection from same Internet Protocol (IP) address to internal ICS network'}
x_mitre_log_sources		{'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): connection from newly-observed device to Industrial Control Systems (ICS) application server within new device window of first network appearance'}
x_mitre_log_sources		{'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): sustained high-byte-count flow from Industrial Control Systems (ICS) server Internet Protocol (IP) address to destination outside ICS zone following bulk read activity'}
x_mitre_log_sources		{'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): host maintains simultaneous flows to device subnet and external destination with timing/byte-count correlation indicating relay'}
x_mitre_log_sources		{'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): next-hop change for device subnet traffic or unexpected path through new gateway not in expected next-hop baseline'}
x_mitre_log_sources		{'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): sequential connections from single source to multiple device Internet Protocol (IP) addresses resulting in large response payloads characteristic of directory listing'}
x_mitre_log_sources		{'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): new device Media Access Control (MAC) address on Industrial Control Systems (ICS) network generating ICS master-pattern traffic such as polling multiple device Internet Protocol (IP) addresses on ICS protocol ports'}
x_mitre_log_sources		{'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): firmware-mode activation protocol session from source not in engineering workstation list'}
x_mitre_log_sources		{'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): connection from Virtual Private Network (VPN)-assigned Internet Protocol (IP) address into device subnet within remote access to Industrial Control Systems (ICS) window of the anomalous authentication'}
x_mitre_log_sources		{'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): new east-west connection between Industrial Control Systems (ICS) hosts on remote service ports not in approved communication matrix'}
x_mitre_log_sources		{'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): first-seen connection from a source to an Industrial Control System (ICS) device outside the documented approved communication matrix'}
x_mitre_log_sources		{'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): source generates short-lived flows to single dst across multiple Industrial Control Systems (ICS) protocol ports (502,102,44818,20000,4840) within port scan time window, source not in approved Supervisory Control and Data Acquisition (SCADA) servers'}
x_mitre_log_sources		{'name': 'networkdevice:snmp', 'channel': 'Simple Network Management Protocol (SNMP) GET to system info OID from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet'}
x_mitre_log_sources		{'name': 'networkdevice:snmp', 'channel': 'new Internet Group Management Protocol (IGMP) join or broadcast traffic spike on Industrial Control Systems (ICS) Virtual Local Area Network (VLAN) from source not in approved device inventory'}
x_mitre_log_sources		{'name': 'networkdevice:snmp', 'channel': 'Internet Group Management Protocol (IGMP) membership report for Industrial Control Systems (ICS) multicast group from source not in approved device inventory'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'write function code targeting alarm config address range from source not in approved write sources within suppress grace period of the alarm status change'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'non-standard or malformed packet to device-specific diagnostic port immediately preceding a device-offline alarm'}
x_mitre_log_sources		{'name': 'NSM:Connections', 'channel': 'one Industrial Control System (ICS) traffic type (command or reporting) to/from device_ip ceases while other traffic types continue normally'}
x_mitre_log_sources		{'name': 'NSM:Flow', 'channel': 'reporting message for device_ip originates from src_mac not matching enrolled hardware address for that Internet Protocol (IP)'}
x_mitre_log_sources		{'name': 'NSM:Connections', 'channel': 'command-type traffic to device_ip absent while other traffic types (polling, reporting) to the same device continue normally'}
x_mitre_log_sources		{'name': 'NSM:Connections', 'channel': 'device_ip generates no outbound unsolicited traffic while responding normally to inbound polls'}
x_mitre_log_sources		{'name': 'NSM:Connections', 'channel': 'embedded device_ip initiates outbound connection on port 443/80/8080 to destination outside documented operational profile'}
x_mitre_log_sources		{'name': 'NSM:Connections', 'channel': 'inbound connection to field device Internet Protocol (IP) address from source outside RFC1918/organizational IP space on Industrial Control System (ICS) protocol port'}
x_mitre_log_sources		{'name': 'NSM:Connections', 'channel': 'Connection/session metadata: embedded device opens HTTP/HTTPS/DNS session to destination outside approved ICS communication baseline'}
x_mitre_log_sources		{'name': 'NSM:Connections', 'channel': 'Connection/session metadata: management-port session to field device originates through external remote-access infrastructure rather than approved internal management path'}
x_mitre_log_sources		{'name': 'NSM:Connections', 'channel': 'field device Internet Protocol (IP) initiates connection to another field device IP, not in approved device-to-device communication matrix'}
x_mitre_log_sources		{'name': 'NSM:Connections', 'channel': 'multiple device Internet Protocol (IP) addresses become unreachable simultaneously following network infrastructure config change event'}
x_mitre_log_sources		{'name': 'NSM:Flow', 'channel': 'unsolicited response message source identity does not match the enrolled device for those data points'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'device_ip observed with src_mac differing from enrolled hardware address without corresponding topology change ticket'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'write function code to output register address range from source not in approved write sources'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'deauthentication flood targeting enrolled Industrial Control Systems (ICS) wireless device Media Access Control (MAC) addresses from source not in approved wireless infrastructure'}
x_mitre_log_sources		{'name': 'perimeter:firewall', 'channel': 'inbound connection to Industrial Control Systems (ICS) device/server Internet Protocol (IP) address on ICS protocol port from source not in organizational IP space'}
x_mitre_log_sources		{'name': 'wireless:spectrum', 'channel': 'Radio Frequency (RF) signal detected on Industrial Control Systems (ICS) wireless frequencies from Media Access Control (MAC) address not in approved wireless device inventory without completed association sequence'}
x_mitre_log_sources		{'name': 'zeek:ssl', 'channel': 'Zeek ssl.log/TLS metadata: server_name (SNI), certificate chain/issuer/subject where available; compare with approved vendor domains/certificates'}

[DC0021] OS API Execution

Current version: 2.2

Version changed from: 2.1 → 2.2

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.775000+00:00	2026-10-13 17:43:47.873000+00:00
x_mitre_version	2.1	2.2

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'MobileEDR:telemetry', 'channel': 'UIDevice.current.model AND CMMotionManager.isDeviceMotionAvailable AND UIScreen.main.scale all read within $EnvCheckWindow$ at cold launch by app NOT IN $SystemEnumAllowList$'}
x_mitre_log_sources		{'name': 'MobileEDR:telemetry', 'channel': 'System.getProperty() AND SensorManager.getSensorList() AND getNetworkInterfaces() all called > $EnvCheckThreshold$ calls within $EnvCheckWindow$ by app NOT IN $SystemEnumAllowList$ where app_state=background'}
x_mitre_log_sources		{'name': 'iOS:unifiedlog', 'channel': 'kernel fault referencing ptrace OR task_for_pid OR get-task-allow outside developer-signed build + MDM integrity_check=fail within KernelFaultWindow where no developer entitlement justifies kernel-level process access'}
x_mitre_log_sources		{'name': 'MobileEDR:telemetry', 'channel': 'PackageInstaller.install() with install_initiator NOT IN ApprovedInstallSources + MDM policy_violation raised within InstallWindow where approved sources do not include this installer origin'}
x_mitre_log_sources		{'name': 'MobileEDR:telemetry', 'channel': 'ptrace with action IN (PTRACE_ATTACH, PTRACE_POKETEXT, PTRACE_POKEDATA, PTRACE_SETREGS) where caller_uid != target_uid + MDM developer_mode=false within PtraceWindow where no debug session justifies memory write to unrelated process'}
x_mitre_log_sources		{'name': 'MobileEDR:telemetry', 'channel': 'process accesses memory region or task port beyond declared entitlement set + MDM integrity_check=fail within same device session where declared entitlements do not justify observed resource access'}
x_mitre_log_sources		{'name': 'MobileEDR:telemetry', 'channel': 'ptrace(PTRACE_ATTACH) from caller_pid where caller is NOT parent of target AND NOT in DebuggerAllowList + MDM usb_debug=false within PtraceWindow where developer context does not justify cross-process attach'}
x_mitre_log_sources		{'name': 'MobileEDR:telemetry', 'channel': 'dylib loaded into process address space with path OR behavioral hash matching KnownJailbreakLibPatterns + MDM compliance=pass within same device session where compliance posture does not justify library presence'}
x_mitre_log_sources		{'name': 'MobileEDR:telemetry', 'channel': 'execve/execveat with effective UID=0 from path NOT IN KnownSystemBinPaths + MDM compliance root_status=false within same device context where compliance state does not justify elevated execution'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes DevicePolicyManager.lockNow(), creates persistent fullscreen overlay (TYPE_APPLICATION_OVERLAY covering full screen), or uses accessibility to block UI interaction — lock or UI-denial API invocation'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Background work scheduler or persistent service triggered the platform retrieval without user interaction'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Background task or networking subsystem event immediately before platform retrieval'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes DevicePolicyManager.resetPassword(), lockNow(), wipeData(), or setCameraDisabled() immediately after Device Admin activation without MDM-initiated policy context or user interaction'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes file management, storage-clear, or wipe operations in background state following network upload without user-initiated delete action'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes custom TLS trust evaluation, OkHttp CertificatePinner, or custom-anchor TrustManager NOT IN $ApprovedPinningApps$ — custom pin validation is the evasion mechanism'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes RSA/ECC keypair generation, public-key import, or asymmetric encryption operations (KeyPairGenerator, Cipher.RSA, ECDH) NOT IN $ApprovedCryptoApps$ before network transmission'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Keypair generation, import, or private-key access events occurring prior to outbound communication not matching app declared secure-communication function'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: MediaProjection capture session, accessibility-based foreground content observation, or privileged screencap/screenrecord invocation from app while different app is foregrounded — cross-app screen content access'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Multiple applications invoking core system APIs (sensor, permission, telephony, PackageManager) show inconsistent, suppressed, or modified return values compared to OS-expected behavior — cross-app API result inconsistency is the runtime hi'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Device integrity degradation (root detected, system partition modification, SafetyNet/Play Integrity failure) coincident with anomalous system API behavior affecting runtime resolution'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes PackageInstaller uninstall or pm uninstall for own package or companion package NOT IN $ProtectedPackageList$ without user-initiated UI flow matching'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Background scheduler or persistent service triggers retrieve-then-write cycle'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Background task activation immediately before retrieve-then-write cycle on supervised device'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Application registers BroadcastReceiver via registerReceiver() or manifest-declared receiver for sensitive system intents (BOOT_COMPLETED, SMS_RECEIVED, ACTION_PACKAGE_REPLACED, CONNECTIVITY_CHANGE, USER_PRESENT) NOT IN $ApprovedReceiverApp'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes PackageManager.setComponentEnabledSetting() to COMPONENT_ENABLED_STATE_DISABLED on its own LAUNCHER activity while continuing active background or foreground-service execution'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Unified Log entry at level=fault in subsystem com.apple.kernel or com.apple.sandbox within $KernelFaultWindow$ of integrity_check failure — kernel-level fault coincident with integrity failure is the exploit-execution signal; requires super'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: ConnectivityManager, TelephonyManager, or WifiManager framework callbacks report repeated failure, disable, or oscillation events outside expected coverage-transition pattern'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: ContentResolver, DocumentProvider, StorageAccessFramework, or bulk stream I/O invocations exceed $FileModificationRateThreshold$ operations per minute across distinct file paths — API-level operation rate distinguishes ransomware from norma'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Known application begins first-seen or expanded use of content providers, account services, accessibility, or network destinations not in $AppBehaviorBaseline$ post-update'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Known app begins first-seen use of protected framework categories (location, microphone, contacts) or background task patterns post-update'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App begins first-seen network connections to destinations matching known-malicious SDK C2 patterns or outside $SDKBaselineEndpoints$ for embedded SDK namespace'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Known app begins first-seen use of protected categories (analytics, location, contacts) matching known-SDK behavior patterns post-update'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Recently updated trusted app invokes special-access paths, account services, or accessibility not present in prior version baseline'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Launch services, extension-handling, or framework subsystem anomalies occur near install or first launch of recently updated trusted app on supervised device'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App uses background work scheduler, JobScheduler, or persistent service to trigger web-service resolver fetch without user interaction'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Background task or networking subsystem event occurs immediately before web-service resolver fetch'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Background work scheduler, foreground service, or persistent service activates'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Background task or persistent networking event activates'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Accessibility-enabled app NOT IN $AccessibilityAllowList$ invokes performAction() click, global action (GLOBAL_ACTION_BACK/HOME/RECENTS), or insertText() on a UI element belonging to a different foregrounded app — cross-app UI action is the'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App intercepts notification content from source_app IN $HighValueNotifApps$ (banking, auth, messaging) while AppState=background'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes cryptographic functions (javax.crypto.Cipher, Android KeyStore, AES/RSA/ECC operations) on data buffer followed by encode-then-transmit sequence NOT matching app declared network function — app-layer crypto on data before transm'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes ContentResolver or SAF (Storage Access Framework) queries across multiple user-data paths outside its own sandbox in background state'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Managed app accesses broad local data scope without user-initiated document picker interaction on supervised device'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes startForegroundService() or startForeground() NOT IN $ApprovedForegroundServiceApps$'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes DownloadManager, URLConnection, or OkHttp download to write retrieved content to app-controlled path outside original APK scope — programmatic download of executable artifact'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Managed app performs post-download processing, dynamic resource handling, or module preparation immediately after retrieval from non-CDN source on supervised device'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App loads native library (.so) or resolves JNI bridge NOT IN $ApprovedNativeLibraries$ immediately before suspicious lower-level activity (sensor access, file write, network connection) — native code loading before anomalous activity is the'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App transitions from managed-code execution into JNI/native function context or attaches native thread,'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App is replaced or reinstalled'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App enqueues WorkManager work, schedules JobScheduler job, or sets AlarmManager with repeating interval NOT IN $ApprovedSchedulerApps$'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Managed app creates NSBackgroundActivityScheduler activity or registers BGTask with repeating=true or deferred interval outside $ApprovedSchedulerApps$ function'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App initializes proxy-capable or raw-socket networking constructs (ServerSocket, SOCKS proxy client, bidirectional relay) NOT IN $ApprovedProxyApps$ — proxy initialization is the technique enabler'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes TelecomManager.answerCall(), placeCall(), endCall(), or ConnectionService call-handling operations without corresponding user-initiated call UI interaction'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App process loads external code module or native library from non-system path injected into zygote or app_process runtime — abnormal library injection path is the hooking mechanism indicator'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes SensorManager.registerListener() for TYPE_ACCELEROMETER or TYPE_GYROSCOPE NOT IN $ApprovedMotionApps$ followed by conditional execution branching correlated with sensor readings — motion sensing followed by behavioral conditiona'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes ZIP, GZIP, or bulk-buffer packaging routines (ZipOutputStream, DeflaterOutputStream, similar) on previously accessed local data in background state'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App applies encryption to newly created archive or staged data blob before network transmission — encrypt-after-archive confirms adversary-controlled packing for exfil'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App performs bulk data transformation or packaging-like processing on collected records prior to outbound transfer on supervised device'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App registers BroadcastReceiver or schedules job for system events (BOOT_COMPLETED, SMS_RECEIVED, ACTION_PACKAGE_REPLACED, CONNECTIVITY_CHANGE, ACTION_USER_PRESENT) NOT IN $ApprovedEventTriggerApps$ — sensitive system event registration is'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App loads library or executes component'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes privileged framework APIs (accessibility performAction, WindowManager.addView TYPE_APPLICATION_OVERLAY, PackageInstaller) immediately after acquiring elevation control mechanism without expected user settings navigation time'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App performs burst of environmental check APIs (Build properties, TelephonyManager IMSI, PackageManager security-tool query) at cold launch before user interaction — multi-category environment fingerprint is the guardrail setup'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App performs UIDevice model + iOS version + enrollment state checks at cold launch before user interaction — device fingerprinting guardrail setup'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes package management, DevicePolicyManager, or settings operations capable of disabling security tooling — API invocation to disable security control'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes accessibility global actions (back, home, recents) or DevicePolicyManager removal-resistance operations when package-management or uninstall UI is in foreground — active uninstall interference'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes package manager operations (disable component, clear data, request uninstall) or settings modifications targeting security tool packages IN $SecurityToolPackageList$'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes file deletion, database truncation, log clearing, or app-data-clear operations within $CleanupWindow$ of prior data access or network exfiltration event — post-exfil cleanup chain'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes file deletion, container-local database truncation, or cache-clear operations on supervised device within $CleanupWindow$ of prior data access or upload event'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Protected resource use, privileged API invocation, or telephony/accessibility/overlay access occurs from system-app context while device is locked or before normal setup completion'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Supplemental baseband, IOKit, accessory, security, or activation-related subsystem anomalies on supervised device at activation — Unified Log supplemental confirmation'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): dlopen() of Industrial Control Systems (ICS) vendor shared library by process not in authorized ICS applications, followed by write-capable network connection to device subnet'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): ioctl or mmap syscall against Industrial Control Systems (ICS) hardware device file from process not in authorized ICS applications'}
x_mitre_log_sources		{'name': 'edr:Syscall', 'channel': 'DeviceIoControl or raw socket creation to Industrial Control Systems (ICS) protocol port from process not in authorized ICS applications, bypassing documented vendor Software Development Kit (SDK) call pattern'}

[DC0032] Process Creation

Current version: 2.2

Version changed from: 2.1 → 2.2

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.773000+00:00	2026-10-13 17:43:45.184000+00:00
x_mitre_version	2.1	2.2

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'execve for python/python3 and script path/arguments'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'execve for node/nodejs or JavaScript runtime and child processes '}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'execve for shell/interpreter and child commands '}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'syscall=execve; command or executable associated with the technique runs outside the approved ICS administrative/application baseline'}
x_mitre_log_sources		{'name': 'WinEventLog:Security', 'channel': 'EventCode=4688; cmd.exe/batch execution with parent and command line '}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1; Python interpreter/script execution and lineage'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1; process lineage and command line'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1; powershell/pwsh or suspicious parent-child chain'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon ', 'channel': 'EventCode=1; wscript.exe/cscript.exe/mshta.exe and child-process lineage '}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Application invokes Runtime.exec(), ProcessBuilder.start(), or JNI-backed launcher with sh, bash, toybox, toolbox, or su as command argument NOT IN $ApprovedShellApps$ — explicit Unix shell invocation'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Managed iOS app invokes process-launch behavior resulting in sh, bash, or equivalent shell child process on supervised device — any shell spawn on stock iOS is a jailbreak indicator'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'execve()'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'com.apple.WebKit or com.apple.WebContent process fault at level=fault within $DriveByWindow$ of navigation to flagged URL — kernel fault in WebKit subsystem is the exploit-execution signal'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'execve() of modified binary (hash != baseline) — execution of modified binary is the persistence activation'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'com.apple.WebContent or com.apple.imagent process shows unexpected child spawn or memory fault at level=fault in Unified Log — kernel fault in message-processing subsystem is exploit execution signal'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'execve() from APK installed within $PhishingWindow$ of navigation to flagged URL — first execution confirms malware activation'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': "sh or cmd process spawned with arguments containing 'pm uninstall' or 'rm' by parent NOT IN $MDMAgentPackageList$ — shell invocation for destruction commands"}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'kernel fault or unexpected child spawn in subsystem IN (com.apple.WebKit, com.apple.imtransferagent, com.apple.imagent) at level=fault in Unified Log'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Application installed with install_source=adb or install_source=sideload from USB-connected host within $USBInstallWindow$ of USB mode change'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'App invokes Runtime.exec(), ProcessBuilder.start(), or JNI-backed command execution framework to spawn shell or command interpreter process NOT IN $ApprovedShellApps$ — programmatic shell spawn is the interpreter invocation'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Managed iOS app invokes lower-level process-launch behavior or command-execution-equivalent activity outside sandbox-permitted APIs on supervised device'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'App execution triggered with unexpected parent context or via indirect invocation (intent redirect, implicit intent resolution to unexpected handler) — indirect invocation path is the flow hijack confirmation'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; command line invokes iptables/nftables to change ICS traffic filtering or redirection outside the authorized network-administration baseline'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; mount/udisksctl invoked to mount a removable block device on an ICS asset outside the approved removable-media workflow'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): execve with path under /media/ or /mnt/ removable mount point within Universial Serial Bus (USB) execution window of mount event'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): execve of network discovery tool (nmap, arp-scan, PLCScan) by User Identifier (UID) not in authorized net admin UIDs'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): unexpected process creation from web server daemon User Identifier (UID) spawning shell process'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): Secure Shell (SSH)-based propagation pattern (connection to multiple hosts followed by file transfer and execution) within a short window'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; systemctl/kill command targets a critical ICS service from a UID not in the authorized service-administration set'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; shell/interpreter process is spawned by an ICS network-facing service or other unexpected parent process'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; network-enumeration utility launched by a UID not in the authorized network-administration set'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; passwd/chpasswd targets an ICS service account outside the approved credential-rotation workflow'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; ICS HMI/GUI application launched from an SSH-associated process/session outside the approved remote-administration baseline'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; browser process spawns a command shell, script interpreter, or executable child inconsistent with the approved browser-child baseline'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; SSH/SNMP/remote-management command includes a remote target host and queries system identity/inventory from an account outside the authorized management set'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; document/viewer process launches a child process outside the expected viewer-child baseline'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; device restart/shutdown command invoked outside the approved change-control window by an unauthorized UID'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; firmware-update utility invoked outside the approved maintenance window or by a UID not in the authorized firmware-management set'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): execve of nmap/masscan with arguments targeting Industrial Control Systems (ICS) protocol port ranges'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; command or executable associated with the technique runs outside the approved ICS administrative/application baseline'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; iptables/nftables command adds a rule that blocks ICS protocol traffic outside the authorized network-administration baseline'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; ip link command disables an interface on an ICS gateway outside the authorized network-administration baseline'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; hostapd/wireless-controller configuration command disables or alters an ICS wireless network outside the authorized wireless-administration baseline'}
x_mitre_log_sources		{'name': 'WinEventLog:System', 'channel': 'System crash or unexpected halt occurring within wiper crash window of the bulk deletion event'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 firmware-update utility spawned by an account outside the authorized firmware-management set or outside the approved maintenance window'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 where a browser process spawns cmd.exe, powershell.exe, wscript.exe, or another executable outside the approved browser-child baseline'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 with parent matching web/application server process and image matching shell/script interpreter within exploit-to-shell window of anomalous request'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 of the newly-created file within tool transfer window of its creation'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 process execution associated with a remote session targets ICS application directories or initiates device-subnet activity'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'Microsoft-Windows-Sysmon/Operational Event ID 1 ProcessCreate: Process execution within the remote session targeting Industrial Control Systems (ICS) application directories or device subnet connections'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 with image path on removable drive letter within Universal Serial Bus (USB) execution window of insertion event'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 of network discovery tool (nmap, PLCScan) from process not in authorized network tools list'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 of archive utility immediately following bulk file access pattern from same parent process tree'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 sc.exe/net.exe invocation targeting a critical ICS service from an account outside the authorized service-administration set'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 network enumeration command from account not in approved network admins, with more than one distinct command within enumeration time window'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 parent matches outlook.exe/winword.exe/excel.exe and image matches cmd.exe/powershell.exe/wscript.exe/mshta.exe on host in Industrial Control Systems (ICS) workstation inventory'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 remote-management command (for example wmic /node, winrs, or PowerShell/CIM with -ComputerName) includes a remote target and queries system identity/inventory outside the authorized management baseline'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 chain originating from user-invoked file open or link click action, spawning processes not in expected document viewer children'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 image matches certutil.exe/regsvr32.exe/mshta.exe/rundll32.exe and command line matches Living-off-the-Land Binary (LOLBin) abuse patterns on host in Industrial Control Systems (ICS) workstation inventory'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 capture utility execution from account not in approved network analysts'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 firmware update tool process activating firmware mode, by account not in authorized firmware managers, outside maintenance window schedule'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 of port scanning utility with arguments targeting Industrial Control Systems (ICS) protocol port ranges'}

[DC0034] Process Metadata

Current version: 2.2

Version changed from: 2.1 → 2.2

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.778000+00:00	2026-10-13 17:43:44.003000+00:00
x_mitre_version	2.1	2.2

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'WinEventLog:PowerShell', 'channel': 'EventCode=400/403; engine lifecycle/context'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: running process names read from /proc//status or /proc//cmdline by app NOT IN $ProcessDiscoveryAllowList$'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: process executing with effective UID=0'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): execve with env containing LD_PRELOAD where exe matches Industrial Control Systems (ICS) service binary list and preload library not in vendor package manifest'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): execve where exe basename matches Industrial Control Systems (ICS) daemon names but path outside vendor install paths'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): execve of wireless configuration utility setting monitor/promiscuous mode outside change management window'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): setuid/setgid to root from a process owned by Industrial Control Systems (ICS) service User Identifier (UID) that was not invoked via sudo'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): execve of wireless configuration utility setting monitor mode on Industrial Control Systems (ICS) Linux asset by User Identifier (UID) not in authorized wireless admin UIDs'}
x_mitre_log_sources		{'name': 'edr:ProcessIntegrity', 'channel': 'Process integrity/hash mismatch detected on Industrial Control Systems (ICS) communication process post-hook-install event'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 where image filename matches Industrial Control Systems (ICS) vendor process names but hash not in vendor hash baseline or current directory outside vendor install paths'}

[DC0118] System Settings

Current version: 2.2

Version changed from: 2.1 → 2.2

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.773000+00:00	2026-10-13 17:40:42.444000+00:00
x_mitre_version	2.1	2.2

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'MobileEDR:telemetry', 'channel': 'Settings.Secure/Global write to install_unknown_apps=1 by process NOT IN MDMAgentPackageList + PackageInstaller call with unknown cert within TimeWindow where MDM agent is the only authorized settings writer'}
x_mitre_log_sources		{'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported'}
x_mitre_log_sources		{'name': 'iOS:MDM', 'channel': 'DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries'}

Patches

[DC0112] API Calls

Current version: 2.1

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.773000+00:00	2026-10-13 17:40:33.749000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: APK or IPA contains SystemProperties.get() calls, Runtime.exec getprop invocations, or code patterns checking for emulator artifacts (ro.product.model=sdk, IMEI=000000, screen size, sensor absence) — static detection of environment-check co'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: IPA contains UIDevice.currentDevice.model checks for Simulator strings, CMMotionManager.isDeviceMotionAvailable comparisons, or other Simulator-detection patterns — static detection of iOS environment-check code'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: ClipboardManager.addOnPrimaryClipChangedListener()'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: UIPasteboard.general.string property accessed by app'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: AccessibilityEvent.TYPE_VIEW_TEXT_CHANGED received by listener_app NOT IN $AccessibilityAllowList$'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: AccessibilityEvent.TYPE_VIEW_TEXT_CHANGED received by listener NOT IN $AccessibilityAllowList$ at rate > $KeystrokeEventThreshold$ per minute with source_apps spanning > $AppMonitorCountThreshold$ distinct apps'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: PackageManager.getInstalledPackages() or getInstalledApplications() called by app NOT IN $AppEnumAllowList$'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': "Dynamic API/runtime trace: UIApplication.canOpenURL() called > $URLProbeThreshold$ times with schemes NOT declared in app's LSApplicationQueriesSchemes within $ProbeWindow$"}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: PackageManager.getPackageInfo() called for package names IN $SecurityToolPackageList$ by app NOT IN $AppEnumAllowList$'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: UIApplication.canOpenURL() called with schemes IN $MDMToolSchemeList$ by app NOT IN $AppEnumAllowList$'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: WifiInfo.getBSSID()'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: NetworkInterface.getNetworkInterfaces()'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: ConnectivityManager.getActiveNetworkInfo() or InetAddress.isReachable() called by app NOT IN $ConnectivityAllowList$ at app launch or on schedule without user action'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: NWPathMonitor.start() or SCNetworkReachabilityGetFlags() called by app NOT IN $ConnectivityAllowList$ at launch or on background schedule'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: WifiManager.getScanResults()'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: CNCopyCurrentNetworkInfo() or NEHotspotHelper.register() called by app NOT IN $WiFiAllowList$'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: android.os.Build field reads > $SysInfoFieldThreshold$ distinct fields within $SysInfoWindow$ by app NOT IN $SysInfoAllowList$ at launch or in background'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: UIDevice.current.model'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: AudioRecord.startRecording() or MediaRecorder.start() called by app NOT IN $AudioAllowList$'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: LocationManager.requestLocationUpdates() called with minTime < $LocationUpdateFreqThreshold$ by app NOT IN $LocationAllowList$'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: FirebaseMessaging.getToken() called for project_id NOT IN $FCMAllowList$ — rogue FCM project registration is the adversary enabling C2 over Google infrastructure'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: UNUserNotificationCenter or legacy UIApplication.registerForRemoteNotifications with Apple Team ID NOT IN $APNSAllowList$ — rogue APNS sender registration'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: AccessibilityService receiving events from dc(source_app) > $AccessibilityTargetThreshold$ distinct apps INCLUDING apps IN $TargetAppList$ — broad monitoring across apps distinguishes malware from single-purpose assistive tech'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: getNetworkInterfaces() OR NetworkInterface.getHardwareAddress() called within $ProcReadWindow$ of /proc reads by same app — network MAC OUI check completes hardware fingerprint'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: UIDevice.currentDevice.model'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: PackageManager.queryIntentActivities() returns handler_count > 1 for custom URI scheme'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: PackageManager reports two or more apps with identical URI scheme intent-filter'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: ContentResolver.query() to sensitive provider URI (contacts, calendar, call_log, sms) with query_count > $ContentQueryThreshold$ by app NOT IN $ApprovedDataApps$'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: CNContactStore.enumerateContacts or EKEventStore.fetchEvents or CLLocationManager.startUpdatingLocation called with broad scope by app NOT IN $ApprovedDataApps$'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: ContentResolver.query(CalendarContract) with query_count > $CalendarQueryThreshold$ by app NOT IN $ApprovedCalendarApps$'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: EKEventStore.fetchEvents() or enumerateEvents() with date_range > $CalendarDateRangeThreshold$ days by app NOT IN $ApprovedCalendarApps$'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: ContentResolver.query(CallLog.Calls) with query_count > $CallLogQueryThreshold$ by app NOT IN $ApprovedDialerApps$'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: ContentResolver.query(ContactsContract) with projection=all_fields'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: CNContactStore.enumerateContacts with CNContactFetchRequest.keysToFetch containing all contact keys by app NOT IN $ApprovedContactsApps$'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: ContentResolver.query(Telephony.Sms) including both inbox'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: AccountManager.getAccounts() OR getAccountsByType() called > $AccountEnumThreshold$ times within $AccountEnumWindow$ by app NOT IN $ApprovedAuthenticatorApps$'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: SecItemCopyMatching() called with kSecMatchLimitAll'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: InetAddress.getByName() or DnsResolver called > $DGACandidateThreshold$ times with algorithmically-distinct hostnames in $DGAWindow$ — rapid programmatic resolution attempts'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: DevicePolicyManager.resetPassword() or lockNow() or wipeData() called by caller NOT IN $MDMAgentPackageList$'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': "Dynamic API/runtime trace: ContentResolver.update() called by writer_app NOT IN $LegitimateIPCPartners$ for target_app's content provider URI"}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: ClipboardManager.addOnPrimaryClipChangedListener() registered'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: DevicePolicyManager.lockNow() or resetPassword() called by caller NOT IN $MDMAgentPackageList$'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: SmsManager.sendTextMessage() called by app NOT IN $ApprovedMessagingApps$'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: NotificationListenerService.onNotificationPosted() receiving notifications from source_app IN $HighValueNotifApps$ by listener NOT IN $NotificationAllowList$'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: camera activated within app IN $MessagingAppList$ — QR scan requires camera access; activation in messaging app context is the trigger signal'}

[DC0083] Cloud Service Enumeration

Current version: 3.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.775000+00:00	2026-10-13 17:40:40.732000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'cloud:AuditLog', 'channel': 'Instrumented app API trace and corresponding cloud-service audit/API telemetry'}

[DC0040] File Deletion

Current version: 3.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.778000+00:00	2026-10-13 17:43:44.580000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: App deletes, truncates, or removes files that were recently written by the same app (collected data, staged exfil artifacts, operation logs) within $PostExfilCleanupWindow$ of network upload event — post-exfil cleanup chain'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: App deletes package files or local state immediately before package inventory disappearance — pre-removal evidence cleanup'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: unlink() or rmdir() on path IN /data/data/ OR /data/user/ OR /sdcard/ by process NOT IN $MDMAgentPackageList$ at rate > $DeletionRateThreshold$ within $DestructionWindow$'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL+PATH', 'channel': 'Linux Audit SYSCALL+PATH records: truncate/shred/rm on Industrial Control Systems (ICS) application log files or auth.log by User Identifier (UID) not in authorized log admin UIDs'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL+PATH', 'channel': 'Linux Audit SYSCALL+PATH records: rm/shred/dd operations across multiple Industrial Control Systems (ICS) data directories exceeding bulk deletion threshold, by User Identifier (UID) not in authorized data management UIDs'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=23 across multiple Industrial Control Systems (ICS) data directories exceeding bulk deletion threshold within data destruction time window, by process not in authorized data management tools'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=23 or wevtutil/Clear-EventLog invocation deleting Industrial Control Systems (ICS) vendor application log file by process not in authorized log management tools'}
x_mitre_log_sources		{'name': 'WinEventLog:System', 'channel': 'EventCode=104 outside scheduled log rotation window'}

[DC0059] File Metadata

Current version: 2.1

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.774000+00:00	2026-10-13 17:43:44.279000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: DEX file entropy > $PackerEntropyThreshold$ at install time for app NOT IN $MDMApprovedCatalog$'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: app_version in MDM == prior_version while dynamic code load from network is observed — confirms this is not a legitimate update'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: binary with file_permissions including setuid bit (mode & 04000) at path NOT IN $KnownSystemBinPaths$ — setuid outside system bin directories is the renamed-root-binary indicator'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: file hash changes for binary at $SystemBinaryPaths$ relative to known-good baseline — hash deviation confirms modification'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: MDM supervised integrity_check=fail following jailbreak detection — integrity check failure on supervised Jamf/Intune enrolled device indicates filesystem modifications beyond passive jailbreak presence'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: installed app package_name Levenshtein distance <= $NameDistanceThreshold$ to entry in $KnownAppCatalog$'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: bundle_id LIKE $KnownSystemNamespace$'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: app package_name distance <= $NameDistanceThreshold$ from $KnownAppCatalog$ entry'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: display_name Levenshtein distance <= $NameDistanceThreshold$ from $KnownIOSAppCatalog$ entry'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL+PATH', 'channel': 'Linux Audit SYSCALL+PATH records: package installation creates files outside the documented package manifest'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL+PATH', 'channel': 'Linux Audit SYSCALL+PATH records: write to Industrial Control Systems (ICS) project file path by uid not in authorized engineering User Identifiers (UIDs) or from path not in approved project sources'}
x_mitre_log_sources		{'name': 'linux:pkgintegrity', 'channel': 'rpm -V/dpkg --verify checksum mismatch for installed Industrial Control Systems (ICS) package binary'}
x_mitre_log_sources		{'name': 'fim:hashcompare', 'channel': 'installed binary hash does not match vendor-published checksum for claimed version'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'Microsoft-Windows-Sysmon/Operational Event ID 11 FileCreate/overwrite or Event ID 2 FileCreateTime, as applicable: Process creation and file creation correlation: vendor installer creates files outside vendor install manifest or spawns undocumented child process'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=11 matching Industrial Control Systems (ICS) vendor binary name in a path outside vendor install paths'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'Microsoft-Windows-Sysmon/Operational Event ID 11 FileCreate/overwrite or Event ID 2 FileCreateTime, as applicable: Engineering tool process opens project file from path not in approved project repository (removable media, email attachment cache, untrusted network share)'}

[DC0061] File Modification

Current version: 3.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.775000+00:00	2026-10-13 17:43:40.092000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: write() to /sdcard/ path'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: ContentResolver.update() or write() to path owned by target_app IN $HighValueAppList$ by writer_app != target_app — cross-app data modification'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: write() to path IN $SystemBinaryPaths$ by process NOT IN $TrustedUpdateSources$'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: app version change detected in MDM inventory for app_package — update is the binary modification event'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: app version change in MDM inventory for bundle_id'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: App inserts, updates, or deletes call log records via CallLog.Calls ContentProvider immediately after call-control action — call log tampering to conceal interception'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL+PATH', 'channel': 'Linux Audit SYSCALL+PATH records: write to Industrial Control Systems (ICS) alarm configuration file by User Identifier (UID) not in authorized alarm admin UIDs'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL+PATH', 'channel': 'Linux Audit SYSCALL+PATH records: write to /etc/ld.so.preload by User Identifier (UID) outside authorized admin list'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL+PATH', 'channel': 'Linux Audit SYSCALL+PATH records: PATH record shows modification of udev/autofs configuration that references an executable or script outside the authorized ICS software inventory'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL+PATH', 'channel': 'Linux Audit SYSCALL+PATH records: modification of bash_history file by uid not normally performing interactive shell sessions'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL+PATH', 'channel': 'Linux Audit SYSCALL+PATH records: write to alarm threshold config file by uid not in authorized alarm admin User Identifiers (UIDs)'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL+PATH', 'channel': 'Linux Audit SYSCALL+PATH records: PATH record shows modification of a serial-device configuration file by a UID not in the authorized serial-administration set'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL+PATH', 'channel': 'Linux Audit SYSCALL+PATH records: write to Siemens project file path by User Identifier (UID) not in authorized Siemens engineering UIDs'}
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'write erase or factory-reset command from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'Siemens engineering tool opens project file from path not in approved project repository'}

[DC0113] Network Communication

Current version: 2.1

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.774000+00:00	2026-10-13 17:40:41.893000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'android:EnterpriseNetworkLog', 'channel': 'DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata'}
x_mitre_log_sources		{'name': 'iOS:NetworkExtension', 'channel': 'NEFilterFlow / per-app VPN / secure-web-gateway flow metadata'}

[DC0116] Permissions Request

Current version: 2.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:40:39.609000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}
x_mitre_log_sources		{'name': 'mobile:ApplicationVetting', 'channel': 'Code-signing entitlements and Info.plist privacy usage-description keys'}

[DC0035] Process Access

Current version: 3.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.770000+00:00	2026-10-13 17:43:48.812000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: accessibility_service or notification_listener appears attributed to a bundle IN $LegitimateSystemProcesses$ within $InjectionWindow$ of root detection — injected code requesting special permissions under a legitimate system process identit'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: kernel log entry at level=fault referencing task_for_pid or get-task-allow violation on SUPERVISED device with Unified Log forwarding — kernel records entitlement violations at fault level; requires supervised MDM with Unified Log export'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: process in $TargetProcessList$ shows unexpected behavior change (new network destinations, new permission accesses) within $InjectionWindow$ of root status change — behavioral delta in target process post-injection is the anomaly indicator'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: kernel log at level=fault referencing task_for_pid, mach_vm_write, or get-task-allow outside developer build on SUPERVISED device — Apple Unified Log kernel subsystem records these violations at fault level; supervised MDM with Unified Log'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=ptrace/process_vm_readv; process accesses an ICS service process PID from an image or UID not in the debugger/diagnostic allowlist'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=10 where SourceImage outside the approved ICS vendor/process baseline accesses TargetImage associated with an ICS application or service'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=10 cross-process memory access into Industrial Control Systems (ICS) vendor process from image not in trusted security tool list, followed by unexpected termination within exploit crash correlation window'}

[DC0033] Process Termination

Current version: 2.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-11-12 22:03:39.105000+00:00	2026-10-13 17:43:45.560000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): Industrial Control Systems (ICS) service process terminated (SIGKILL/SIGSEGV) following high-rate inbound connections recorded in netflow within the same window'}

[DC0115] Protected Configuration

Current version: 2.1

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.774000+00:00	2026-10-13 17:40:34.763000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'iOS:MDMLog', 'channel': "profile with payload_type LIKE 'com.apple.security.*' installed where mdm_origin=false — security payload from non-MDM source is the policy modification event"}
x_mitre_log_sources		{'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported'}
x_mitre_log_sources		{'name': 'iOS:MDM', 'channel': 'DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries'}

[DC0001] Scheduled Job Creation

Current version: 3.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.778000+00:00	2026-10-13 17:43:53.278000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: Scheduled task execution creates file, accesses sensor, or initiates network connection immediately after firing, with no recent user interaction triggering the task'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: Scheduled task execution produces network, local-write, or sensor artifact while app_state=background or device_locked=true without user trigger'}
x_mitre_log_sources		{'name': 'WinEventLog:Security', 'channel': 'Windows Security Event ID 4698/4702: EventCode=4698 referencing Industrial Control Systems (ICS) vendor binary name from unauthorized process'}

[DC0117] System Notifications

Current version: 2.1

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.778000+00:00	2026-10-13 17:40:39.059000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'iOS:ManagedAppLog', 'channel': 'ManagedApplicationFeedback or application-generated telemetry'}
x_mitre_log_sources		{'name': 'android:ManagedAppLog', 'channel': 'Documented DPC/admin callbacks or managed-app generated event telemetry'}

[DC0002] User Account Authentication

Current version: 3.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.777000+00:00	2026-10-13 17:43:46.928000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'saas:audit ', 'channel': 'Successful application-specific/legacy credential authentication where exposed '}
x_mitre_log_sources		{'name': 'azure:signinlogs', 'channel': 'Successful account authentication with authentication/client properties inconsistent with normal MFA-backed access '}
x_mitre_log_sources		{'name': 'idp:authentication ', 'channel': 'Successful authentication associated with legacy/application-specific credential flow '}
x_mitre_log_sources		{'name': 'idp:AuditLog', 'channel': 'App authentication flow instrumentation or IdP sign-in/audit events'}
x_mitre_log_sources		{'name': 'syslog:auth', 'channel': 'sshd Accepted publickey/password for Industrial Control Systems (ICS)-role account from source not in approved admin CIDR'}
x_mitre_log_sources		{'name': 'networkdevice:aaa', 'channel': 'TACACS+/RADIUS authentication success for Industrial Control Systems (ICS) network admin account from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet'}
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'Device authentication/audit log: successful authentication using a vendor-default or prohibited account from a non-approved management source'}
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'Device authentication/audit log: successful authentication using a default/hardcoded/prohibited account from a non-approved management source'}
x_mitre_log_sources		{'name': 'WinEventLog:Security', 'channel': 'Windows Security Event ID 4624/4625: EventCode=4648 for Industrial Control Systems (ICS)-role account from process outside approved ICS vendor process list'}
x_mitre_log_sources		{'name': 'WinEventLog:Security', 'channel': 'Windows Security Event ID 4624/4625: EventCode=4723, 4724 for Industrial Control Systems (ICS) service/operator account by account not in authorized credential admins outside credential rotation schedule'}

ics-attack

Minor Version Changes

[DC0038] Application Log Content

Current version: 3.1

Version changed from: 3.0 → 3.1

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.776000+00:00	2026-10-13 17:43:41.733000+00:00
x_mitre_log_sources[173]['name']	saas:Airtable	WinEventLog:System
x_mitre_log_sources[173]['channel']	EXPORT: User-triggered data export via GUI or API	network adapter disabled on Industrial Control Systems (ICS) gateway host by process not in authorized network admins
x_mitre_version	3.0	3.1

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'm365:unified', 'channel': 'CopilotInteraction'}
x_mitre_log_sources		{'name': 'AWS:bedrock', 'channel': 'GuardrailTrace'}
x_mitre_log_sources		{'name': 'AWS:bedrock', 'channel': 'AgentTrace.FailureTrace'}
x_mitre_log_sources		{'name': 'AWS:bedrock', 'channel': 'AgentTrace.ModelInvocationInput'}
x_mitre_log_sources		{'name': 'AWS:bedrock', 'channel': 'AgentTrace.actionGroupInvocationInput'}
x_mitre_log_sources		{'name': 'AWS:bedrock', 'channel': 'AgentTrace.knowledgeBaseLookupInput'}
x_mitre_log_sources		{'name': 'casb:activity ', 'channel': 'Subsequent sensitive data access or outbound transfer occurs in the same SaaS session '}
x_mitre_log_sources		{'name': 'm365:unified', 'channel': 'Authentication/account audit event identifying app-password or applicable legacy-authentication activity '}
x_mitre_log_sources		{'name': 'saas:audit', 'channel': 'Actual send/share/upload/write operation'}
x_mitre_log_sources		{'name': 'engineeringworkstation:ApplicationLog', 'channel': 'firmware write session initiated without corresponding change ticket reference'}
x_mitre_log_sources		{'name': 'engineeringworkstation:ApplicationLog', 'channel': 'program download session logged without corresponding change ticket reference'}
x_mitre_log_sources		{'name': 'syslog:daemon', 'channel': 'Industrial Control Systems (ICS) daemon log entry indicating connection limit exceeded, out of memory, or watchdog timeout'}
x_mitre_log_sources		{'name': 'webserver:applog', 'channel': 'Web server/WAF access or request log: exploit-relevant URI/path/query/header/status pattern against ICS web interface; request-body claims require WAF/DPI logging'}
x_mitre_log_sources		{'name': 'syslog:auth', 'channel': 'Secure Shell (SSH) session with X11 forwarding from source not in approved admin Classless Inter-Domain Routing (CIDR) subnet'}
x_mitre_log_sources		{'name': 'edr:TelemetryCompare', 'channel': 'process enumeration discrepancy between Windows Management Instrumentation (WMI) and direct process listing'}
x_mitre_log_sources		{'name': 'historian:applog', 'channel': 'historian Structured Query Language (SQL) query returning above bulk query threshold rows from account not in approved historian clients'}
x_mitre_log_sources		{'name': 'scada:applog', 'channel': 'device communication-loss alarm generated within detection window of a corresponding network flood alert'}
x_mitre_log_sources		{'name': 'networkdevice:snmp', 'channel': 'ifInErrors or ifOutDiscards rate exceeds baseline combined with cpu5min exceeding utilization threshold'}
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'Network Address Translation (NAT)/route/Access Control List (ACL) configuration change from source not in approved net admins outside config change window'}
x_mitre_log_sources		{'name': 'vpn:applog', 'channel': 'session duration or command activity inconsistent with documented vendor support session profiles'}
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'configuration change logged without corresponding change ticket reference following anomalous authentication'}
x_mitre_log_sources		{'name': 'networkdevice:snmp', 'channel': 'Simple Network Management Protocol (SNMP) walk request from source not in approved Network Management System (NMS) Class Inter-Domain Routing (CIDR) subnet'}
x_mitre_log_sources		{'name': 'networkdevice:snmp', 'channel': 'Simple Network Management Protocol (SNMP) SET to alarm threshold Object Identifier (OID) from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet'}
x_mitre_log_sources		{'name': 'networkdevice:snmp', 'channel': 'Simple Network Management Protocol (SNMP) polling inconsistency or syslog sequence gap suggesting telemetry manipulation'}
x_mitre_log_sources		{'name': 'networkdevice:snmp', 'channel': 'Simple Network Management Protocol (SNMP) SET to power Management Information Base (MIB) restart Object Identifier (OID) or Command Line Interface (CLI) reload command from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet'}
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'Access Control List (ACL)/policy change affecting alarm notification traffic ports without corresponding change ticket'}
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'unexpected listening port or routing table change following firmware update event'}
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'new Media Access Control (MAC) address learned on a switch port previously unused or assigned to a different device, followed by Industrial Control Systems (ICS) protocol traffic to field devices'}
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'management command succeeds from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet, preceded by exploit-pattern traffic to management interface'}
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'syslog sequence number gap or forwarding interruption coinciding with suspicious activity window for the same device'}
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'Simple Network Management Protocol (SNMP) SET to service stop Object Identifier (OID) or Command Line Interface (CLI) command stopping critical service from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet'}
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'AAA/Simple Network Management Protocol (SNMP) credential change from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet, followed by authentication failures from legitimate NMS systems'}
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'remote console or web management session from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet'}
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'Access Control List (ACL) modification blocking Industrial Control Systems (ICS) reporting message ports while command ports remain open'}
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'unexpected restart or crash coinciding with anomalous traffic pattern on management interface'}
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'serial server configuration change altering port parameters for field device ports from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet'}
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'unauthorized Switched Port Analyzer (SPAN) session request or port mirroring configuration from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet'}
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'Switched Port Analayzer (SPAN) session or port mirroring configuration change from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet'}
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'Access Control List (ACL)/firewall/routing configuration change from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet outside change control window'}
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'interface shutdown command on Industrial Control Systems (ICS) device port from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet outside change control window'}
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'deauthentication targeting more than mass deauth threshold enrolled devices within deauth time window, or Media Access Control (MAC) address filter config change excluding enrolled devices, from source not in approved wireless admin list'}
x_mitre_log_sources		{'name': 'opc:applog', 'channel': 'client_id not in approved Open Platform Communications (OPC) clients issuing high-volume read requests'}
x_mitre_log_sources		{'name': 'opc:applog', 'channel': 'Open Platform Communications (OPC) client polling frequency for tag set exceeds documented Human-Machine Interface (HMI) refresh baseline from client not in approved application list'}
x_mitre_log_sources		{'name': 'opc:applog', 'channel': 'Open Platform Communications Data Access (OPC DA) write queue depth or write throughput to a single point exceeds configured baseline by a significant margin'}
x_mitre_log_sources		{'name': 'opcua:AuditEvent', 'channel': 'OPC UA AuditUpdateMethodEventType/AuditWriteUpdateEventType: ClientUserId, ClientApplicationUri, SourceNode/MethodId, Status and arguments for a state-changing method/write'}
x_mitre_log_sources		{'name': 'opc:applog', 'channel': 'write to setpoint tag from client not in approved Open Platform Communications (OPC) clients with value outside baseline value range'}
x_mitre_log_sources		{'name': 'opc:applog', 'channel': 'client_id not in approved Open Platform Communications (OPC) clients traversing entire tag tree rather than known fixed subset'}
x_mitre_log_sources		{'name': 'opc:applog', 'channel': 'Open Platform Communications (OPC) client not in approved OPC clients calling BrowseNamespace traversing entire tag tree'}
x_mitre_log_sources		{'name': 'opc:applog', 'channel': 'command call to field device output tag from process not matching recognized Supervisory Control and Data Acquisition (SCADA)/Distributed Control System (DCS) control application'}
x_mitre_log_sources		{'name': 'engineeringworkstation:ApplicationLog', 'channel': 'mode-change session logged without corresponding change ticket reference'}
x_mitre_log_sources		{'name': 'serialgw:syslog', 'channel': 'serial port parameter change (baud rate, parity, port disable) without corresponding change ticket reference'}
x_mitre_log_sources		{'name': 'engineeringworkstation:ApplicationLog', 'channel': 'firmware update mode entry logged without corresponding change ticket reference'}
x_mitre_log_sources		{'name': 'scada:applog', 'channel': 'write Application Programming Interface (API) call queue depth or throughput to a single point exceeds max write queue depth'}
x_mitre_log_sources		{'name': 'scada:applog', 'channel': 'parameter write logged without corresponding operator_id in the Human-Machine Interface (HMI) audit trail'}
x_mitre_log_sources		{'name': 'scada:applog', 'channel': 'command issued to device_ip with no corresponding state-change confirmation received within command confirmation window'}
x_mitre_log_sources		{'name': 'otndr:BehaviorAlert', 'channel': 'device Input/Output (I/O) state change inconsistent with programmed logic correlating temporally with operator terminal interaction'}
x_mitre_log_sources		{'name': 'device:VendorLog', 'channel': 'protected function (firmware write, memory protection mode change) succeeds for a session that did not complete the documented authentication/privilege-elevation sequence'}
x_mitre_log_sources		{'name': 'engineeringworkstation:ApplicationLog', 'channel': 'Engineering application audit/session log: controller program upload initiated outside approved backup/change window and without documented backup purpose'}
x_mitre_log_sources		{'name': 'engineeringworkstation:ApplicationLog', 'channel': 'full upload session outside backup window schedule without documented backup purpose'}
x_mitre_log_sources		{'name': 'engineeringworkstation:ApplicationLog', 'channel': 'online edit session logged without corresponding change ticket reference'}
x_mitre_log_sources		{'name': 'syslog:auth', 'channel': 'Secure Shell (SSH) connection from source Internet Protocol (IP) address that appeared on Industrial Control Systems (ICS) network within new device window, not in approved device inventory'}
x_mitre_log_sources		{'name': 'vendorapp:ApplicationLog', 'channel': 'Industrial Control Systems (ICS) vendor application log shows endpoint or certificate change without documented maintenance reference'}
x_mitre_log_sources		{'name': 'engineeringworkstation:ApplicationLog', 'channel': 'firmware session initiated outside maintenance window schedule without change ticket reference'}
x_mitre_log_sources		{'name': 'engineeringworkstation:ApplicationLog', 'channel': 'device restart command initiated outside change control window by account not in approved engineer list'}
x_mitre_log_sources		{'name': 'webproxy:applog', 'channel': 'file download from domain not matching verified vendor Transport Layer Security (TLS) certificate/domain history, immediately preceding the anomalous process spawn'}
x_mitre_log_sources		{'name': 'webserver:applog', 'channel': 'Web server/WAF access or request log: exploit-relevant URI/path/query/header/status pattern against ICS web interface from unapproved source; request-body claims require WAF/DPI logging'}
x_mitre_log_sources		{'name': 'WinEventLog:Application', 'channel': 'wireless controller management log: SSID or MAC filter config change from account not in authorized wireless admins'}
x_mitre_log_sources		{'name': 'WinEventLog:System', 'channel': 'Industrial Control Systems (ICS) service failing to start (authentication failure) within credential change impact window of the password change event'}

[DC0064] Command Execution

Current version: 2.2

Version changed from: 2.1 → 2.2

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.774000+00:00	2026-10-13 17:43:48.219000+00:00
x_mitre_log_sources[142]['name']	linus:syslog	linux:syslog
x_mitre_version	2.1	2.2

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'CLI command audit / configuration command history'}
x_mitre_log_sources		{'name': 'WinEventLog:PowerShell', 'channel': 'EventCode=4103/4104/4105/4106; command/script-block content '}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Unix shell process (sh, bash, busybox sh, toybox) spawns as child of app process with command-line arguments indicating scripted operation — shell with arguments confirms script execution not interactive terminal'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Shell or command-executing child process with arguments spawned under managed app context on supervised iOS device'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: pm uninstall OR rm -f called by process NOT IN $MDMAgentPackageList$ for package_count > $BulkUninstallThreshold$ within $DestructionWindow$ — command-line destruction activity'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App spawns sh, bash, toybox, toolbox, or su child process with command arguments within $ShellActivityWindow$ of shell launch — child shell process with arguments is the script execution signal'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Shell process (sh, bash) or command-executing child process spawned under app context on supervised iOS device — any shell spawn on stock iOS indicates jailbreak or kernel exploit'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): sequential reads across ICS data paths by uid not in authorized data access UIDs, followed by tar/zip invocation within a short window'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): execve of screenshot utility (scrot, import, xwd) on Industrial Control Systems (ICS) Human-Machine Interface (HMI) by User Identifier (UID) not in approved operator UIDs'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): system binary executing with command line piping or decoding external content, from Industrial Control Systems (ICS) service account User Identifier (UID)'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): raw socket creation (SOCK_RAW) or tcpdump/tshark execution by uid not in authorized capture User Identifiers (UIDs)'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): Industrial Control Systems (ICS) tool execution following Secure Shell (SSH) lateral movement session'}
x_mitre_log_sources		{'name': 'gpo:deployment', 'channel': 'destructive payload deployed via Group Policy Object (GPO) to multiple hosts simultaneously'}
x_mitre_log_sources		{'name': 'historian:applog', 'channel': 'bulk export query returning above bulk query threshold records from account not in approved historian clients'}
x_mitre_log_sources		{'name': 'WinEventLog:Security', 'channel': 'Windows Security Event ID 4688: EventCode=1102 correlated with any other Medium+ confidence alert on the same host within log clear lookback window'}

[DC0055] File Access

Current version: 3.1

Version changed from: 3.0 → 3.1

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.770000+00:00	2026-10-13 17:43:44.861000+00:00
x_mitre_version	3.0	3.1

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: open() for read on path IN /sdcard/ OR on path with file_permissions=777'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: opendir() or File.listFiles() on path IN $ExternalStoragePaths$ called > $FileEnumThreshold$ times within $EnumWindow$ by app NOT IN $FileEnumAllowList$'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': "Dynamic filesystem trace or acquired app-container/filesystem artifacts: opendir('/proc/') with recursive listdir by app NOT IN $ProcessDiscoveryAllowList$ on device with android_version < $HidepidVersion$"}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: open() for read on /proc/cpuinfo'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: App reads files across $MinDirectoryCount$+ distinct parent directories with file_read_count > $FileReadRateThreshold$ within $DataCollectionWindow$ in background or low-interaction state — bulk cross-directory read is the collection signal'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: App reads multiple files from Photos library, Files provider, or iCloud Drive in background or lock-adjacent state exceeding $FileReadRateThreshold$ within $DataCollectionWindow$'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: App loads executable or library from writable external directory (/sdcard/, app cache, /data/local/tmp/) — writable-path library load is exploitable hijack vector'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL+PATH', 'channel': 'Linux Audit SYSCALL+PATH records: PATH records show sequential reads of ICS documentation/configuration files by a UID not in the authorized engineering or backup account set'}
x_mitre_log_sources		{'name': 'WinEventLog:Security', 'channel': 'Windows Security Event ID 4663 (requires Object Access auditing and SACL on monitored paths): repeated ReadData/ListDirectory access across ICS data paths by an unapproved process/account'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'Sequential file reads across multiple Industrial Control Systems (ICS) data paths by image not in authorized ICS applications, exceeding bulk access threshold within a short window'}
x_mitre_log_sources		{'name': 'WinEventLog:Security', 'channel': 'Windows Security Event ID 4663 (requires Object Access auditing/SACL): engineering process reads/opens project file from unapproved repository/removable-media/network-share path'}
x_mitre_log_sources		{'name': 'WinEventLog:Security', 'channel': 'Windows Security Event ID 4663 (requires Object Access auditing/SACL): Siemens engineering process reads/opens project file from unapproved repository/removable-media/network-share path'}

[DC0039] File Creation

Current version: 3.1

Version changed from: 3.0 → 3.1

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.770000+00:00	2026-10-13 17:43:40.408000+00:00
x_mitre_version	3.0	3.1

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'MobileEDR:telemetry', 'channel': 'IPA binary written with signing cert matching user-trusted certificate NOT IN $EnterpriseCertList$ within $ProfileInstallWindow$'}
x_mitre_log_sources		{'name': 'MobileEDR:telemetry', 'channel': 'PackageInstaller.install() with signing_cert NOT IN $EnterpriseCertList$ within $PolicyViolationWindow$ of settings change'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: App writes asymmetric-encrypted blob or encoded ciphertext to local staging path before network transmission — encrypted staging artifact'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: Local file write between inbound retrieval'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': "Dynamic filesystem trace or acquired app-container/filesystem artifacts: open() with O_CREAT on path LIKE '/data/data/%/files/%' for binary or dex content by app_package NOT IN $LegitDynamicLoaders$"}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: open() with O_CREAT on binary-typed path in /data/data// within $StegoExecWindow$ of media file download from same session'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: open() with O_CREAT for file with audio MIME type (audio/mp4, audio/aac, audio/3gpp) in /data/data//files/ within $AudioCaptureWindow$ of recording API start'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: open() with O_CREAT for APK or binary file in /sdcard/ or /data/local/tmp/ by browser process within $DriveByWindow$ — payload drop confirms exploit code execution'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: PackageInstaller.install() with installer_source NOT IN $ApprovedInstallSources$ within $PolicyViolationWindow$ of settings change'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: app binary written to device with signing certificate matching manually-trusted enterprise cert NOT IN $EnterpriseCertAllowList$ within $ProfileInstallWindow$'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: PackageInstaller.install() with signing_cert NOT IN $EnterpriseCertList$ within $PolicyViolationWindow$ of settings change'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: IPA binary written with signing cert matching user-trusted certificate NOT IN $EnterpriseCertList$ within $ProfileInstallWindow$'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: app binary written to device storage as part of install — confirms impersonating app is being persisted'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: PackageInstaller.install() writes binary to device storage for impersonating app — install event is the enrollment of impersonating app'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: open() with O_CREAT for APK file in /sdcard/ or /data/local/tmp/ within $PhishingWindow$ of navigation to flagged URL — APK drop confirms malware delivery phase'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: File with binary signature (.apk, .dex, .so, .sh) written to app storage or /data/local/tmp/ from USB-mounted path or external storage within $USBInstallWindow$'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: Compromised app writes staging, cache, or export artifacts inconsistent with its declared function within $PostInstallWindow$'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: App stages or caches content retrieved from web-service platform locally before initiating secondary network connection'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: App writes high-entropy blob (Shannon entropy > $EntropyThreshold$) to local staging path immediately before outbound transmission — encrypted staging artifact confirms app-layer encryption occurred'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: App writes newly retrieved binary, archive, native library (.so), DEX, or script to /data/data//files/, cache, or shared storage within $IngressWriteWindow$ of network retrieval from non-CDN source'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: Managed app writes newly retrieved container-local file, dylib-like resource, or opaque payload after download from non-CDN source'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: APK, DEX, or native library written to app installation path outside MDM-authorized update mechanism — binary replacement is the persistence artifact'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: App reads files across multiple directories or databases in background state (collection phase) then invokes archive or compression routines on collected content — read-then-archive sequence is the staging chain'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: App writes archive-like container, high-entropy packaged blob, or .zip/.gz output to app-private or cache path after bulk data collection — archive artifact in private storage is the staging evidence'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: App writes large container, temp package, or high-entropy blob to container-local storage after clustered data access — staged archive artifact'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: App writes to or modifies protected configuration files or local control structures of deployed security tools'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=11 of alarm config paths by image not in Human-Machine Interface (HMI) alarm parent allowlist'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL+PATH', 'channel': 'Linux Audit SYSCALL+PATH records: file transfer (scp, sftp, rsync, etc.) placing executable on Industrial Control Systems (ICS) Linux asset, followed by execve of the transferred file within tool transfer window'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=11 with executable/script extension from remote-sourced write operation'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=11 from removable media path to Industrial Control Systems (ICS) engineering working directory'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=11 where an unrecognized process creates a staging/output file after bulk ICS data access activity'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=11 by same process within capture to file window of the Application Programming Interface (API) call'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=11 to alarm threshold config path by image not in Human-Machine Interface (HMI) alarm parent allowlist'}

[DC0067] Logon Session Creation

Current version: 2.1

Version changed from: 2.0 → 2.1

Details

values_changed
STIX Field	Old value	New Value
modified	2025-11-12 22:03:39.105000+00:00	2026-10-13 17:43:46.287000+00:00
x_mitre_version	2.0	2.1

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'device:auth', 'channel': 'SSH/Telnet/console or vendor remote-management session '}
x_mitre_log_sources		{'name': 'idp:session ', 'channel': 'New session established from source/device inconsistent with account baseline '}
x_mitre_log_sources		{'name': 'linux:syslog', 'channel': 'auth.log/secure.log; SSH or console session context '}
x_mitre_log_sources		{'name': 'networkdevice:auth', 'channel': 'SSH/Telnet/console authentication and session creation'}
x_mitre_log_sources		{'name': 'saas:session ', 'channel': 'New authenticated session associated with changed source/client context '}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): sudo/su success for Industrial Control Systems (ICS) service account UID without the expected automated invocation pattern'}
x_mitre_log_sources		{'name': 'syslog:auth', 'channel': 'Secure Shell (SSH) session between Industrial Control Systems (ICS) hosts not in approved lateral movement pairs'}
x_mitre_log_sources		{'name': 'WinEventLog:Security', 'channel': 'Windows Security Event ID 4624/4625: EventCode=4624 by account not in authorized engineer accounts'}
x_mitre_log_sources		{'name': 'wireless:radius', 'channel': 'Extensible Authentication Protocol (EAP) authentication success for device Media Access Control (MAC)/certificate not in approved wireless device inventory'}
x_mitre_log_sources		{'name': 'WinEventLog:Security', 'channel': 'Windows Security Event ID 4624/4625: EventCode=4624 from a device Media Access Control (MAC) address/hardware-ID first observed on the network, not in approved device inventory'}
x_mitre_log_sources		{'name': 'syslog:auth', 'channel': 'sshd Accepted for username matching default vendor credential list from source not in approved admin Classless Inter-Domain Routing (CIDR) subnet'}
x_mitre_log_sources		{'name': 'syslog:auth', 'channel': 'sshd Accepted for username matching default or hardcoded credential patterns from source not in approved admin Classless Inter-Domain Routing (CIDR) subnet'}
x_mitre_log_sources		{'name': 'WinEventLog:Security', 'channel': 'Windows Security Event ID 4624/4625: EventCode=4624 for Industrial Control Systems (ICS)-role account from workstation not in approved host list or outside office hours window'}
x_mitre_log_sources		{'name': 'WinEventLog:Security', 'channel': 'Windows Security Event ID 4624/4625: EventCode=4624 for account matching default vendor credential list from source not in approved host list'}
x_mitre_log_sources		{'name': 'WinEventLog:Security', 'channel': 'Windows Security Event ID 4624/4625: EventCode=4624, Type 2/10 to Industrial Control Systems (ICS) host from source not in approved operator workstations or account not in approved operator list'}
x_mitre_log_sources		{'name': 'WinEventLog:Security', 'channel': 'Windows Security Event ID 4624/4625: EventCode=4624 for Industrial Control Systems (ICS)-role account from Virtual Private Network (VPN)-assigned Internet Protocol (IP) address correlated with remote access authentication anomaly'}
x_mitre_log_sources		{'name': 'WinEventLog:Security', 'channel': 'Windows Security Event ID 4624/4625: EventCode=4624, Type 3/10 between Industrial Control Systems (ICS) hosts not in approved lateral movement pairs'}
x_mitre_log_sources		{'name': 'WinEventLog:Security', 'channel': 'Windows Security Event ID 4624/4625: EventCode=4624 for account matching default or hardcoded credential patterns from source not in approved host list'}

[DC0016] Module Load

Current version: 3.1

Version changed from: 3.0 → 3.1

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.778000+00:00	2026-10-13 17:43:48.544000+00:00
x_mitre_version	3.0	3.1

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=7; scripting-engine module loads when useful '}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=7; System.Management.Automation or unusual PowerShell-related modules'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: DexClassLoader() or dlopen() called with path argument matching file written in preceding $DecryptExecWindow$'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: DexClassLoader() or dlopen() on path written within $StegoExecWindow$ of media download event — download-write-load chain confirms steganographic payload delivery'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: DexClassLoader() called at runtime with path NOT matching any file in original APK manifest within $PackerExecWindow$ of app launch'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': "Dynamic API/runtime trace: DexClassLoader() or System.load() or WebView.loadUrl(javascript:) called with content_source='network_download' within $CodeDownloadWindow$ of download event"}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=init_module/finit_module; kernel module loaded from a path or hash not in the authorized ICS host module baseline'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=7 of Industrial Control Systems (ICS) vendor communication Dynamic Link Library (DLL) with hash not in signed baseline'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=7 where an ICS/vendor DLL is loaded by an image outside the authorized ICS application baseline'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=7 of GDI32.dll/User32.dll by process not in authorized screen capture tools on Human-Machine Interface (HMI)-classified host'}

[DC0082] Network Connection Creation

Current version: 2.2

Version changed from: 2.1 → 2.2

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.770000+00:00	2026-10-13 17:43:42.443000+00:00
x_mitre_version	2.1	2.2

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'linux:osquery', 'channel': 'socket_events to broker/service, where deployed'}
x_mitre_log_sources		{'name': 'linux:osquery', 'channel': 'socket_events to DNS/DoH/DoT destinations, where deployed'}
x_mitre_log_sources		{'name': 'linux:osquery', 'channel': 'socket_events for Python-originated connections, where deployed'}
x_mitre_log_sources		{'name': 'linux:osquery', 'channel': 'socket_events for runtime-originated connections, where deployed '}
x_mitre_log_sources		{'name': 'NetworkDevice:Syslog', 'channel': 'Permitted/denied connection creation where network devices record it'}
x_mitre_log_sources		{'name': 'NSM:Connections', 'channel': 'New device-to-broker relationship outside documented profile'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=3; process-to-broker connection'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=3; connection to DNS/DoH destination with process identity'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=3; Python-originated connection to OT or external destination'}
x_mitre_log_sources		{'name': 'android:EnterpriseNetworkLog', 'channel': 'DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata'}
x_mitre_log_sources		{'name': 'iOS:NetworkExtension', 'channel': 'NEFilterFlow / per-app VPN / secure-web-gateway flow metadata'}
x_mitre_log_sources		{'name': 'NSM:Connections', 'channel': 'device establishes new network connections or activates protocols not seen in pre-reboot baseline'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): bind/listen/connect syscalls show one process accepting ICS-protocol connections while also initiating an outbound connection to a non-ICS destination'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): execve of scripting interpreter with sustained network connect() calls to device subnet at rate exceeding poll baseline, by User Identifier (UID) not in service account allowlist'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): firmware updater connecting to device on firmware port, by User Identifier (UID) not in authorized firmware manager UIDs, outside maintenance window schedule'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): connect() syscall on port (e.g., 80, 443, 8080, etc.) to destination not in approved vendor domains, from Industrial Control Systems (ICS) service process'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): write Application Programming Interface (API) invocation rate to single Input/Output (I/O) point from Industrial Control Systems (ICS) service User Identifier (UID) exceeds max write rate per point'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): connect syscalls show a host outside the approved SCADA/master set opening ICS-protocol connections to multiple field devices'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): connect syscall from an ICS service/application process to a destination outside the approved network or vendor-service baseline'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): socket/connect activity from a process outside the approved ICS monitoring-tool baseline to an ICS multicast destination/group'}
x_mitre_log_sources		{'name': 'NSM:Connections', 'channel': 'device process crash or unexpected restart immediately followed by privileged protocol command succeeding from same source session'}
x_mitre_log_sources		{'name': 'NSM:Connections', 'channel': 'rapid sequential connection attempts to same device Internet Protocol (IP) address across multiple Industrial Control System (ICS) protocol ports from source not in approved Supervisory Control and Data Acquisition (SCADA) servers'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=3 process holds connections to both device subnet and external/inter-zone destination simultaneously, combined with proxy-capable process spawn'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=3 to device subnet within auth-to-device window of the anomalous logon'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=3 network connection to an RDP/VNC service on an ICS Windows host from a source outside the approved management CIDR baseline'}
x_mitre_log_sources		{'name': 'WinEventLog:Security', 'channel': 'EventCode=5157 or firewall rule changes blocking Industrial Control Systems (ICS) command message traffic'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=3 on remote service ports (e.g., 22, 445, 3389, 5985/5986) between hosts not in approved communication matrix'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'Microsoft-Windows-Sysmon/Operational Event ID 3 NetworkConnect: inbound connection rate to Industrial Control Systems (ICS) application port exceeds threshold per minute from unexpected sources'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=3 on port 80/443/8080 from process not matching Industrial Control Systems (ICS) vendor update process allowlist'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=3 same process holding connections to both device subnet and external Internet Protocol (IP) address simultaneously'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=3 from resulting process to destinations not in approved destinations list'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=3 unexpected Windows host opening Industrial Control Systems (ICS) protocol connections to multiple field device Internet Protocol (IP) addresses in polling pattern characteristic of master station'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=3 on Hypertext Transfer Protocol (HTTP)/Hypertext Transfer Protocol Secure (HTTPS)/Domain Name System (DNS) port from process not recognized as Industrial Control Systems (ICS) vendor application'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=3 to device subnet from process not in authorized Industrial Control Systems (ICS) applications'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=3 outbound User Datagram Protocol (UDP) broadcast traffic from process not in recognized Industrial Control Systems (ICS) asset management tools'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=3 outbound connection from a process outside the approved ICS monitoring-tool baseline to an ICS multicast destination'}

[DC0085] Network Traffic Content

Current version: 2.2

Version changed from: 2.1 → 2.2

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.771000+00:00	2026-10-13 17:43:41.384000+00:00
x_mitre_version	2.1	2.2

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'Pub/sub protocol, client ID, topic/queue and message metadata when observable'}
x_mitre_log_sources		{'name': 'NetworkDevice:IDS', 'channel': 'DoH/DoT identification, SNI/HTTP host when observable, DNS tunneling signatures'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'Protocol identification; MQTT CONNECT/SUBSCRIBE/PUBLISH, AMQP/DDS metadata where parsable'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'MQTT/AMQP/DDS protocol and message metadata when visible'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'MQTT/AMQP/DDS protocol identification, broker/topic/client metadata when visible'}
x_mitre_log_sources		{'name': 'NSM:DNS', 'channel': 'Native DNS query/response content: long/encoded labels, TXT use, unusual query structure'}
x_mitre_log_sources		{'name': 'NSM:DNS', 'channel': 'Native DNS query/response content'}
x_mitre_log_sources		{'name': 'NSM:DNS', 'channel': 'DNS query/response metadata and content'}
x_mitre_log_sources		{'name': 'NSM:DNS', 'channel': 'Device DNS query/response content'}
x_mitre_log_sources		{'name': 'NSM:TLS/HTTP', 'channel': 'SNI/HTTP host or resolver endpoint identification when observable'}
x_mitre_log_sources		{'name': 'webproxy:applog', 'channel': 'DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'session on firmware-capable port exceeds session size threshold from source not in engineering workstation list outside change control window'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'firmware write service targeting specific slot/rack address from source not in engineering workstation list outside change control window'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'large session on firmware-capable port from source not in engineering workstation list outside change control window'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'write/control command traffic from source not in approved Supervisory Control and Data Acquisition (SCADA) servers directed at multiple distinct device IPs within rogue master time window'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'task/organization-block modification service from source not in engineering workstation list outside change control window'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'S7comm Download Block / Common Industrial Protocol (CIP) Download Program / Distributed Network Protocol (DNP3) program file transfer to device_ip from source not in engineering workstation list within mode change to download window of mode-change event'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'write to existing program block address from source not in engineering workstation list outside change control window'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'download of block address not previously present in device program inventory, from source not in engineering workstation list'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'decoded ICS protocol unsolicited response or OPC UA data-change message for a device/address not normally owned by the observed source'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'decoded ICS protocol write/setpoint operation to a control/output address from a client identity or source not in the approved control-application baseline'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'OPC UA Browse/BrowseNext request to namespace or system-information objects from a client identity or source not in the approved monitoring baseline'}
x_mitre_log_sources		{'name': 'dns:querylog', 'channel': 'Domain Name System (DNS) query from Industrial Control Systems (ICS) host to domain not in approved vendor domains, particularly domains exhibiting Domain Generation Algorithm (DGA)-like patterns'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'source not in approved Supervisory Control and Data Acquisition (SCADA) servers issuing reads covering sequential address ranges across multiple device Internet Protocol (IP) addresses within auto collection time window'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'malformed Protocol Data Unit (PDU) rate to device_ip exceeds threshold within detection window from source not in approved Supervisory Control and Data Acquisition (SCADA) server list'}
x_mitre_log_sources		{'name': 'zeek:ssl', 'channel': 'Transport Layer Security (TLS) Server Name Indication (SNI) or certificate issuer does not match approved vendor domains or recognized Content Delivery Network (CDN) serving vendor content'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'EtherNet/IP ListIdentity broadcast or sequential Industrial Control System (ICS) protocol connection attempts across Internet Protocol (IP) range from source not in approved Supervisory Control and Data Acqusition (SCADA) servers'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'structurally valid Industrial Control System (ICS) protocol message from source not in approved communication baseline for the destination device_ip'}
x_mitre_log_sources		{'name': 'otids:ProtocolDecoder', 'channel': 'SNMP request/response decoder: OID, operation type, source/destination; flag access to undocumented/vendor-internal OIDs from non-approved NMS sources'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'read-only function codes from source not in approved Supervisory Control and Data Acquisition (SCADA) servers at rate exceeding baseline poll rate or covering address ranges outside known tag ranges'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'Open Platform Communications Unified Architecture (OPC UA) BrowseNamespace or Distributed Network Protocol 3 (DNP3) object 0 all-variation read or Common Industrial Protocol (CIP) Get_Attributes_All from source not in approved Supervisory Control and Data Acquisition (SCADA) servers, covering above namespace coverage threshold percent of device tag space'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'Generic Object Oriented Substation Event (GOOSE) dataset stNum value decreases (replay indicator) or test-mode bit asserted on protection relay without scheduled maintenance'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'mode-change service from source not in engineering workstation list outside change control window'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'write to alarm threshold address range from source not in approved write sources with new value outside safe alarm threshold range'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'write/operate command targeting safety-critical output addresses from source not in approved Supervisory Control and Data Acquisition (SCADA) servers'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'restart/reset service from source not in engineering workstation list outside change control window'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'firmware-update-mode activation service from source not in engineering workstation list outside change control window'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'write function code to same register address at rate exceeding max write rate per point within brute force detection window'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'write function code (FC 6/16) to setpoint address range with value outside baseline value range, or from source not in approved write sources'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'device authentication session from source Media Access Control (MAC)/Internet Protocol (IP) address not enrolled as authorized engineering workstation, with valid credential'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'authentication success using credential matching default vendor credential list from source not in engineering workstation list'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'credential/access code change command from source not in approved security admin list'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'device authentication success using credential pattern matching known hardcoded credential patterns from source not in approved access list'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'authentication success using credential matching default vendor credential list or known hardcoded credential patterns from source not in engineering workstation list'}
x_mitre_log_sources		{'name': 'otids:ProtocolDecoder', 'channel': 'Decoded OT/file-transfer transaction: transfer operation, source/destination, object/file identifier where exposed by the protocol, outside approved engineering/change window'}
x_mitre_log_sources		{'name': 'otids:ProtocolDecoder', 'channel': 'Decoded DNP3/IEC 61850 file-transfer transaction: source/destination and file/object identifier where exposed; correlate with approved engineering source and change window'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'restart/reset service from source not in engineering workstation list, with more than one device receiving the command within bulk restart time window'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'GetIdentity/Identity Object response vendor/product string does not match enrolled asset inventory for device_ip'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'CIP Port Object Get_Attribute_All or topology query from source not in approved Supervisory Control and Data Acquisition (SCADA) servers'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'EtherNet/IP ListIdentity or Modbus broadcast from source Media Access Control (MAC) address not in approved device inventory'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'Internet Group Management Protocol (IGMP) join or Generic Object Oriented Substation Event (GOOSE) multicast subscription from source Media Access Control (MAC) address not in approved device inventory'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'Hypertext Transfer Protocol (HTTP) request to device management web interface with exploit-pattern payload from source not in engineering workstation list'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'protocol-level latency inconsistent with direct communication, or Media Access Control (MAC)/Internet Protocol (IP) address binding change for device_ip'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'transaction identifier reuse pattern or function-code distribution deviates from established per-device baseline within Adversary in the Middle (AiTM) correlation window of the Media Access Control (MAC) address binding change'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'single session reads address range covering above full image coverage threshold percent of device total Input/Output (I/O) space, from source not in approved Supervisory Control and Data Acquisition (SCADA) servers'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'write/control method invocation from client identity not in approved application list'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'malformed or oversized Industrial Control System (ICS) protocol message from unexpected source followed by device behavioral anomaly (reboot, mode change) within a short window'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'malformed or exploit-payload data via built-in communication interface from external source'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'vendor diagnostic function code with payload matching code execution pattern from source not in engineering workstation list'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'anomalous protocol exchange preceding device behavioral change (reboot, altered configuration)'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': "deterministic function code response content diverges from the device's established per-function response baseline without a corresponding firmware update event"}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'bulk read of configuration/data dictionary objects from source with no prior session history with this device'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'event buffer clear or log clear service from source not in engineering workstation list, correlated with preceding suspicious activity on the same device'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'reserved or vendor-specific function code accessing device registers directly from source not in engineering workstation list'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'bulk configuration/program object read from source with no prior configuration-read session history'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'Initialize_Memory or MEMORY_RESET service from source not in engineering workstation list'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'S7comm Upload Block / Common Industrial Protocol (CIP) Read Program session from source not in engineering workstation list with bytes_recv exceeding program upload size threshold'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'S7comm SZL Central Processing Unit (CPU)-state read or Common Industrial Protocol (CIP) Identity Object state attribute read from source not in approved Supervisory Control and Data Acquisition (SCADA) servers'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'SZL module inventory, Identity Object, or Device Attributes query from source not in approved Supervisory Control and Data Acquisition (SCADA) servers'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'S7comm Upload ALL or Common Industrial Protocol (CIP) full program upload from source not in engineering workstation list, bytes_recv exceeding full upload size threshold'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'online block edit service from source not in engineering workstation list outside change control window, with device remaining in RUN mode throughout'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'Virtual Network Computing (VNC) connection or screen-capture Hypertext Transfer Protocol (HTTP) request to embedded Human-Machine Interface (HMI) panel from source not in approved operator workstation list'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'Virtual Network Computing (VNC) or remote console session to embedded Human-Machine Interface (HMI) panel from source not in approved management Classless Inter-Domain Routing (CIDR) subnet'}
x_mitre_log_sources		{'name': 'otids:ProtocolDecoder', 'channel': 'Protocol decoder/IDS transaction: traffic on an ICS service port fails expected protocol parsing/conformance or decodes as a different application protocol'}
x_mitre_log_sources		{'name': 'otids:ProtocolDecoder', 'channel': 'Protocol decoder/IDS transaction/signature: exploit-relevant request against ICS remote service from unexpected source, correlated with subsequent endpoint/device anomaly'}
x_mitre_log_sources		{'name': 'zeek:conn', 'channel': 'exploit-pattern traffic to Industrial Control Systems (ICS) server/device Internet Protocol (IP) from unexpected source, followed by behavioral anomaly within a short window'}

[DC0078] Network Traffic Flow

Current version: 2.2

Version changed from: 2.1 → 2.2

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.777000+00:00	2026-10-13 17:43:50.375000+00:00
x_mitre_version	2.1	2.2

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'NSM:Flow', 'channel': 'Device-to-broker flow metadata'}
x_mitre_log_sources		{'name': 'NetworkProxy:HTTPSFlow', 'channel': 'bytes_out in range $CredentialDumpMin$..$CredentialDumpMax$ to dest NOT IN $AppCDNList$ within $ExfilWindow$ of MDM jailbreak detection — credential dump size range (small but dense) to novel destination indicates Keychain exfiltration'}
x_mitre_log_sources		{'name': 'NSM:Flow', 'channel': 'Source/destination/port/session metadata'}
x_mitre_log_sources		{'name': 'NSM:Flow', 'channel': 'Client/broker flow metadata'}
x_mitre_log_sources		{'name': 'NSM:Flow', 'channel': 'Client/broker connection metadata and periodicity'}
x_mitre_log_sources		{'name': 'NSM:Flow', 'channel': 'Direct external DNS or HTTPS/TLS flow bypassing designated resolver/proxy'}
x_mitre_log_sources		{'name': 'NSM:Flow', 'channel': 'External DNS/HTTPS/TLS flow bypassing approved resolver/proxy'}
x_mitre_log_sources		{'name': 'NSM:Flow', 'channel': 'Client-to-resolver or client-to-DoH endpoint flow'}
x_mitre_log_sources		{'name': 'NSM:Flow', 'channel': 'Device-to-resolver/DoH destination flow'}
x_mitre_log_sources		{'name': 'android:EnterpriseNetworkLog', 'channel': 'DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata'}
x_mitre_log_sources		{'name': 'iOS:NetworkExtension', 'channel': 'NEFilterFlow / per-app VPN / secure-web-gateway flow metadata'}
x_mitre_log_sources		{'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): connection rate to device_ip exceeds Denial of Service (DoS) threshold per minute from single or distributed sources'}
x_mitre_log_sources		{'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): flow volume to Industrial Control Systems (ICS) device subnet exceeds Denial of Service (DoS) flow threshold per minute'}
x_mitre_log_sources		{'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): traffic from newly-authenticated device to Industrial Control System (ICS) application server within onboard window of association'}
x_mitre_log_sources		{'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): source not in approved Supervisory Control and Data Acquisition (SCADA) servers generating high volume of short-duration flows to device subnet at regular intervals'}
x_mitre_log_sources		{'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): Trivial File Transfer Protocol (TFTP) session to device Internet Protocol (IP) address from source not in engineering workstation list followed by device reboot syslog within firmware transfer window'}
x_mitre_log_sources		{'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): egress flow on port 443/80/8080/53 from Industrial Control Systems (ICS) host in no-external-connectivity role list to destination not in approved vendor domains'}
x_mitre_log_sources		{'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): source generates flows to every IP in device subnet in sequential order within discovery time window'}
x_mitre_log_sources		{'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): Internet Control Message Protocol (ICMP) echo requests or Address Resolution Protocol (ARP) broadcasts to all Internet Protocol (IP) addresses in subnet sequentially from single source within discovery time window'}
x_mitre_log_sources		{'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): inbound exploit-pattern traffic to Industrial Control Systems (ICS) Demilitarized Zone (DMZ) server followed by outbound connection from same Internet Protocol (IP) address to internal ICS network'}
x_mitre_log_sources		{'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): connection from newly-observed device to Industrial Control Systems (ICS) application server within new device window of first network appearance'}
x_mitre_log_sources		{'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): sustained high-byte-count flow from Industrial Control Systems (ICS) server Internet Protocol (IP) address to destination outside ICS zone following bulk read activity'}
x_mitre_log_sources		{'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): host maintains simultaneous flows to device subnet and external destination with timing/byte-count correlation indicating relay'}
x_mitre_log_sources		{'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): next-hop change for device subnet traffic or unexpected path through new gateway not in expected next-hop baseline'}
x_mitre_log_sources		{'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): sequential connections from single source to multiple device Internet Protocol (IP) addresses resulting in large response payloads characteristic of directory listing'}
x_mitre_log_sources		{'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): new device Media Access Control (MAC) address on Industrial Control Systems (ICS) network generating ICS master-pattern traffic such as polling multiple device Internet Protocol (IP) addresses on ICS protocol ports'}
x_mitre_log_sources		{'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): firmware-mode activation protocol session from source not in engineering workstation list'}
x_mitre_log_sources		{'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): connection from Virtual Private Network (VPN)-assigned Internet Protocol (IP) address into device subnet within remote access to Industrial Control Systems (ICS) window of the anomalous authentication'}
x_mitre_log_sources		{'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): new east-west connection between Industrial Control Systems (ICS) hosts on remote service ports not in approved communication matrix'}
x_mitre_log_sources		{'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): first-seen connection from a source to an Industrial Control System (ICS) device outside the documented approved communication matrix'}
x_mitre_log_sources		{'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): source generates short-lived flows to single dst across multiple Industrial Control Systems (ICS) protocol ports (502,102,44818,20000,4840) within port scan time window, source not in approved Supervisory Control and Data Acquisition (SCADA) servers'}
x_mitre_log_sources		{'name': 'networkdevice:snmp', 'channel': 'Simple Network Management Protocol (SNMP) GET to system info OID from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet'}
x_mitre_log_sources		{'name': 'networkdevice:snmp', 'channel': 'new Internet Group Management Protocol (IGMP) join or broadcast traffic spike on Industrial Control Systems (ICS) Virtual Local Area Network (VLAN) from source not in approved device inventory'}
x_mitre_log_sources		{'name': 'networkdevice:snmp', 'channel': 'Internet Group Management Protocol (IGMP) membership report for Industrial Control Systems (ICS) multicast group from source not in approved device inventory'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'write function code targeting alarm config address range from source not in approved write sources within suppress grace period of the alarm status change'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'non-standard or malformed packet to device-specific diagnostic port immediately preceding a device-offline alarm'}
x_mitre_log_sources		{'name': 'NSM:Connections', 'channel': 'one Industrial Control System (ICS) traffic type (command or reporting) to/from device_ip ceases while other traffic types continue normally'}
x_mitre_log_sources		{'name': 'NSM:Flow', 'channel': 'reporting message for device_ip originates from src_mac not matching enrolled hardware address for that Internet Protocol (IP)'}
x_mitre_log_sources		{'name': 'NSM:Connections', 'channel': 'command-type traffic to device_ip absent while other traffic types (polling, reporting) to the same device continue normally'}
x_mitre_log_sources		{'name': 'NSM:Connections', 'channel': 'device_ip generates no outbound unsolicited traffic while responding normally to inbound polls'}
x_mitre_log_sources		{'name': 'NSM:Connections', 'channel': 'embedded device_ip initiates outbound connection on port 443/80/8080 to destination outside documented operational profile'}
x_mitre_log_sources		{'name': 'NSM:Connections', 'channel': 'inbound connection to field device Internet Protocol (IP) address from source outside RFC1918/organizational IP space on Industrial Control System (ICS) protocol port'}
x_mitre_log_sources		{'name': 'NSM:Connections', 'channel': 'Connection/session metadata: embedded device opens HTTP/HTTPS/DNS session to destination outside approved ICS communication baseline'}
x_mitre_log_sources		{'name': 'NSM:Connections', 'channel': 'Connection/session metadata: management-port session to field device originates through external remote-access infrastructure rather than approved internal management path'}
x_mitre_log_sources		{'name': 'NSM:Connections', 'channel': 'field device Internet Protocol (IP) initiates connection to another field device IP, not in approved device-to-device communication matrix'}
x_mitre_log_sources		{'name': 'NSM:Connections', 'channel': 'multiple device Internet Protocol (IP) addresses become unreachable simultaneously following network infrastructure config change event'}
x_mitre_log_sources		{'name': 'NSM:Flow', 'channel': 'unsolicited response message source identity does not match the enrolled device for those data points'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'device_ip observed with src_mac differing from enrolled hardware address without corresponding topology change ticket'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'write function code to output register address range from source not in approved write sources'}
x_mitre_log_sources		{'name': 'NSM:Content', 'channel': 'deauthentication flood targeting enrolled Industrial Control Systems (ICS) wireless device Media Access Control (MAC) addresses from source not in approved wireless infrastructure'}
x_mitre_log_sources		{'name': 'perimeter:firewall', 'channel': 'inbound connection to Industrial Control Systems (ICS) device/server Internet Protocol (IP) address on ICS protocol port from source not in organizational IP space'}
x_mitre_log_sources		{'name': 'wireless:spectrum', 'channel': 'Radio Frequency (RF) signal detected on Industrial Control Systems (ICS) wireless frequencies from Media Access Control (MAC) address not in approved wireless device inventory without completed association sequence'}
x_mitre_log_sources		{'name': 'zeek:ssl', 'channel': 'Zeek ssl.log/TLS metadata: server_name (SNI), certificate chain/issuer/subject where available; compare with approved vendor domains/certificates'}

[DC0021] OS API Execution

Current version: 2.2

Version changed from: 2.1 → 2.2

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.775000+00:00	2026-10-13 17:43:47.873000+00:00
x_mitre_version	2.1	2.2

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'MobileEDR:telemetry', 'channel': 'UIDevice.current.model AND CMMotionManager.isDeviceMotionAvailable AND UIScreen.main.scale all read within $EnvCheckWindow$ at cold launch by app NOT IN $SystemEnumAllowList$'}
x_mitre_log_sources		{'name': 'MobileEDR:telemetry', 'channel': 'System.getProperty() AND SensorManager.getSensorList() AND getNetworkInterfaces() all called > $EnvCheckThreshold$ calls within $EnvCheckWindow$ by app NOT IN $SystemEnumAllowList$ where app_state=background'}
x_mitre_log_sources		{'name': 'iOS:unifiedlog', 'channel': 'kernel fault referencing ptrace OR task_for_pid OR get-task-allow outside developer-signed build + MDM integrity_check=fail within KernelFaultWindow where no developer entitlement justifies kernel-level process access'}
x_mitre_log_sources		{'name': 'MobileEDR:telemetry', 'channel': 'PackageInstaller.install() with install_initiator NOT IN ApprovedInstallSources + MDM policy_violation raised within InstallWindow where approved sources do not include this installer origin'}
x_mitre_log_sources		{'name': 'MobileEDR:telemetry', 'channel': 'ptrace with action IN (PTRACE_ATTACH, PTRACE_POKETEXT, PTRACE_POKEDATA, PTRACE_SETREGS) where caller_uid != target_uid + MDM developer_mode=false within PtraceWindow where no debug session justifies memory write to unrelated process'}
x_mitre_log_sources		{'name': 'MobileEDR:telemetry', 'channel': 'process accesses memory region or task port beyond declared entitlement set + MDM integrity_check=fail within same device session where declared entitlements do not justify observed resource access'}
x_mitre_log_sources		{'name': 'MobileEDR:telemetry', 'channel': 'ptrace(PTRACE_ATTACH) from caller_pid where caller is NOT parent of target AND NOT in DebuggerAllowList + MDM usb_debug=false within PtraceWindow where developer context does not justify cross-process attach'}
x_mitre_log_sources		{'name': 'MobileEDR:telemetry', 'channel': 'dylib loaded into process address space with path OR behavioral hash matching KnownJailbreakLibPatterns + MDM compliance=pass within same device session where compliance posture does not justify library presence'}
x_mitre_log_sources		{'name': 'MobileEDR:telemetry', 'channel': 'execve/execveat with effective UID=0 from path NOT IN KnownSystemBinPaths + MDM compliance root_status=false within same device context where compliance state does not justify elevated execution'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes DevicePolicyManager.lockNow(), creates persistent fullscreen overlay (TYPE_APPLICATION_OVERLAY covering full screen), or uses accessibility to block UI interaction — lock or UI-denial API invocation'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Background work scheduler or persistent service triggered the platform retrieval without user interaction'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Background task or networking subsystem event immediately before platform retrieval'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes DevicePolicyManager.resetPassword(), lockNow(), wipeData(), or setCameraDisabled() immediately after Device Admin activation without MDM-initiated policy context or user interaction'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes file management, storage-clear, or wipe operations in background state following network upload without user-initiated delete action'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes custom TLS trust evaluation, OkHttp CertificatePinner, or custom-anchor TrustManager NOT IN $ApprovedPinningApps$ — custom pin validation is the evasion mechanism'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes RSA/ECC keypair generation, public-key import, or asymmetric encryption operations (KeyPairGenerator, Cipher.RSA, ECDH) NOT IN $ApprovedCryptoApps$ before network transmission'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Keypair generation, import, or private-key access events occurring prior to outbound communication not matching app declared secure-communication function'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: MediaProjection capture session, accessibility-based foreground content observation, or privileged screencap/screenrecord invocation from app while different app is foregrounded — cross-app screen content access'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Multiple applications invoking core system APIs (sensor, permission, telephony, PackageManager) show inconsistent, suppressed, or modified return values compared to OS-expected behavior — cross-app API result inconsistency is the runtime hi'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Device integrity degradation (root detected, system partition modification, SafetyNet/Play Integrity failure) coincident with anomalous system API behavior affecting runtime resolution'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes PackageInstaller uninstall or pm uninstall for own package or companion package NOT IN $ProtectedPackageList$ without user-initiated UI flow matching'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Background scheduler or persistent service triggers retrieve-then-write cycle'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Background task activation immediately before retrieve-then-write cycle on supervised device'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Application registers BroadcastReceiver via registerReceiver() or manifest-declared receiver for sensitive system intents (BOOT_COMPLETED, SMS_RECEIVED, ACTION_PACKAGE_REPLACED, CONNECTIVITY_CHANGE, USER_PRESENT) NOT IN $ApprovedReceiverApp'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes PackageManager.setComponentEnabledSetting() to COMPONENT_ENABLED_STATE_DISABLED on its own LAUNCHER activity while continuing active background or foreground-service execution'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Unified Log entry at level=fault in subsystem com.apple.kernel or com.apple.sandbox within $KernelFaultWindow$ of integrity_check failure — kernel-level fault coincident with integrity failure is the exploit-execution signal; requires super'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: ConnectivityManager, TelephonyManager, or WifiManager framework callbacks report repeated failure, disable, or oscillation events outside expected coverage-transition pattern'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: ContentResolver, DocumentProvider, StorageAccessFramework, or bulk stream I/O invocations exceed $FileModificationRateThreshold$ operations per minute across distinct file paths — API-level operation rate distinguishes ransomware from norma'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Known application begins first-seen or expanded use of content providers, account services, accessibility, or network destinations not in $AppBehaviorBaseline$ post-update'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Known app begins first-seen use of protected framework categories (location, microphone, contacts) or background task patterns post-update'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App begins first-seen network connections to destinations matching known-malicious SDK C2 patterns or outside $SDKBaselineEndpoints$ for embedded SDK namespace'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Known app begins first-seen use of protected categories (analytics, location, contacts) matching known-SDK behavior patterns post-update'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Recently updated trusted app invokes special-access paths, account services, or accessibility not present in prior version baseline'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Launch services, extension-handling, or framework subsystem anomalies occur near install or first launch of recently updated trusted app on supervised device'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App uses background work scheduler, JobScheduler, or persistent service to trigger web-service resolver fetch without user interaction'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Background task or networking subsystem event occurs immediately before web-service resolver fetch'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Background work scheduler, foreground service, or persistent service activates'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Background task or persistent networking event activates'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Accessibility-enabled app NOT IN $AccessibilityAllowList$ invokes performAction() click, global action (GLOBAL_ACTION_BACK/HOME/RECENTS), or insertText() on a UI element belonging to a different foregrounded app — cross-app UI action is the'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App intercepts notification content from source_app IN $HighValueNotifApps$ (banking, auth, messaging) while AppState=background'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes cryptographic functions (javax.crypto.Cipher, Android KeyStore, AES/RSA/ECC operations) on data buffer followed by encode-then-transmit sequence NOT matching app declared network function — app-layer crypto on data before transm'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes ContentResolver or SAF (Storage Access Framework) queries across multiple user-data paths outside its own sandbox in background state'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Managed app accesses broad local data scope without user-initiated document picker interaction on supervised device'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes startForegroundService() or startForeground() NOT IN $ApprovedForegroundServiceApps$'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes DownloadManager, URLConnection, or OkHttp download to write retrieved content to app-controlled path outside original APK scope — programmatic download of executable artifact'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Managed app performs post-download processing, dynamic resource handling, or module preparation immediately after retrieval from non-CDN source on supervised device'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App loads native library (.so) or resolves JNI bridge NOT IN $ApprovedNativeLibraries$ immediately before suspicious lower-level activity (sensor access, file write, network connection) — native code loading before anomalous activity is the'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App transitions from managed-code execution into JNI/native function context or attaches native thread,'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App is replaced or reinstalled'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App enqueues WorkManager work, schedules JobScheduler job, or sets AlarmManager with repeating interval NOT IN $ApprovedSchedulerApps$'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Managed app creates NSBackgroundActivityScheduler activity or registers BGTask with repeating=true or deferred interval outside $ApprovedSchedulerApps$ function'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App initializes proxy-capable or raw-socket networking constructs (ServerSocket, SOCKS proxy client, bidirectional relay) NOT IN $ApprovedProxyApps$ — proxy initialization is the technique enabler'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes TelecomManager.answerCall(), placeCall(), endCall(), or ConnectionService call-handling operations without corresponding user-initiated call UI interaction'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App process loads external code module or native library from non-system path injected into zygote or app_process runtime — abnormal library injection path is the hooking mechanism indicator'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes SensorManager.registerListener() for TYPE_ACCELEROMETER or TYPE_GYROSCOPE NOT IN $ApprovedMotionApps$ followed by conditional execution branching correlated with sensor readings — motion sensing followed by behavioral conditiona'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes ZIP, GZIP, or bulk-buffer packaging routines (ZipOutputStream, DeflaterOutputStream, similar) on previously accessed local data in background state'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App applies encryption to newly created archive or staged data blob before network transmission — encrypt-after-archive confirms adversary-controlled packing for exfil'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App performs bulk data transformation or packaging-like processing on collected records prior to outbound transfer on supervised device'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App registers BroadcastReceiver or schedules job for system events (BOOT_COMPLETED, SMS_RECEIVED, ACTION_PACKAGE_REPLACED, CONNECTIVITY_CHANGE, ACTION_USER_PRESENT) NOT IN $ApprovedEventTriggerApps$ — sensitive system event registration is'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App loads library or executes component'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes privileged framework APIs (accessibility performAction, WindowManager.addView TYPE_APPLICATION_OVERLAY, PackageInstaller) immediately after acquiring elevation control mechanism without expected user settings navigation time'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App performs burst of environmental check APIs (Build properties, TelephonyManager IMSI, PackageManager security-tool query) at cold launch before user interaction — multi-category environment fingerprint is the guardrail setup'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App performs UIDevice model + iOS version + enrollment state checks at cold launch before user interaction — device fingerprinting guardrail setup'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes package management, DevicePolicyManager, or settings operations capable of disabling security tooling — API invocation to disable security control'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes accessibility global actions (back, home, recents) or DevicePolicyManager removal-resistance operations when package-management or uninstall UI is in foreground — active uninstall interference'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes package manager operations (disable component, clear data, request uninstall) or settings modifications targeting security tool packages IN $SecurityToolPackageList$'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes file deletion, database truncation, log clearing, or app-data-clear operations within $CleanupWindow$ of prior data access or network exfiltration event — post-exfil cleanup chain'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes file deletion, container-local database truncation, or cache-clear operations on supervised device within $CleanupWindow$ of prior data access or upload event'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Protected resource use, privileged API invocation, or telephony/accessibility/overlay access occurs from system-app context while device is locked or before normal setup completion'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Supplemental baseband, IOKit, accessory, security, or activation-related subsystem anomalies on supervised device at activation — Unified Log supplemental confirmation'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): dlopen() of Industrial Control Systems (ICS) vendor shared library by process not in authorized ICS applications, followed by write-capable network connection to device subnet'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): ioctl or mmap syscall against Industrial Control Systems (ICS) hardware device file from process not in authorized ICS applications'}
x_mitre_log_sources		{'name': 'edr:Syscall', 'channel': 'DeviceIoControl or raw socket creation to Industrial Control Systems (ICS) protocol port from process not in authorized ICS applications, bypassing documented vendor Software Development Kit (SDK) call pattern'}

[DC0032] Process Creation

Current version: 2.2

Version changed from: 2.1 → 2.2

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.773000+00:00	2026-10-13 17:43:45.184000+00:00
x_mitre_version	2.1	2.2

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'execve for python/python3 and script path/arguments'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'execve for node/nodejs or JavaScript runtime and child processes '}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'execve for shell/interpreter and child commands '}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'syscall=execve; command or executable associated with the technique runs outside the approved ICS administrative/application baseline'}
x_mitre_log_sources		{'name': 'WinEventLog:Security', 'channel': 'EventCode=4688; cmd.exe/batch execution with parent and command line '}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1; Python interpreter/script execution and lineage'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1; process lineage and command line'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1; powershell/pwsh or suspicious parent-child chain'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon ', 'channel': 'EventCode=1; wscript.exe/cscript.exe/mshta.exe and child-process lineage '}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Application invokes Runtime.exec(), ProcessBuilder.start(), or JNI-backed launcher with sh, bash, toybox, toolbox, or su as command argument NOT IN $ApprovedShellApps$ — explicit Unix shell invocation'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Managed iOS app invokes process-launch behavior resulting in sh, bash, or equivalent shell child process on supervised device — any shell spawn on stock iOS is a jailbreak indicator'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'execve()'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'com.apple.WebKit or com.apple.WebContent process fault at level=fault within $DriveByWindow$ of navigation to flagged URL — kernel fault in WebKit subsystem is the exploit-execution signal'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'execve() of modified binary (hash != baseline) — execution of modified binary is the persistence activation'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'com.apple.WebContent or com.apple.imagent process shows unexpected child spawn or memory fault at level=fault in Unified Log — kernel fault in message-processing subsystem is exploit execution signal'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'execve() from APK installed within $PhishingWindow$ of navigation to flagged URL — first execution confirms malware activation'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': "sh or cmd process spawned with arguments containing 'pm uninstall' or 'rm' by parent NOT IN $MDMAgentPackageList$ — shell invocation for destruction commands"}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'kernel fault or unexpected child spawn in subsystem IN (com.apple.WebKit, com.apple.imtransferagent, com.apple.imagent) at level=fault in Unified Log'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Application installed with install_source=adb or install_source=sideload from USB-connected host within $USBInstallWindow$ of USB mode change'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'App invokes Runtime.exec(), ProcessBuilder.start(), or JNI-backed command execution framework to spawn shell or command interpreter process NOT IN $ApprovedShellApps$ — programmatic shell spawn is the interpreter invocation'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Managed iOS app invokes lower-level process-launch behavior or command-execution-equivalent activity outside sandbox-permitted APIs on supervised device'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'App execution triggered with unexpected parent context or via indirect invocation (intent redirect, implicit intent resolution to unexpected handler) — indirect invocation path is the flow hijack confirmation'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; command line invokes iptables/nftables to change ICS traffic filtering or redirection outside the authorized network-administration baseline'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; mount/udisksctl invoked to mount a removable block device on an ICS asset outside the approved removable-media workflow'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): execve with path under /media/ or /mnt/ removable mount point within Universial Serial Bus (USB) execution window of mount event'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): execve of network discovery tool (nmap, arp-scan, PLCScan) by User Identifier (UID) not in authorized net admin UIDs'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): unexpected process creation from web server daemon User Identifier (UID) spawning shell process'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): Secure Shell (SSH)-based propagation pattern (connection to multiple hosts followed by file transfer and execution) within a short window'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; systemctl/kill command targets a critical ICS service from a UID not in the authorized service-administration set'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; shell/interpreter process is spawned by an ICS network-facing service or other unexpected parent process'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; network-enumeration utility launched by a UID not in the authorized network-administration set'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; passwd/chpasswd targets an ICS service account outside the approved credential-rotation workflow'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; ICS HMI/GUI application launched from an SSH-associated process/session outside the approved remote-administration baseline'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; browser process spawns a command shell, script interpreter, or executable child inconsistent with the approved browser-child baseline'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; SSH/SNMP/remote-management command includes a remote target host and queries system identity/inventory from an account outside the authorized management set'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; document/viewer process launches a child process outside the expected viewer-child baseline'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; device restart/shutdown command invoked outside the approved change-control window by an unauthorized UID'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; firmware-update utility invoked outside the approved maintenance window or by a UID not in the authorized firmware-management set'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): execve of nmap/masscan with arguments targeting Industrial Control Systems (ICS) protocol port ranges'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; command or executable associated with the technique runs outside the approved ICS administrative/application baseline'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; iptables/nftables command adds a rule that blocks ICS protocol traffic outside the authorized network-administration baseline'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; ip link command disables an interface on an ICS gateway outside the authorized network-administration baseline'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; hostapd/wireless-controller configuration command disables or alters an ICS wireless network outside the authorized wireless-administration baseline'}
x_mitre_log_sources		{'name': 'WinEventLog:System', 'channel': 'System crash or unexpected halt occurring within wiper crash window of the bulk deletion event'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 firmware-update utility spawned by an account outside the authorized firmware-management set or outside the approved maintenance window'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 where a browser process spawns cmd.exe, powershell.exe, wscript.exe, or another executable outside the approved browser-child baseline'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 with parent matching web/application server process and image matching shell/script interpreter within exploit-to-shell window of anomalous request'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 of the newly-created file within tool transfer window of its creation'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 process execution associated with a remote session targets ICS application directories or initiates device-subnet activity'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'Microsoft-Windows-Sysmon/Operational Event ID 1 ProcessCreate: Process execution within the remote session targeting Industrial Control Systems (ICS) application directories or device subnet connections'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 with image path on removable drive letter within Universal Serial Bus (USB) execution window of insertion event'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 of network discovery tool (nmap, PLCScan) from process not in authorized network tools list'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 of archive utility immediately following bulk file access pattern from same parent process tree'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 sc.exe/net.exe invocation targeting a critical ICS service from an account outside the authorized service-administration set'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 network enumeration command from account not in approved network admins, with more than one distinct command within enumeration time window'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 parent matches outlook.exe/winword.exe/excel.exe and image matches cmd.exe/powershell.exe/wscript.exe/mshta.exe on host in Industrial Control Systems (ICS) workstation inventory'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 remote-management command (for example wmic /node, winrs, or PowerShell/CIM with -ComputerName) includes a remote target and queries system identity/inventory outside the authorized management baseline'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 chain originating from user-invoked file open or link click action, spawning processes not in expected document viewer children'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 image matches certutil.exe/regsvr32.exe/mshta.exe/rundll32.exe and command line matches Living-off-the-Land Binary (LOLBin) abuse patterns on host in Industrial Control Systems (ICS) workstation inventory'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 capture utility execution from account not in approved network analysts'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 firmware update tool process activating firmware mode, by account not in authorized firmware managers, outside maintenance window schedule'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 of port scanning utility with arguments targeting Industrial Control Systems (ICS) protocol port ranges'}

[DC0034] Process Metadata

Current version: 2.2

Version changed from: 2.1 → 2.2

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.778000+00:00	2026-10-13 17:43:44.003000+00:00
x_mitre_version	2.1	2.2

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'WinEventLog:PowerShell', 'channel': 'EventCode=400/403; engine lifecycle/context'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: running process names read from /proc//status or /proc//cmdline by app NOT IN $ProcessDiscoveryAllowList$'}
x_mitre_log_sources		{'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: process executing with effective UID=0'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): execve with env containing LD_PRELOAD where exe matches Industrial Control Systems (ICS) service binary list and preload library not in vendor package manifest'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): execve where exe basename matches Industrial Control Systems (ICS) daemon names but path outside vendor install paths'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): execve of wireless configuration utility setting monitor/promiscuous mode outside change management window'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): setuid/setgid to root from a process owned by Industrial Control Systems (ICS) service User Identifier (UID) that was not invoked via sudo'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): execve of wireless configuration utility setting monitor mode on Industrial Control Systems (ICS) Linux asset by User Identifier (UID) not in authorized wireless admin UIDs'}
x_mitre_log_sources		{'name': 'edr:ProcessIntegrity', 'channel': 'Process integrity/hash mismatch detected on Industrial Control Systems (ICS) communication process post-hook-install event'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 where image filename matches Industrial Control Systems (ICS) vendor process names but hash not in vendor hash baseline or current directory outside vendor install paths'}

Patches

[DC0110] Asset Inventory

Current version: 2.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:43:42.721000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'assetinventory:MasterAddress', 'channel': 'command traffic uses master/station address not in registered master addresses'}
x_mitre_log_sources		{'name': 'assetinventory:ProgramHash', 'channel': 'post-transfer program hash does not match last authorized program baseline'}
x_mitre_log_sources		{'name': 'assetinventory:ProgramSize', 'channel': 'device program size/block count increases without corresponding change ticket reference'}

[DC0108] Device Alarm

Current version: 2.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:43:39.111000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'alarmserver:ApplicationLog', 'channel': 'alarm suppression Application Programming Interface (API) call logged without operator session identifier (ID)'}
x_mitre_log_sources		{'name': 'alarmserver:ApplicationLog', 'channel': 'alarm class disabled or suppressed Application Programming Interface (API) event logged without operator_id field populated'}
x_mitre_log_sources		{'name': 'operationaldb:AlarmEvent', 'channel': 'device reboot/restart alarm within firmware update window of the flagged transfer session'}
x_mitre_log_sources		{'name': 'operationaldb:AlarmEvent', 'channel': 'device reboot within firmware update window of the flagged transfer session'}
x_mitre_log_sources		{'name': 'operationaldb:AlarmEvent', 'channel': 'device receives commands from two distinct master identities within a short window'}
x_mitre_log_sources		{'name': 'device:VendorLog', 'channel': 'measured scan cycle time or interrupt response latency deviates from baseline cycle time by more than cycle timing deviation threshold following a task configuration change'}
x_mitre_log_sources		{'name': 'operationaldb:AlarmEvent', 'channel': 'device_ip transitions to PROGRAM/STOP mode without operator_ack and without corresponding open change ticket reference'}
x_mitre_log_sources		{'name': 'device:VendorLog', 'channel': 'measurable change in scan cycle timing or Input/Output (I/O) update pattern following a flagged program write'}
x_mitre_log_sources		{'name': 'operationaldb:AlarmEvent', 'channel': 'device mode-change alarm generated without corresponding operator_id entry within mode change ack window'}
x_mitre_log_sources		{'name': 'operationaldb:AlarmEvent', 'channel': 'alarm threshold configuration changed without operator_ack or change ticket reference'}
x_mitre_log_sources		{'name': 'operationaldb:AlarmEvent', 'channel': 'more than one device generates restart/offline alarm within bulk restart time window without open maintenance ticket'}
x_mitre_log_sources		{'name': 'operationaldb:AlarmEvent', 'channel': 'device_ip alarm telemetry goes silent within alarm silence grace period of the mode-activation message without operator acknowledgment'}
x_mitre_log_sources		{'name': 'operationaldb:AlarmEvent', 'channel': 'device offline alarm coinciding with switch port admin-down syslog for that port'}
x_mitre_log_sources		{'name': 'processsensor:RedundantComparison', 'channel': 'device-reported value for a tag diverges from independently measured value for same physical quantity by more than sensor tolerance threshold'}

[DC0042] Drive Creation

Current version: 2.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-11-12 22:03:39.105000+00:00	2026-10-13 17:43:56.655000+00:00
x_mitre_log_sources[16]['name']	maos:osquery	macos:osquery

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'WinEventLog:System', 'channel': 'EventCode=20001, 2003 not in authorized Universal Serial Bus (USB) allowlist on Industrial Control Systems (ICS) host'}
x_mitre_log_sources		{'name': 'WinEventLog:System', 'channel': 'EventCode=20001 correlated with autorun registry modification within autorun modification window'}

[DC0040] File Deletion

Current version: 3.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.778000+00:00	2026-10-13 17:43:44.580000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: App deletes, truncates, or removes files that were recently written by the same app (collected data, staged exfil artifacts, operation logs) within $PostExfilCleanupWindow$ of network upload event — post-exfil cleanup chain'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: App deletes package files or local state immediately before package inventory disappearance — pre-removal evidence cleanup'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: unlink() or rmdir() on path IN /data/data/ OR /data/user/ OR /sdcard/ by process NOT IN $MDMAgentPackageList$ at rate > $DeletionRateThreshold$ within $DestructionWindow$'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL+PATH', 'channel': 'Linux Audit SYSCALL+PATH records: truncate/shred/rm on Industrial Control Systems (ICS) application log files or auth.log by User Identifier (UID) not in authorized log admin UIDs'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL+PATH', 'channel': 'Linux Audit SYSCALL+PATH records: rm/shred/dd operations across multiple Industrial Control Systems (ICS) data directories exceeding bulk deletion threshold, by User Identifier (UID) not in authorized data management UIDs'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=23 across multiple Industrial Control Systems (ICS) data directories exceeding bulk deletion threshold within data destruction time window, by process not in authorized data management tools'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=23 or wevtutil/Clear-EventLog invocation deleting Industrial Control Systems (ICS) vendor application log file by process not in authorized log management tools'}
x_mitre_log_sources		{'name': 'WinEventLog:System', 'channel': 'EventCode=104 outside scheduled log rotation window'}

[DC0059] File Metadata

Current version: 2.1

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.774000+00:00	2026-10-13 17:43:44.279000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: DEX file entropy > $PackerEntropyThreshold$ at install time for app NOT IN $MDMApprovedCatalog$'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: app_version in MDM == prior_version while dynamic code load from network is observed — confirms this is not a legitimate update'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: binary with file_permissions including setuid bit (mode & 04000) at path NOT IN $KnownSystemBinPaths$ — setuid outside system bin directories is the renamed-root-binary indicator'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: file hash changes for binary at $SystemBinaryPaths$ relative to known-good baseline — hash deviation confirms modification'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: MDM supervised integrity_check=fail following jailbreak detection — integrity check failure on supervised Jamf/Intune enrolled device indicates filesystem modifications beyond passive jailbreak presence'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: installed app package_name Levenshtein distance <= $NameDistanceThreshold$ to entry in $KnownAppCatalog$'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: bundle_id LIKE $KnownSystemNamespace$'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: app package_name distance <= $NameDistanceThreshold$ from $KnownAppCatalog$ entry'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: display_name Levenshtein distance <= $NameDistanceThreshold$ from $KnownIOSAppCatalog$ entry'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL+PATH', 'channel': 'Linux Audit SYSCALL+PATH records: package installation creates files outside the documented package manifest'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL+PATH', 'channel': 'Linux Audit SYSCALL+PATH records: write to Industrial Control Systems (ICS) project file path by uid not in authorized engineering User Identifiers (UIDs) or from path not in approved project sources'}
x_mitre_log_sources		{'name': 'linux:pkgintegrity', 'channel': 'rpm -V/dpkg --verify checksum mismatch for installed Industrial Control Systems (ICS) package binary'}
x_mitre_log_sources		{'name': 'fim:hashcompare', 'channel': 'installed binary hash does not match vendor-published checksum for claimed version'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'Microsoft-Windows-Sysmon/Operational Event ID 11 FileCreate/overwrite or Event ID 2 FileCreateTime, as applicable: Process creation and file creation correlation: vendor installer creates files outside vendor install manifest or spawns undocumented child process'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=11 matching Industrial Control Systems (ICS) vendor binary name in a path outside vendor install paths'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'Microsoft-Windows-Sysmon/Operational Event ID 11 FileCreate/overwrite or Event ID 2 FileCreateTime, as applicable: Engineering tool process opens project file from path not in approved project repository (removable media, email attachment cache, untrusted network share)'}

[DC0061] File Modification

Current version: 3.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.775000+00:00	2026-10-13 17:43:40.092000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: write() to /sdcard/ path'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: ContentResolver.update() or write() to path owned by target_app IN $HighValueAppList$ by writer_app != target_app — cross-app data modification'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: write() to path IN $SystemBinaryPaths$ by process NOT IN $TrustedUpdateSources$'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: app version change detected in MDM inventory for app_package — update is the binary modification event'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: app version change in MDM inventory for bundle_id'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: App inserts, updates, or deletes call log records via CallLog.Calls ContentProvider immediately after call-control action — call log tampering to conceal interception'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL+PATH', 'channel': 'Linux Audit SYSCALL+PATH records: write to Industrial Control Systems (ICS) alarm configuration file by User Identifier (UID) not in authorized alarm admin UIDs'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL+PATH', 'channel': 'Linux Audit SYSCALL+PATH records: write to /etc/ld.so.preload by User Identifier (UID) outside authorized admin list'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL+PATH', 'channel': 'Linux Audit SYSCALL+PATH records: PATH record shows modification of udev/autofs configuration that references an executable or script outside the authorized ICS software inventory'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL+PATH', 'channel': 'Linux Audit SYSCALL+PATH records: modification of bash_history file by uid not normally performing interactive shell sessions'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL+PATH', 'channel': 'Linux Audit SYSCALL+PATH records: write to alarm threshold config file by uid not in authorized alarm admin User Identifiers (UIDs)'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL+PATH', 'channel': 'Linux Audit SYSCALL+PATH records: PATH record shows modification of a serial-device configuration file by a UID not in the authorized serial-administration set'}
x_mitre_log_sources		{'name': 'auditd:SYSCALL+PATH', 'channel': 'Linux Audit SYSCALL+PATH records: write to Siemens project file path by User Identifier (UID) not in authorized Siemens engineering UIDs'}
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'write erase or factory-reset command from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'Siemens engineering tool opens project file from path not in approved project repository'}

[DC0004] Firmware Modification

Current version: 2.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:14:38.020000+00:00	2026-10-13 17:43:40.707000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'assetinventory:FirmwareHash', 'channel': 'post-update firmware hash does not match vendor-published checksum for the claimed version'}
x_mitre_log_sources		{'name': 'assetinventory:FirmwareHash', 'channel': 'reported firmware hash post-reboot not in authorized firmware inventory'}
x_mitre_log_sources		{'name': 'assetinventory:FirmwareHash', 'channel': 'device firmware hash does not match authorized firmware inventory following a reboot event'}
x_mitre_log_sources		{'name': 'assetinventory:FirmwareHash', 'channel': 'device-reported firmware hash/version does not match independently verified value obtained through vendor integrity tool or physical inspection'}
x_mitre_log_sources		{'name': 'assetinventory:FirmwareHash', 'channel': 'module-specific firmware hash post-write does not match authorized module firmware inventory'}
x_mitre_log_sources		{'name': 'assetinventory:FirmwareHash', 'channel': 'post-reboot firmware hash (main processor or specific module) not in authorized firmware inventory'}
x_mitre_log_sources		{'name': 'assetinventory:FirmwareHash', 'channel': 'independently acquired firmware/module hash or vendor integrity measurement differs from approved baseline; protocol-response anomalies are corroboration only'}

[DC0088] Logon Session Metadata

Current version: 2.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-11-12 22:03:39.105000+00:00	2026-10-13 17:43:51.337000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'vpn:authlog', 'channel': 'Industrial Control Systems (ICS)-role account authentication from source geolocation/Autonomous System Number (ASN) not in approved remote access origins or outside expected session pattern'}
x_mitre_log_sources		{'name': 'syslog:auth', 'channel': 'authentication attempt or success from internet-sourced Internet Protocol (IP) address not in organizational IP space'}
x_mitre_log_sources		{'name': 'syslog:auth', 'channel': 'Secure Shell (SSH) session from Virtual Private Network (VPN)-assigned Internet Protocol (IP) address correlated with remote access authentication anomaly'}
x_mitre_log_sources		{'name': 'WinEventLog:Security', 'channel': 'Windows Security Event ID 4624/4625: EventCode=4672 for Industrial Control Systems (ICS)-role account from anomalous session'}
x_mitre_log_sources		{'name': 'WinEventLog:Security', 'channel': 'Windows Security Event ID 4624/4625: EventCode=4672 for Industrial Control Systems (ICS)-role account without corresponding admin-group logon in preceding session'}
x_mitre_log_sources		{'name': 'WinEventLog:Security', 'channel': 'Windows Security Event ID 4624/4625: inbound authentication attempt or successful session from internet-sourced Internet Protocol (IP) address to Industrial Control Systems (ICS) application port'}

[DC0102] Network Share Access

Current version: 2.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-11-12 22:03:39.105000+00:00	2026-10-13 17:43:49.731000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'fileserver:audit', 'channel': 'sequential access to above bulk document access threshold files within information repository time window from single session'}
x_mitre_log_sources		{'name': 'WinEventLog:Security', 'channel': 'Windows Security Event ID 5140/5145: EventCode=5145 for file write to Industrial Control Systems (ICS) host, source not in authorized file sources'}

[DC0107] Process History/Live Data

Current version: 2.1

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.775000+00:00	2026-10-13 17:43:50.698000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'operationaldb:ProcessHistory', 'channel': 'no new process value recorded for device_ip within 1.5x expected poll interval immediately following a flood alert'}
x_mitre_log_sources		{'name': 'operationaldb:ProcessHistory', 'channel': 'process value crosses known alarm threshold but no corresponding alarm event recorded within expected latency window'}
x_mitre_log_sources		{'name': 'operationaldb:ProcessHistory', 'channel': 'multiple safety-critical outputs toggle within rapid toggle window, pattern consistent with scripted issuance'}
x_mitre_log_sources		{'name': 'operationaldb:ProcessHistory', 'channel': 'I/O point value oscillates or changes state at frequency exceeding max normal state change rate, inconsistent with physical process response time'}
x_mitre_log_sources		{'name': 'operationaldb:ProcessHistory', 'channel': 'reported values show statistically improbable stability during a period when physical process is known to be actively changing'}
x_mitre_log_sources		{'name': 'operationaldb:ProcessHistory', 'channel': 'tag value deviates from rolling baseline mean by more than parameter drift threshold percent within time window following a flagged write'}
x_mitre_log_sources		{'name': 'operationaldb:ProcessHistory', 'channel': 'process value expected to change following a command does not change within command confirmation window'}
x_mitre_log_sources		{'name': 'operationaldb:ProcessHistory', 'channel': 'no unsolicited report received from device_ip within 1.5x expected reporting interval, while direct polling confirms device is reachable'}
x_mitre_log_sources		{'name': 'processsensor:RedundantComparison', 'channel': 'Independent process measurement comparison: controller I/O image value diverges from independent sensor/measurement beyond configured integrity tolerance'}

[DC0033] Process Termination

Current version: 2.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-11-12 22:03:39.105000+00:00	2026-10-13 17:43:45.560000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): Industrial Control Systems (ICS) service process terminated (SIGKILL/SIGSEGV) following high-rate inbound connections recorded in netflow within the same window'}

[DC0109] Process/Event Alarm

Current version: 2.1

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.773000+00:00	2026-10-13 17:43:51.984000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'operationaldb:AlarmEvent', 'channel': 'communication-loss alarm for affected devices within comm block correlation window of the flagged configuration change'}
x_mitre_log_sources		{'name': 'operationaldb:AlarmEvent', 'channel': 'alarm status transitions to suppressed/shelved/disabled/acknowledged without matching operator_id entry within suppress grace period'}
x_mitre_log_sources		{'name': 'operationaldb:AlarmEvent', 'channel': 'process state change recorded without preceding operator_ack or scheduled switching order reference'}
x_mitre_log_sources		{'name': 'operationaldb:AlarmEvent', 'channel': 'device_ip communication-loss alarm within serial block correlation window of a flagged serial gateway configuration change'}
x_mitre_log_sources		{'name': 'operationaldb:AlarmEvent', 'channel': 'expected communication absent for device_ip without corresponding device-generated alarm explaining the gap'}

[DC0001] Scheduled Job Creation

Current version: 3.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.778000+00:00	2026-10-13 17:43:53.278000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: Scheduled task execution creates file, accesses sensor, or initiates network connection immediately after firing, with no recent user interaction triggering the task'}
x_mitre_log_sources		{'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: Scheduled task execution produces network, local-write, or sensor artifact while app_state=background or device_locked=true without user trigger'}
x_mitre_log_sources		{'name': 'WinEventLog:Security', 'channel': 'Windows Security Event ID 4698/4702: EventCode=4698 referencing Industrial Control Systems (ICS) vendor binary name from unauthorized process'}

[DC0029] Script Execution

Current version: 2.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-11-12 22:03:39.105000+00:00	2026-10-13 17:43:47.221000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): execve of scripting interpreter making sequential Industrial Control Systems (ICS) protocol reads with output to file, by User Identifier (UID) not in authorized scripting UIDs'}

[DC0060] Service Creation

Current version: 2.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-11-12 22:03:39.105000+00:00	2026-10-13 17:43:53.579000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'WinEventLog:System', 'channel': 'EventCode=7045 where ServiceName/ImagePath references Industrial Control Systems (ICS) vendor application with hash/path mismatch'}
x_mitre_log_sources		{'name': 'WinEventLog:System', 'channel': 'EventCode=7045 enabling Transmission Control Protocol (TCP) port forwarding on Industrial Control Systems (ICS) protocol port not in known ICS services'}

[DC0041] Service Metadata

Current version: 2.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.774000+00:00	2026-10-13 17:43:56.009000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'WinEventLog:System', 'channel': 'EventCode=7034, 7036 for Industrial Control Systems (ICS) service within detection window of connection flood'}
x_mitre_log_sources		{'name': 'WinEventLog:System', 'channel': 'EventCode=7036 critical Industrial Control Systems (ICS) service transitions to Stopped without preceding change ticket reference'}

[DC0111] Software

Current version: 2.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:43:43.366000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'assetinventory:ProgramDiff', 'channel': 'current task-to-block assignment table differs from last known-good baseline without corresponding change ticket'}
x_mitre_log_sources		{'name': 'assetinventory:ProgramHash', 'channel': 'program hash differs from last authorized baseline without corresponding change ticket reference'}

[DC0002] User Account Authentication

Current version: 3.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.777000+00:00	2026-10-13 17:43:46.928000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'saas:audit ', 'channel': 'Successful application-specific/legacy credential authentication where exposed '}
x_mitre_log_sources		{'name': 'azure:signinlogs', 'channel': 'Successful account authentication with authentication/client properties inconsistent with normal MFA-backed access '}
x_mitre_log_sources		{'name': 'idp:authentication ', 'channel': 'Successful authentication associated with legacy/application-specific credential flow '}
x_mitre_log_sources		{'name': 'idp:AuditLog', 'channel': 'App authentication flow instrumentation or IdP sign-in/audit events'}
x_mitre_log_sources		{'name': 'syslog:auth', 'channel': 'sshd Accepted publickey/password for Industrial Control Systems (ICS)-role account from source not in approved admin CIDR'}
x_mitre_log_sources		{'name': 'networkdevice:aaa', 'channel': 'TACACS+/RADIUS authentication success for Industrial Control Systems (ICS) network admin account from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet'}
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'Device authentication/audit log: successful authentication using a vendor-default or prohibited account from a non-approved management source'}
x_mitre_log_sources		{'name': 'networkdevice:syslog', 'channel': 'Device authentication/audit log: successful authentication using a default/hardcoded/prohibited account from a non-approved management source'}
x_mitre_log_sources		{'name': 'WinEventLog:Security', 'channel': 'Windows Security Event ID 4624/4625: EventCode=4648 for Industrial Control Systems (ICS)-role account from process outside approved ICS vendor process list'}
x_mitre_log_sources		{'name': 'WinEventLog:Security', 'channel': 'Windows Security Event ID 4624/4625: EventCode=4723, 4724 for Industrial Control Systems (ICS) service/operator account by account not in authorized credential admins outside credential rotation schedule'}

[DC0063] Windows Registry Key Modification

Current version: 2.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 15:12:00.778000+00:00	2026-10-13 17:43:52.610000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_sources		{'name': 'opc:applog', 'channel': 'Open Platform Communications (OPC) server data change notification or value write from client_id not matching authorized data acquisition service'}
x_mitre_log_sources		{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=13 to Communication (COM) port configuration key by process not in authorized serial port management tools'}

Detection Strategies

[DET0930] Behavioral Detection of Windows Command Shell Execution in ICS

Current version: 1.0

Patches

[DET0802] Detection of Activate Firmware Update Mode

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:34:50.680000+00:00	2026-10-13 17:47:58.355000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--46022e9c-fcb9-4369-b953-ad5724a6819b
x_mitre_analytic_refs		x-mitre-analytic--39fb5809-408b-4f42-a26f-92d372d1a041
x_mitre_analytic_refs		x-mitre-analytic--76f95bb8-16c3-42f7-99a0-929e6f08a24e

[DET0764] Detection of Adversary-in-the-Middle

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:34:50.689000+00:00	2026-10-13 17:46:53.518000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--46604667-aba2-403a-b41b-6e5a9f1494da
x_mitre_analytic_refs		x-mitre-analytic--a24f00d8-2d62-465a-a63c-5604058d195e
x_mitre_analytic_refs		x-mitre-analytic--7b5121f9-506c-40bf-81b2-df1042aa48b7

[DET0728] Detection of Alarm Suppression

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:34:50.669000+00:00	2026-10-13 17:45:54.503000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--a7766ca3-ff83-48fe-b6aa-5a781c64d95b
x_mitre_analytic_refs		x-mitre-analytic--62dee878-27af-4620-b710-10b0ca373701
x_mitre_analytic_refs		x-mitre-analytic--d3adcced-e0c1-4b3c-8a54-f0edd3805df0

[DET0734] Detection of Automated Collection

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:34:50.676000+00:00	2026-10-13 17:47:39.480000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--e25f2fd3-1172-447f-8c03-715689666691
x_mitre_analytic_refs		x-mitre-analytic--7d922eff-22d6-4ac2-90d9-3539e0c998fe

[DET0748] Detection of Autorun Image

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-07-31 20:48:56.122000+00:00	2026-10-13 17:47:42.798000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--a607836b-d6d0-4501-8f05-b43a5dac09c8
x_mitre_analytic_refs		x-mitre-analytic--87efd969-d991-49be-9e41-24f5dbcff9e8

[DET0784] Detection of Block Command Message

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:34:50.673000+00:00	2026-10-13 17:47:30.286000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--b4eeeacf-6d03-4350-ae75-b87e28b697bc
x_mitre_analytic_refs		x-mitre-analytic--a318c729-65ad-424b-a67b-c6b38fb0a708

[DET0910] Detection of Block Communications

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-07-31 20:48:57.028000+00:00	2026-10-13 17:47:36.169000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--2b726f82-bb4f-4889-b6a0-4587f438cd83
x_mitre_analytic_refs		x-mitre-analytic--4ea5942d-fa95-484d-9acb-fe205a3960a3
x_mitre_analytic_refs		x-mitre-analytic--13d41f06-6c14-4b45-8c66-bc0fdd878419

[DET0911] Detection of Block Ethernet

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-07-31 20:48:57.971000+00:00	2026-10-13 17:46:26.784000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--8cf7c363-594f-4efc-a1e8-30435b5f1feb
x_mitre_analytic_refs		x-mitre-analytic--a97db312-a06f-4020-aef2-b28bb8d78c56
x_mitre_analytic_refs		x-mitre-analytic--c17121b6-e945-4799-8a00-77d183501a1e

[DET0903] Detection of Block Operational Technology Message

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-07-31 20:48:55.497000+00:00	2026-10-13 17:47:34.378000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--da7a9116-f290-4160-a24a-930d8961ddf4
x_mitre_analytic_refs		x-mitre-analytic--869e2789-fd07-4bda-8d59-a6fc6c4ee96f

[DET0789] Detection of Block Reporting Message

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:34:50.667000+00:00	2026-10-13 17:47:31.175000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--d2a6ecfe-089b-47cc-8f10-260ad2de9c2e
x_mitre_analytic_refs		x-mitre-analytic--d585c9c1-aa82-4b3c-a42d-eb499d996219
x_mitre_analytic_refs		x-mitre-analytic--d6db8902-24b1-4e69-bc3d-78585c78a5d4

[DET0797] Detection of Block Serial COM

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:34:50.677000+00:00	2026-10-13 17:47:55.820000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--792af2a0-7fc2-4b63-899e-ae09dea3aef1
x_mitre_analytic_refs		x-mitre-analytic--2a89e23c-fb19-456c-bf77-db29bc673301
x_mitre_analytic_refs		x-mitre-analytic--51c17c6d-d4f7-46f6-840e-3697b33d2783

[DET0912] Detection of Block Wi-Fi

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-07-31 20:48:54.649000+00:00	2026-10-13 17:47:12.091000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--7e96cc61-f4ca-4546-8631-3ef6fff8ae28
x_mitre_analytic_refs		x-mitre-analytic--49d68949-cdc8-4364-9700-7786f4d08871
x_mitre_analytic_refs		x-mitre-analytic--74ac7748-3b80-4aac-ad25-c3e6914cb01a

[DET0908] Detection of Broadcast Discovery

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-07-31 20:48:56.771000+00:00	2026-10-13 17:48:01.766000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--b3107fc4-e41d-4e1c-a895-6e6cdc9182ca
x_mitre_analytic_refs		x-mitre-analytic--beefb21a-0c89-4472-8a35-b1ac557018b5
x_mitre_analytic_refs		x-mitre-analytic--99652f40-1f48-4a01-9e09-0585e02ce534

[DET0737] Detection of Brute Force I/O

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:34:50.675000+00:00	2026-10-13 17:46:13.703000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--4be2c353-ef8d-4bb4-b973-4cae602f627f
x_mitre_analytic_refs		x-mitre-analytic--49d64aa5-8804-45c9-99d9-b0729f3dc58c

[DET0771] Detection of Change Credential

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:34:50.674000+00:00	2026-10-13 17:47:28.708000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--3fdeb2a5-e60c-4fac-b003-528676da2f05
x_mitre_analytic_refs		x-mitre-analytic--2862e391-b78a-400f-819e-d44e672e3d3a
x_mitre_analytic_refs		x-mitre-analytic--6c7a03f0-1697-4109-9b8c-70567ed5eaf4

[DET0736] Detection of Commonly Used Port

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:34:50.674000+00:00	2026-10-13 17:47:40.302000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--8aac97f9-602a-440f-b846-7a11e6a157ca
x_mitre_analytic_refs		x-mitre-analytic--5330f4ab-a6f0-411d-957d-bb7bd2a73ddf
x_mitre_analytic_refs		x-mitre-analytic--23d4c3a3-a195-4d5f-a5c5-ae4d23054ee4

[DET0759] Detection of Connection Proxy

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:34:50.684000+00:00	2026-10-13 17:47:45.587000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--073153c5-a2dc-4985-b5f0-b0ee35f5457c
x_mitre_analytic_refs		x-mitre-analytic--4a1b6793-4389-40f7-a7d3-8ad98cba738e
x_mitre_analytic_refs		x-mitre-analytic--4984e65d-1bb6-4de1-8dfc-5672e822bb47

[DET0758] Detection of Data Destruction

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:34:50.697000+00:00	2026-10-13 17:47:05.089000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--7f685d48-0d80-4ba4-8473-432c31b21da8
x_mitre_analytic_refs		x-mitre-analytic--928c559b-3258-4760-a785-ba1270d7ea92
x_mitre_analytic_refs		x-mitre-analytic--aa83b39c-238f-4592-abaa-35e011218f98

[DET0754] Detection of Data from Information Repositories

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:34:50.686000+00:00	2026-10-13 17:47:04.241000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--5cf9cf41-4419-4d04-afcd-991dff638faf
x_mitre_analytic_refs		x-mitre-analytic--4053f72d-59c0-432e-a969-83217c586338

[DET0749] Detection of Data from Local System

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:34:50.674000+00:00	2026-10-13 17:47:01.722000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--346fbf4f-5fc5-4acb-9d2f-cd30c3c22226
x_mitre_analytic_refs		x-mitre-analytic--b41c2b27-08ce-4f3c-a810-484f100422a3
x_mitre_analytic_refs		x-mitre-analytic--2d784f76-a3e0-46ed-8ce2-d9dcd531fa52

[DET0756] Detection of Default Credentials

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:34:50.688000+00:00	2026-10-13 17:47:14.879000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--7d81a83b-ae31-4ceb-b469-bb8a914a751c
x_mitre_analytic_refs		x-mitre-analytic--45c339b2-55b1-4a8b-b21d-c53c3bf2b73a
x_mitre_analytic_refs		x-mitre-analytic--8744740c-e346-4a34-b0db-9c5540e65ed7

[DET0723] Detection of Denial of Service

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:34:50.668000+00:00	2026-10-13 17:47:37.024000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--2c7a6c0b-55f7-44d1-a605-bf2dd1dee01a
x_mitre_analytic_refs		x-mitre-analytic--197be8a2-8569-4304-9fe8-b987c8ed79b1
x_mitre_analytic_refs		x-mitre-analytic--8e055360-9991-43ef-bd20-2b3f40432c78

[DET0801] Detection of Device Restart/Shutdown

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:34:50.671000+00:00	2026-10-13 17:47:20.456000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--5db2235a-aa06-47b7-a89e-953a5afb6555
x_mitre_analytic_refs		x-mitre-analytic--17713d7e-3d88-47b0-b5b0-fd60cd90bf86
x_mitre_analytic_refs		x-mitre-analytic--b15aa5f3-acb3-4de6-831b-3f2a259baf63

[DET0782] Detection of Drive-by Compromise

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:34:50.684000+00:00	2026-10-13 17:44:57.972000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--f571ba94-73ab-4590-ba2c-739a93cde075

[DET0742] Detection of Execution through API

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:34:50.697000+00:00	2026-10-13 17:48:08.206000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--8f09d2c6-0a02-486f-b468-f1e9519c35c7
x_mitre_analytic_refs		x-mitre-analytic--d8aba717-a6a9-4ded-815c-603dd4a44508
x_mitre_analytic_refs		x-mitre-analytic--99cde5ec-8f9f-4585-9195-5ed4509dc9cd

[DET0740] Detection of Exploit Public-Facing Application

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:34:50.687000+00:00	2026-10-13 17:46:50.733000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--8b7ed6ba-ae88-48ab-8aa1-48c15e23db4d
x_mitre_analytic_refs		x-mitre-analytic--02e631a3-5ef0-436d-89bc-923fb32b80f0
x_mitre_analytic_refs		x-mitre-analytic--f91f4654-219f-47a4-aa5a-7c1597f23908

[DET0795] Detection of Exploitation for Evasion

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:34:50.685000+00:00	2026-10-13 17:47:54.905000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--33c51048-bfa2-431a-a1d9-40fb60248de4
x_mitre_analytic_refs		x-mitre-analytic--fe1b5de5-3919-480b-80b6-8914b6b1d098
x_mitre_analytic_refs		x-mitre-analytic--c6a85d88-e62c-4bc2-8210-a8c94705d0f4

[DET0738] Detection of Exploitation for Privilege Escalation

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:34:50.668000+00:00	2026-10-13 17:47:25.144000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--efad38ee-8529-4860-9d22-d5a36626cb2d
x_mitre_analytic_refs		x-mitre-analytic--ee51b3ed-fb50-46dc-b21f-d28a98467941
x_mitre_analytic_refs		x-mitre-analytic--c1ff324d-8321-49f5-95db-db99c888bb2c

[DET0767] Detection of Exploitation of Remote Services

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:34:50.679000+00:00	2026-10-13 17:48:07.349000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--c6552643-bbf2-4686-b050-af6f652fca79
x_mitre_analytic_refs		x-mitre-analytic--b89b2084-97e0-47cc-a9fd-bea4d0423b06
x_mitre_analytic_refs		x-mitre-analytic--f4abf9a4-ce83-41cf-85e2-a823d46ebf10

[DET0803] Detection of External Remote Services

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:34:50.696000+00:00	2026-10-13 17:47:32.751000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--03e474c2-49ff-4126-9a9a-e1f196d4a97b
x_mitre_analytic_refs		x-mitre-analytic--ec4eaf43-4490-4833-a18a-e475ab244970
x_mitre_analytic_refs		x-mitre-analytic--01d1755a-23ba-45d4-9cb9-00a7343d0da5

[DET0772] Detection of Graphical User Interface

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:34:50.683000+00:00	2026-10-13 17:47:11.255000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--a4594062-42a7-448f-99fb-5e4b2c005410
x_mitre_analytic_refs		x-mitre-analytic--d27cebed-41c5-46b8-8c98-a57d6c40805e
x_mitre_analytic_refs		x-mitre-analytic--21e2074e-f7d9-4a41-87e6-d365ac99a972

[DET0722] Detection of Hooking

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:34:50.686000+00:00	2026-10-13 17:48:05.325000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--ad07439d-e13e-438a-9f4b-330d61f2607b
x_mitre_analytic_refs		x-mitre-analytic--05e52883-89d1-43f9-9836-d0dfc2f1d3e3
x_mitre_analytic_refs		x-mitre-analytic--5b7ee346-9061-4e8e-9bec-4d629cf488c5

[DET0750] Detection of Indicator Removal on Host

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:34:50.696000+00:00	2026-10-13 17:47:02.579000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--b26ae113-36e8-4ff4-94bb-bf058788979c
x_mitre_analytic_refs		x-mitre-analytic--6549a8ab-c92c-4249-a5f2-cd9d0458192d
x_mitre_analytic_refs		x-mitre-analytic--482edcb0-46cd-45b6-a373-2e9bbe2ffad2

[DET0905] Detection of Insecure Credentials

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-07-31 20:48:58.228000+00:00	2026-10-13 17:47:17.910000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--b968d9b9-b7f6-423b-b490-6a43ed97389f
x_mitre_analytic_refs		x-mitre-analytic--caa6869b-e752-4fb8-a228-09abaa2d321c
x_mitre_analytic_refs		x-mitre-analytic--74e60460-7618-4a7c-b490-c1e164784564

[DET0796] Detection of Internet Accessible Device

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:34:50.692000+00:00	2026-10-13 17:47:16.202000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--5ac739da-7adb-491a-8ef9-694846572fc1
x_mitre_analytic_refs		x-mitre-analytic--952ff035-fa50-4462-85e1-ee0287b68922
x_mitre_analytic_refs		x-mitre-analytic--518d0e1a-b5e2-4c12-a36c-8d61ad58955e

[DET0745] Detection of Lateral Tool Transfer

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:34:50.679000+00:00	2026-10-13 17:46:45.686000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--af14d56d-c96c-4ab4-8377-a3ecfba26962
x_mitre_analytic_refs		x-mitre-analytic--a0c69c57-549d-4cdd-82eb-0654d8df364e

[DET0725] Detection of Masquerading

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:34:50.667000+00:00	2026-10-13 17:48:06.182000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--b011484e-65d1-408a-b361-67d945e9ca87
x_mitre_analytic_refs		x-mitre-analytic--684fc82e-39d7-48c8-9123-5badd99afaa7
x_mitre_analytic_refs		x-mitre-analytic--856d21f6-edc1-4e7b-84c5-692a467a2dbe

[DET0777] Detection of Modify Alarm Settings

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:34:50.683000+00:00	2026-10-13 17:47:49.663000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--9e2addaf-2773-4bd1-8192-231451038024
x_mitre_analytic_refs		x-mitre-analytic--984bc0c8-77ee-4971-ba17-6a89fc401315
x_mitre_analytic_refs		x-mitre-analytic--bd1cb276-2ab0-4a91-8099-5c8a957e4968

[DET0776] Detection of Modify Parameter

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:34:50.676000+00:00	2026-10-13 17:46:16.865000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--13b48db7-e4d4-47a3-8bd1-60f9c2a039da
x_mitre_analytic_refs		x-mitre-analytic--74cb9e26-6ec1-41e8-9da8-ed30504f9c39

[DET0727] Detection of Monitor Process State

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:34:50.679000+00:00	2026-10-13 17:46:12.884000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--0aa3c64b-e708-4fe2-9764-af61670e1172
x_mitre_analytic_refs		x-mitre-analytic--a0774b4b-493d-4025-bf19-b94280371478
x_mitre_analytic_refs		x-mitre-analytic--c0e95b25-fa40-4794-a262-498aff3b9fd1

[DET0909] Detection of Multicast Discovery

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-07-31 20:48:54.962000+00:00	2026-10-13 17:48:02.875000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--7ddbb1f7-feda-4a50-b944-b02bedf653b5
x_mitre_analytic_refs		x-mitre-analytic--5f4e48bc-ac0a-4a86-8d59-229105b212ca
x_mitre_analytic_refs		x-mitre-analytic--3a8c6bca-bc2c-4a70-9446-8b2adca39441

[DET0753] Detection of Native API

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:34:50.678000+00:00	2026-10-13 17:47:03.413000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--b4b66413-59b9-45bb-93d4-a0a99da9e9a4
x_mitre_analytic_refs		x-mitre-analytic--c41ec8c0-34b0-4573-8643-7366cfbbe4ac
x_mitre_analytic_refs		x-mitre-analytic--66c22dd3-7665-4ead-ab01-5a4742c37d8b

[DET0770] Detection of Network Connection Enumeration

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:34:50.676000+00:00	2026-10-13 17:46:48.197000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--35c7f7bd-a79b-4125-ba0c-2bbf281ebf51
x_mitre_analytic_refs		x-mitre-analytic--8d30e2a3-b7a5-403b-ad5f-243f37f44fa4
x_mitre_analytic_refs		x-mitre-analytic--4effd386-490e-435b-9375-f53a3b44f0d0

[DET0800] Detection of Network Sniffing

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:34:50.698000+00:00	2026-10-13 17:46:07.587000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--9fac6c8a-9320-47d1-aa1d-3bdd4f5856d3
x_mitre_analytic_refs		x-mitre-analytic--795181c0-57b0-4c2f-ac9a-1c6a1c62b813
x_mitre_analytic_refs		x-mitre-analytic--9b1bb08d-5aba-47f4-86d7-a5788c99e1ac

[DET0788] Detection of Point & Tag Identification

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:34:50.678000+00:00	2026-10-13 17:46:18.578000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--8713afc6-95d2-4064-a047-a9be0cc486dd
x_mitre_analytic_refs		x-mitre-analytic--d5cdbfae-d4c3-4379-9330-de223f74fb09
x_mitre_analytic_refs		x-mitre-analytic--ac890be9-5686-42bf-9a1c-ac7fd8bb283a

[DET0907] Detection of Port Scan

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-07-31 20:48:55.220000+00:00	2026-10-13 17:46:42.791000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--b03ff220-3bf8-41bd-a443-0ae287fa8e74
x_mitre_analytic_refs		x-mitre-analytic--ff0f3e46-3817-4b77-a188-74720d721c03
x_mitre_analytic_refs		x-mitre-analytic--bed265af-6f51-42c1-b4d2-691535a32d67

[DET0766] Detection of Project File Infection

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:34:50.668000+00:00	2026-10-13 17:44:16.359000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--aef5883b-f520-4309-aacc-d233b31ec860

[DET0804] Detection of Remote Services

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:34:50.681000+00:00	2026-10-13 17:46:41.956000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--060b84bc-0f25-4643-aa26-f98f32e6a860
x_mitre_analytic_refs		x-mitre-analytic--301b9d5c-6bcd-4539-9ace-6ae4c5d94c43
x_mitre_analytic_refs		x-mitre-analytic--6623745b-ae70-491c-a317-8206b4789463

[DET0739] Detection of Remote System Discovery

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:34:50.696000+00:00	2026-10-13 17:45:35.079000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--61dac9fe-69e8-40df-b573-e1eebff4cfc1
x_mitre_analytic_refs		x-mitre-analytic--695ad38a-7e5b-4d91-bab3-2388d3ae2f0b
x_mitre_analytic_refs		x-mitre-analytic--ca6b9523-4eba-48b2-8584-bed6fb3e6020

[DET0787] Detection of Remote System Information Discovery

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:34:50.679000+00:00	2026-10-13 17:47:07.632000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--35b0fba9-70c7-420b-a9eb-b3caf6b9d87e
x_mitre_analytic_refs		x-mitre-analytic--736619f9-f636-4308-843b-83d38813982b
x_mitre_analytic_refs		x-mitre-analytic--4062a3b7-6859-4b28-b0d3-b0f71dc62f6a

[DET0733] Detection of Replication Through Removable Media

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:34:50.692000+00:00	2026-10-13 17:46:44.772000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--9510e414-3071-4e9c-af51-d07765393e32
x_mitre_analytic_refs		x-mitre-analytic--9a06af00-5f21-43c8-a4a3-24eaa28655c2
x_mitre_analytic_refs		x-mitre-analytic--b048b681-7bce-468e-896b-da76f8b81d49

[DET0792] Detection of Rogue Master

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:34:50.685000+00:00	2026-10-13 17:47:52.970000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--f17cd473-1711-4a92-b8c7-a9890d432032
x_mitre_analytic_refs		x-mitre-analytic--b1e81f19-f241-45ef-bfa5-2aa27d99ee0c
x_mitre_analytic_refs		x-mitre-analytic--16dcc866-c1fc-4616-b985-235197cae399

[DET0780] Detection of Rootkit

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:34:50.667000+00:00	2026-10-13 17:45:50.204000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--a2ab9718-e601-4c5d-94ad-6382df57987c
x_mitre_analytic_refs		x-mitre-analytic--ee5da023-236b-4c86-b228-9280aa402119
x_mitre_analytic_refs		x-mitre-analytic--f45c158a-7086-4172-9fe4-1684e0ca34ee

[DET0751] Detection of Screen Capture

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:34:50.675000+00:00	2026-10-13 17:47:44.722000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--04d594f0-5158-4965-a81d-f757f841bbe1
x_mitre_analytic_refs		x-mitre-analytic--c2027adc-ff27-4bdc-a9bd-2e96b4aacc15

[DET0765] Detection of Service Stop

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:34:50.688000+00:00	2026-10-13 17:46:46.543000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--62ef9334-2cb2-436d-bd50-2ae1213704aa
x_mitre_analytic_refs		x-mitre-analytic--5346fb44-b04e-4820-8b14-eb62ee3a2ca8
x_mitre_analytic_refs		x-mitre-analytic--27e8a172-0682-4d23-a7c2-e2eac526ea9c

[DET0906] Detection of Siemens Project File Format Infection

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-07-31 20:48:54.264000+00:00	2026-10-13 17:44:22.714000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--c5204537-15c5-42ff-baee-f7d029157ca9

[DET0781] Detection of Spearphishing Attachment

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:34:50.689000+00:00	2026-10-13 17:47:50.533000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--fde26204-97d9-4635-82c4-c7e3ed3c9a2c
x_mitre_analytic_refs		x-mitre-analytic--e3b493fc-9771-4e68-b7ec-e91556b22c46

[DET0746] Detection of Spoof Reporting Message

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:34:50.691000+00:00	2026-10-13 17:46:51.861000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--6e73b9c1-482d-44c7-b25b-e9b99764e987
x_mitre_analytic_refs		x-mitre-analytic--dc472b4e-7b39-4bbb-810e-acbf9998a767
x_mitre_analytic_refs		x-mitre-analytic--500aec57-cf41-4572-bdae-f08e185ebeec

[DET0799] Detection of Standard Application Layer Protocol

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:34:50.681000+00:00	2026-10-13 17:47:56.723000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--62facfaa-0d19-4479-8cd7-cfef4c30898c
x_mitre_analytic_refs		x-mitre-analytic--f95ebff8-48ae-409a-adfb-8230d870768b
x_mitre_analytic_refs		x-mitre-analytic--154de82d-e589-4dab-ae2a-42a61dc1443a

[DET0730] Detection of Supply Chain Compromise

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:34:50.678000+00:00	2026-10-13 17:45:55.528000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--c5bd7cb8-0223-4cc6-a390-80178e24e48d
x_mitre_analytic_refs		x-mitre-analytic--9508cebc-ee97-47e6-b603-5fdf88f9f54f
x_mitre_analytic_refs		x-mitre-analytic--c4d5acb4-61c8-4142-bf26-5865d235f02f

[DET0793] Detection of System Binary Proxy Execution

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:34:50.677000+00:00	2026-10-13 17:46:58.830000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--18409dae-85cb-4460-a2a6-f287991f0dca
x_mitre_analytic_refs		x-mitre-analytic--22252671-e8e9-4853-8696-7a38ec7bad53

[DET0731] Detection of System Firmware

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:34:50.668000+00:00	2026-10-13 17:47:19.620000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--1f5ec3e0-2b7d-4b6d-992b-c5849911df1e
x_mitre_analytic_refs		x-mitre-analytic--6829c203-6543-4489-bab8-422a41ac82a1
x_mitre_analytic_refs		x-mitre-analytic--c5274e54-6a55-4aae-b438-aed5c1ef8acd

[DET0744] Detection of Transient Cyber Asset

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:34:50.684000+00:00	2026-10-13 17:47:13.720000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--b1b08627-62b0-4ede-b07d-478be9721f5a

[DET0794] Detection of Unauthorized Command Message

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:34:50.694000+00:00	2026-10-13 17:46:22.529000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--bef23fc2-f276-4dc4-9e09-c3c546c431a1
x_mitre_analytic_refs		x-mitre-analytic--392fc0ea-dcf5-40cd-81ce-df2a9b90f8cc

[DET0902] Detection of Unauthorized Message

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-07-31 20:48:57.712000+00:00	2026-10-13 17:47:59.186000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--18bf81d6-981c-49a2-9259-a08e1f1337b8
x_mitre_analytic_refs		x-mitre-analytic--89b7a519-ee8c-4aac-a9ef-f82d32116d30

[DET0791] Detection of User Execution

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:34:50.696000+00:00	2026-10-13 17:46:36.010000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--cc87a984-9ec1-40c8-bcc3-14e9c51ef9fd
x_mitre_analytic_refs		x-mitre-analytic--88dc7850-3f62-4822-90c0-3a1ed06cc044

[DET0724] Detection of Valid Accounts

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:34:50.698000+00:00	2026-10-13 17:46:32.018000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--d1985f23-da68-4b46-a5ab-9645ab91a25b
x_mitre_analytic_refs		x-mitre-analytic--e2a6f7a5-8316-4367-8e90-9d6560818250
x_mitre_analytic_refs		x-mitre-analytic--175f3f34-38ad-41ad-ae95-927479eacc14

[DET0726] Detection of Wireless Compromise

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:34:50.682000+00:00	2026-10-13 17:47:37.856000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--47aafd6b-75d1-44e9-b2bc-505d9fbb4671
x_mitre_analytic_refs		x-mitre-analytic--92483574-b54e-403d-a08b-f6e07a77f963

[DET0743] Detection of Wireless Sniffing

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:34:50.690000+00:00	2026-10-13 17:47:41.969000+00:00

iterable_item_added
STIX Field	Old value	New Value
x_mitre_analytic_refs		x-mitre-analytic--86989bf4-0dfc-459e-aa67-86c9c02fcdf9
x_mitre_analytic_refs		x-mitre-analytic--866a9b33-9fd4-4f1a-a44e-dd919f31efc1

Analytics

Description:

No target-side behavioral Detection Strategy exists for CAPTCHA based solely on CAPTCHA telemetry.

Minor Version Changes

[AN0339] Analytic 0339

Current version: 1.1

Version changed from: 1.0 → 1.1

	Old Description			New Description
t	1	Deletion or disablement of user accounts in platforms like O	t	1	Deletion or disablement of user accounts in SaaS platforms s
	>	kta, Salesforce, or Zoom with anomalies in admin session att		>	uch as Okta, Salesforce, or Zoom, correlated with anomalous
	>	ributes or mass actions within short duration.		>	administrative session attributes or multiple account-remova
				>	l actions within a short duration.

Details

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-09-23 22:09:20.549000+00:00
description	Deletion or disablement of user accounts in platforms like Okta, Salesforce, or Zoom with anomalies in admin session attributes or mass actions within short duration.	Deletion or disablement of user accounts in SaaS platforms such as Okta, Salesforce, or Zoom, correlated with anomalous administrative session attributes or multiple account-removal actions within a short duration.
x_mitre_log_source_references[0]['channel']	user.lifecycle.delete, user.account.lock	user.lifecycle.deactivate, user.lifecycle.suspend, user.lifecycle.delete.initiated, user.lifecycle.delete.completed
x_mitre_version	1.0	1.1
x_mitre_mutable_elements[0]	{'field': 'BulkActionThreshold', 'description': 'Trigger if multiple deletions occur within a short period'}	{'field': 'BulkActionThreshold', 'description': 'Trigger if multiple account deletion, deactivation, or suspension actions occur within a short period.'}
x_mitre_mutable_elements[1]	{'field': 'SessionDeviceType', 'description': 'Alert on deletions initiated from unfamiliar device contexts'}	{'field': 'SessionDeviceType', 'description': 'Alert when account deletion, deactivation, or suspension is initiated from unfamiliar administrative session contexts.'}

Patches

[AN1952] Analytic 1952

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-09-18 00:31:18.341000+00:00
external_references[2]['description']	ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved October 12, 2021.	ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved September 17, 2026.
external_references[2]['url']	https://threatconnect.com/blog/infrastructure-research-hunting/	https://web.archive.org/web/20221130114004/https://threatconnect.com/blog/infrastructure-research-hunting/

[AN1958] Analytic 1958

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-09-18 00:31:18.342000+00:00
external_references[1]['description']	ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved October 12, 2021.	ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved September 17, 2026.
external_references[1]['url']	https://threatconnect.com/blog/infrastructure-research-hunting/	https://web.archive.org/web/20221130114004/https://threatconnect.com/blog/infrastructure-research-hunting/

[AN1961] Analytic 1961

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-09-18 00:31:18.342000+00:00
external_references[1]['description']	ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved October 12, 2021.	ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved September 17, 2026.
external_references[1]['url']	https://threatconnect.com/blog/infrastructure-research-hunting/	https://web.archive.org/web/20221130114004/https://threatconnect.com/blog/infrastructure-research-hunting/

[AN1970] Analytic 1970

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-09-18 00:31:18.341000+00:00
external_references[3]['description']	ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved October 12, 2021.	ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved September 17, 2026.
external_references[3]['url']	https://threatconnect.com/blog/infrastructure-research-hunting/	https://web.archive.org/web/20221130114004/https://threatconnect.com/blog/infrastructure-research-hunting/

[AN1986] Analytic 1986

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-09-18 00:31:18.341000+00:00
external_references[3]['description']	ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved October 12, 2021.	ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved September 17, 2026.
external_references[3]['url']	https://threatconnect.com/blog/infrastructure-research-hunting/	https://web.archive.org/web/20221130114004/https://threatconnect.com/blog/infrastructure-research-hunting/

[AN1991] Analytic 1991

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-09-18 00:31:18.341000+00:00
external_references[1]['description']	ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved October 12, 2021.	ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved September 17, 2026.
external_references[1]['url']	https://threatconnect.com/blog/infrastructure-research-hunting/	https://web.archive.org/web/20221130114004/https://threatconnect.com/blog/infrastructure-research-hunting/

[AN1996] Analytic 1996

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-09-18 00:31:18.343000+00:00
external_references[1]['description']	ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved October 12, 2021.	ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved September 17, 2026.
external_references[1]['url']	https://threatconnect.com/blog/infrastructure-research-hunting/	https://web.archive.org/web/20221130114004/https://threatconnect.com/blog/infrastructure-research-hunting/

[AN2003] Analytic 2003

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-09-18 00:31:18.342000+00:00
external_references[3]['description']	ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved October 12, 2021.	ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved September 17, 2026.
external_references[3]['url']	https://threatconnect.com/blog/infrastructure-research-hunting/	https://web.archive.org/web/20221130114004/https://threatconnect.com/blog/infrastructure-research-hunting/

[AN2006] Analytic 2006

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-09-18 00:31:18.340000+00:00
external_references[3]['description']	ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved October 12, 2021.	ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved September 17, 2026.
external_references[3]['url']	https://threatconnect.com/blog/infrastructure-research-hunting/	https://web.archive.org/web/20221130114004/https://threatconnect.com/blog/infrastructure-research-hunting/

[AN2014] Analytic 2014

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-09-18 00:31:18.342000+00:00
external_references[1]['description']	ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved October 12, 2021.	ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved September 17, 2026.
external_references[1]['url']	https://threatconnect.com/blog/infrastructure-research-hunting/	https://web.archive.org/web/20221130114004/https://threatconnect.com/blog/infrastructure-research-hunting/

[AN2017] Analytic 2017

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-09-18 00:31:18.341000+00:00
external_references[3]['description']	ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved October 12, 2021.	ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved September 17, 2026.
external_references[3]['url']	https://threatconnect.com/blog/infrastructure-research-hunting/	https://web.archive.org/web/20221130114004/https://threatconnect.com/blog/infrastructure-research-hunting/

[AN2019] Analytic 2019

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-09-18 00:31:18.342000+00:00
external_references[1]['description']	ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved October 12, 2021.	ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved September 17, 2026.
external_references[1]['url']	https://threatconnect.com/blog/infrastructure-research-hunting/	https://web.archive.org/web/20221130114004/https://threatconnect.com/blog/infrastructure-research-hunting/

[AN2020] Analytic 2020

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-09-18 00:31:18.343000+00:00
external_references[1]['description']	ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved October 12, 2021.	ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved September 17, 2026.
external_references[1]['url']	https://threatconnect.com/blog/infrastructure-research-hunting/	https://web.archive.org/web/20221130114004/https://threatconnect.com/blog/infrastructure-research-hunting/

[AN2024] Analytic 2024

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-09-18 00:31:18.341000+00:00
external_references[1]['description']	ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved October 12, 2021.	ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved September 17, 2026.
external_references[1]['url']	https://threatconnect.com/blog/infrastructure-research-hunting/	https://web.archive.org/web/20221130114004/https://threatconnect.com/blog/infrastructure-research-hunting/

[AN2027] Analytic 2027

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-09-18 00:31:18.342000+00:00
external_references[3]['description']	ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved October 12, 2021.	ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved September 17, 2026.
external_references[3]['url']	https://threatconnect.com/blog/infrastructure-research-hunting/	https://web.archive.org/web/20221130114004/https://threatconnect.com/blog/infrastructure-research-hunting/

[AN2028] Analytic 2028

Current version: 1.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-09-18 00:31:18.343000+00:00
external_references[1]['description']	ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved October 12, 2021.	ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved September 17, 2026.
external_references[1]['url']	https://threatconnect.com/blog/infrastructure-research-hunting/	https://web.archive.org/web/20221130114004/https://threatconnect.com/blog/infrastructure-research-hunting/

mobile-attack

Minor Version Changes

[AN1673] Analytic 1673

Current version: 1.1

Version changed from: 1.0 → 1.1

	Old Description			New Description
t	1	Application vetting services could look for applications att	t	1	For Android, detect Evade Analysis Environment primarily dur
	>	empting to get `android.os.SystemProperties` or `getprop` wi		>	ing application vetting or controlled analysis rather than a
	>	th the runtime `exec()` commands. This could indicate some l		>	ssuming a live device SOC feed. Correlate API Calls via Appl
	>	evel of sandbox evasion, as Google recommends against using		>	ication Vetting / Instrumented Dynamic Analysis [Dynamic API
	>	system properties within applications.		>	/runtime trace: APK or IPA contains SystemProperties.get() c
				>	alls, Runtime.exec getprop invocations, or code patterns che
				>	cking for emulator artifacts (ro.product.model=sdk, IMEI=000
				>	000, screen size, sensor absence) — static detection of envi
				>	ronment-check co]. Alert on a sequence or state change incon
				>	sistent with the device/app baseline, approved management po
				>	licy, or expected user workflow; do not infer unobserved API
				>	calls, file/process activity, or payload content from manag
				>	ement state alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'EnvCheckThreshold', 'description': 'Default 5 calls per category within window. Tightening: 3.'}, {'field': 'EnvCheckWindow', 'description': 'Default 10s at cold launch.'}, {'field': 'SystemEnumAllowList', 'description': 'MDM agent, diagnostic apps. Minimal.'}, {'field': 'AppCDNList', 'description': 'Per-app CDN. Derive by measurement.'}, {'field': 'FollowOnWindow', 'description': 'Default 120s.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:40:48.054000+00:00
description	Application vetting services could look for applications attempting to get `android.os.SystemProperties` or `getprop` with the runtime `exec()` commands. This could indicate some level of sandbox evasion, as Google recommends against using system properties within applications.	For Android, detect Evade Analysis Environment primarily during application vetting or controlled analysis rather than assuming a live device SOC feed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: APK or IPA contains SystemProperties.get() calls, Runtime.exec getprop invocations, or code patterns checking for emulator artifacts (ro.product.model=sdk, IMEI=000000, screen size, sensor absence) — static detection of environment-check co]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]['name']	Application Vetting	mobile:DynamicAnalysis
x_mitre_log_source_references[0]['channel']	None	Dynamic API/runtime trace: APK or IPA contains SystemProperties.get() calls, Runtime.exec getprop invocations, or code patterns checking for emulator artifacts (ro.product.model=sdk, IMEI=000000, screen size, sensor absence) — static detection of environment-check co
x_mitre_version	1.0	1.1

[AN1674] Analytic 1674

Current version: 1.1

Version changed from: 1.0 → 1.1

	Old Description			New Description
t	1	Application vetting services could look for applications att	t	1	For iOS, detect Evade Analysis Environment primarily during
	>	empting to get `android.os.SystemProperties` or `getprop` wi		>	application vetting or controlled analysis rather than assum
	>	th the runtime `exec()` commands. This could indicate some l		>	ing a live device SOC feed. Correlate API Calls via Applicat
	>	evel of sandbox evasion, as Google recommends against using		>	ion Vetting / Instrumented Dynamic Analysis [Dynamic API/run
	>	system properties within applications.		>	time trace: IPA contains UIDevice.currentDevice.model checks
				>	for Simulator strings, CMMotionManager.isDeviceMotionAvaila
				>	ble comparisons, or other Simulator-detection patterns — sta
				>	tic detection of iOS environment-check code]. Alert on a seq
				>	uence or state change inconsistent with the device/app basel
				>	ine, approved management policy, or expected user workflow;
				>	do not infer unobserved API calls, file/process activity, or
				>	payload content from management state alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'EnvCheckWindow', 'description': 'Default 5s at cold launch.'}, {'field': 'SystemEnumAllowList', 'description': 'MDM agent, approved analytics SDK. Minimal.'}, {'field': 'AppCDNList', 'description': 'Per-app CDN. Derive by measurement.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:40:48.618000+00:00
description	Application vetting services could look for applications attempting to get `android.os.SystemProperties` or `getprop` with the runtime `exec()` commands. This could indicate some level of sandbox evasion, as Google recommends against using system properties within applications.	For iOS, detect Evade Analysis Environment primarily during application vetting or controlled analysis rather than assuming a live device SOC feed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: IPA contains UIDevice.currentDevice.model checks for Simulator strings, CMMotionManager.isDeviceMotionAvailable comparisons, or other Simulator-detection patterns — static detection of iOS environment-check code]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]['name']	Application Vetting	mobile:DynamicAnalysis
x_mitre_log_source_references[0]['channel']	None	Dynamic API/runtime trace: IPA contains UIDevice.currentDevice.model checks for Simulator strings, CMMotionManager.isDeviceMotionAvailable comparisons, or other Simulator-detection patterns — static detection of iOS environment-check code
x_mitre_version	1.0	1.1

[AN1679] Analytic 1679

Current version: 1.1

Version changed from: 1.0 → 1.1

	Old Description			New Description
t	1	On Android, the user can use the device settings menu to vie	t	1	For Android, detect Code Signing Policy Modification by corr
	>	w trusted CA certificates and look for unexpected or unknown		>	elating analyst-visible device/network evidence and manageme
	>	certificates. A mobile security product could similarly exa		>	nt state; use streaming or batched telemetry only where the
	>	mine the trusted CA certificate store for anomalies. Users c		>	documented collector is deployed. Correlate Application Perm
	>	an use the device settings menu to view which applications o		>	ission via Android Enterprise DPC / Application Vetting [Dev
	>	n the device are allowed to install unknown applications.		>	icePolicyManager.getPermissionGrantState(); PackageManager m
	>	On iOS, the user can use the device settings menu to view in		>	anifest/requested-permission review]; File Creation via Appl
	>	stalled Configuration Profiles and look for unexpected or un		>	ication Vetting / Forensic Acquisition [Dynamic filesystem t
	>	known profiles. A Mobile Device Management (MDM) system coul		>	race or acquired app-container/filesystem artifacts: Package
	>	d use the iOS MDM APIs to examine the list of installed Conf		>	Installer.install() with signing_cert NOT IN $EnterpriseCert
	>	iguration Profiles for anomalies.		>	List$ within $PolicyViolationWindow$ of settings change]; Sy
				>	stem Settings via Android Enterprise DPC [DevicePolicyManage
				>	r policy/compliance/security-state queries and SecurityLog e
				>	vents where supported]. Alert on a sequence or state change
				>	inconsistent with the device/app baseline, approved manageme
				>	nt policy, or expected user workflow; do not infer unobserve
				>	d API calls, file/process activity, or payload content from
				>	management state alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'MDMAgentPackageList', 'description': 'MDM agent, OTA service.'}, {'field': 'SettingsChangeWindow', 'description': 'Default 30s between settings write and MDM detection.'}, {'field': 'EnterpriseCertList', 'description': 'Approved enterprise signing cert fingerprints. Derive from certificate management.'}, {'field': 'PolicyViolationWindow', 'description': 'Default 1800s.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:41:39.353000+00:00
description	On Android, the user can use the device settings menu to view trusted CA certificates and look for unexpected or unknown certificates. A mobile security product could similarly examine the trusted CA certificate store for anomalies. Users can use the device settings menu to view which applications on the device are allowed to install unknown applications. On iOS, the user can use the device settings menu to view installed Configuration Profiles and look for unexpected or unknown profiles. A Mobile Device Management (MDM) system could use the iOS MDM APIs to examine the list of installed Configuration Profiles for anomalies.	For Android, detect Code Signing Policy Modification by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; File Creation via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: PackageInstaller.install() with signing_cert NOT IN $EnterpriseCertList$ within $PolicyViolationWindow$ of settings change]; System Settings via Android Enterprise DPC [DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_version	1.0	1.1
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--56c2b384-77f8-461f-a71a-76f7888ebfb6', 'name': 'User Interface', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: PackageInstaller.install() with signing_cert NOT IN $EnterpriseCertList$ within $PolicyViolationWindow$ of settings change'}
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--56c2b384-77f8-461f-a71a-76f7888ebfb6', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported'}

[AN1680] Analytic 1680

Current version: 1.1

Version changed from: 1.0 → 1.1

	Old Description			New Description
t	1	On Android, the user can use the device settings menu to vie	t	1	For iOS, detect Code Signing Policy Modification from docume
	>	w trusted CA certificates and look for unexpected or unknown		>	nted management, network, or vetting evidence; treat state q
	>	certificates. A mobile security product could similarly exa		>	ueries as periodic observations rather than real-time events
	>	mine the trusted CA certificate store for anomalies. Users c		>	. Correlate Application Permission via Application Vetting [
	>	an use the device settings menu to view which applications o		>	Code-signing entitlements and Info.plist privacy usage-descr
	>	n the device are allowed to install unknown applications.		>	iption keys]; File Creation via Application Vetting / Forens
	>	On iOS, the user can use the device settings menu to view in		>	ic Acquisition [Dynamic filesystem trace or acquired app-con
	>	stalled Configuration Profiles and look for unexpected or un		>	tainer/filesystem artifacts: IPA binary written with signing
	>	known profiles. A Mobile Device Management (MDM) system coul		>	cert matching user-trusted certificate NOT IN $EnterpriseCe
	>	d use the iOS MDM APIs to examine the list of installed Conf		>	rtList$ within $ProfileInstallWindow$]; Protected Configurat
	>	iguration Profiles for anomalies.		>	ion via Apple MDM [DeviceInformation / SecurityInfo / Profil
				>	eList / restrictions and compliance queries]. Alert on a seq
				>	uence or state change inconsistent with the device/app basel
				>	ine, approved management policy, or expected user workflow;
				>	do not infer unobserved API calls, file/process activity, or
				>	payload content from management state alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'EnterpriseCertList', 'description': 'Approved enterprise cert fingerprints. Derive from certificate management.'}, {'field': 'ProfileInstallWindow', 'description': 'Default 3600s.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:41:39.969000+00:00
description	On Android, the user can use the device settings menu to view trusted CA certificates and look for unexpected or unknown certificates. A mobile security product could similarly examine the trusted CA certificate store for anomalies. Users can use the device settings menu to view which applications on the device are allowed to install unknown applications. On iOS, the user can use the device settings menu to view installed Configuration Profiles and look for unexpected or unknown profiles. A Mobile Device Management (MDM) system could use the iOS MDM APIs to examine the list of installed Configuration Profiles for anomalies.	For iOS, detect Code Signing Policy Modification from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Application Permission via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]; File Creation via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: IPA binary written with signing cert matching user-trusted certificate NOT IN $EnterpriseCertList$ within $ProfileInstallWindow$]; Protected Configuration via Apple MDM [DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_version	1.0	1.1
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--56c2b384-77f8-461f-a71a-76f7888ebfb6', 'name': 'User Interface', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'mobile:ApplicationVetting', 'channel': 'Code-signing entitlements and Info.plist privacy usage-description keys'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: IPA binary written with signing cert matching user-trusted certificate NOT IN $EnterpriseCertList$ within $ProfileInstallWindow$'}
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--6c62144a-cd5c-401c-ada9-58c4c74cd9d2', 'name': 'iOS:MDM', 'channel': 'DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries'}

[AN1685] Analytic 1685

Current version: 1.1

Version changed from: 1.0 → 1.1

+For Android, detect Ptrace System Calls by correlating analy
->
+st-visible device/network evidence and management state; use
+ streaming or batched telemetry only where the documented co
+llector is deployed. Correlate Host Status via Android Enter
+prise DPC [DevicePolicyManager policy/compliance/security-st
+ate queries and SecurityLog events where supported]; Network
+ Traffic Flow via Android Enterprise Network Logging / Enter
+prise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEve
+nt / ConnectEvent; VPN flow metadata]; Process Access via Ap
+plication Vetting / Instrumented Dynamic Analysis [Dynamic A
+PI/runtime trace: process in $TargetProcessList$ shows unexp
+ected behavior change (new network destinations, new permiss
+ion accesses) within $InjectionWindow$ of root status change
+ — behavioral delta in target process post-injection is the
+anomaly indicator]. Alert on a sequence or state change inco
+nsistent with the device/app baseline, approved management p
+olicy, or expected user workflow; do not infer unobserved AP
+I calls, file/process activity, or payload content from mana
+gement state alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'TargetProcessList', 'description': 'High-value processes that would be injection targets: media server, browser, system apps.'}, {'field': 'InjectionWindow', 'description': 'Default 600s after MDM root detection.'}, {'field': 'AppBaselineDomains', 'description': 'Per-device network destination baseline. Derive by measurement.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:41:36.882000+00:00
description	Application vetting services could look for misuse of dynamic libraries.	For Android, detect Ptrace System Calls by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Host Status via Android Enterprise DPC [DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported]; Network Traffic Flow via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]; Process Access via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: process in $TargetProcessList$ shows unexpected behavior change (new network destinations, new permission accesses) within $InjectionWindow$ of root status change — behavioral delta in target process post-injection is the anomaly indicator]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_version	1.0	1.1
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'Application Vetting', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--85a533a4-5fa4-4dba-b45d-f0717bedd6e6', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'android:EnterpriseNetworkLog', 'channel': 'DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata'}
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--1887a270-576a-4049-84de-ef746b2572d6', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: process in $TargetProcessList$ shows unexpected behavior change (new network destinations, new permission accesses) within $InjectionWindow$ of root status change — behavioral delta in target process post-injection is the anomaly indicator'}

[AN1686] Analytic 1686

Current version: 1.1

Version changed from: 1.0 → 1.1

+For iOS, detect Ptrace System Calls by correlating analyst-v
->
+isible device/network evidence and management state; use str
+eaming or batched telemetry only where the documented collec
+tor is deployed. Correlate Host Status via Apple MDM [Device
+Information / SecurityInfo / ProfileList / restrictions and
+compliance queries]; Network Traffic Flow via Apple Network
+Extension / Enterprise VPN [NEFilterFlow / per-app VPN / sec
+ure-web-gateway flow metadata]; Process Access via Applicati
+on Vetting / Instrumented Dynamic Analysis [Dynamic API/runt
+ime trace: kernel log at level=fault referencing task_for_pi
+d, mach_vm_write, or get-task-allow outside developer build
+on SUPERVISED device — Apple Unified Log kernel subsystem re
+cords these violations at fault level; supervised MDM with U
+nified Log ]. Alert on a sequence or state change inconsiste
+nt with the device/app baseline, approved management policy,
+ or expected user workflow; do not infer unobserved API call
+s, file/process activity, or payload content from management
+ state alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'AppBaselineDomains', 'description': 'Per-device CDN baseline.'}, {'field': 'PostExploitWindow', 'description': 'Default 60s between kernel fault and C2 connection.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:41:37.495000+00:00
description	Application vetting services could look for misuse of dynamic libraries.	For iOS, detect Ptrace System Calls by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Host Status via Apple MDM [DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries]; Network Traffic Flow via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]; Process Access via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: kernel log at level=fault referencing task_for_pid, mach_vm_write, or get-task-allow outside developer build on SUPERVISED device — Apple Unified Log kernel subsystem records these violations at fault level; supervised MDM with Unified Log ]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_version	1.0	1.1
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'Application Vetting', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--85a533a4-5fa4-4dba-b45d-f0717bedd6e6', 'name': 'iOS:MDM', 'channel': 'DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'iOS:NetworkExtension', 'channel': 'NEFilterFlow / per-app VPN / secure-web-gateway flow metadata'}
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--1887a270-576a-4049-84de-ef746b2572d6', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: kernel log at level=fault referencing task_for_pid, mach_vm_write, or get-task-allow outside developer build on SUPERVISED device — Apple Unified Log kernel subsystem records these violations at fault level; supervised MDM with Unified Log'}

[AN1703] Analytic 1703

Current version: 1.1

Version changed from: 1.0 → 1.1

+For Android, detect Process Injection by correlating analyst
->
+-visible device/network evidence and management state; use s
+treaming or batched telemetry only where the documented coll
+ector is deployed. Correlate Host Status via Android Enterpr
+ise DPC [DevicePolicyManager policy/compliance/security-stat
+e queries and SecurityLog events where supported]; Network T
+raffic Flow via Android Enterprise Network Logging / Enterpr
+ise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent
+ / ConnectEvent; VPN flow metadata]; Process Access via Appl
+ication Vetting / Instrumented Dynamic Analysis [Dynamic API
+/runtime trace: accessibility_service or notification_listen
+er appears attributed to a bundle IN $LegitimateSystemProces
+ses$ within $InjectionWindow$ of root detection — injected c
+ode requesting special permissions under a legitimate system
+ process identit]. Alert on a sequence or state change incon
+sistent with the device/app baseline, approved management po
+licy, or expected user workflow; do not infer unobserved API
+ calls, file/process activity, or payload content from manag
+ement state alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'LegitimateSystemProcesses', 'description': 'com.android.systemui, android.process.media, com.android.phone — high-value injection targets.'}, {'field': 'InjectionWindow', 'description': 'Default 600s after root detection.'}, {'field': 'ProcessBaselineDomains', 'description': 'Per-process network destination baseline for system processes.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:41:35.635000+00:00
description	Application vetting services could look for misuse of dynamic libraries.	For Android, detect Process Injection by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Host Status via Android Enterprise DPC [DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported]; Network Traffic Flow via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]; Process Access via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: accessibility_service or notification_listener appears attributed to a bundle IN $LegitimateSystemProcesses$ within $InjectionWindow$ of root detection — injected code requesting special permissions under a legitimate system process identit]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_version	1.0	1.1
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'Application Vetting', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--85a533a4-5fa4-4dba-b45d-f0717bedd6e6', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'android:EnterpriseNetworkLog', 'channel': 'DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata'}
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--1887a270-576a-4049-84de-ef746b2572d6', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: accessibility_service or notification_listener appears attributed to a bundle IN $LegitimateSystemProcesses$ within $InjectionWindow$ of root detection — injected code requesting special permissions under a legitimate system process identit'}

[AN1704] Analytic 1704

Current version: 1.1

Version changed from: 1.0 → 1.1

+For iOS, detect Process Injection by correlating analyst-vis
->
+ible device/network evidence and management state; use strea
+ming or batched telemetry only where the documented collecto
+r is deployed. Correlate Host Status via Apple MDM [DeviceIn
+formation / SecurityInfo / ProfileList / restrictions and co
+mpliance queries]; Network Traffic Flow via Apple Network Ex
+tension / Enterprise VPN [NEFilterFlow / per-app VPN / secur
+e-web-gateway flow metadata]; Process Access via Application
+ Vetting / Instrumented Dynamic Analysis [Dynamic API/runtim
+e trace: kernel log entry at level=fault referencing task_fo
+r_pid or get-task-allow violation on SUPERVISED device with
+Unified Log forwarding — kernel records entitlement violatio
+ns at fault level; requires supervised MDM with Unified Log
+export]. Alert on a sequence or state change inconsistent wi
+th the device/app baseline, approved management policy, or e
+xpected user workflow; do not infer unobserved API calls, fi
+le/process activity, or payload content from management stat
+e alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'AppBaselineDomains', 'description': 'Per-device CDN baseline. Derive by 30-day measurement.'}, {'field': 'IntegrityCheckWindow', 'description': 'Default 900s — MDM check-in interval.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:41:36.262000+00:00
description	Application vetting services could look for misuse of dynamic libraries.	For iOS, detect Process Injection by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Host Status via Apple MDM [DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries]; Network Traffic Flow via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]; Process Access via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: kernel log entry at level=fault referencing task_for_pid or get-task-allow violation on SUPERVISED device with Unified Log forwarding — kernel records entitlement violations at fault level; requires supervised MDM with Unified Log export]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_version	1.0	1.1
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'Application Vetting', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--85a533a4-5fa4-4dba-b45d-f0717bedd6e6', 'name': 'iOS:MDM', 'channel': 'DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'iOS:NetworkExtension', 'channel': 'NEFilterFlow / per-app VPN / secure-web-gateway flow metadata'}
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--1887a270-576a-4049-84de-ef746b2572d6', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: kernel log entry at level=fault referencing task_for_pid or get-task-allow violation on SUPERVISED device with Unified Log forwarding — kernel records entitlement violations at fault level; requires supervised MDM with Unified Log export'}

[AN1705] Analytic 1705

Current version: 1.1

Version changed from: 1.0 → 1.1

	Old Description			New Description
t	1	Application vetting services may be able to detect known pri	t	1	For iOS, detect Credentials from Password Store by correlati
	>	vilege escalation exploits contained within applications, as		>	ng analyst-visible device/network evidence and management st
	>	well as searching application packages for strings that cor		>	ate; use streaming or batched telemetry only where the docum
	>	relate to known password store locations. Mobile security pr		>	ented collector is deployed. Correlate Application State via
	>	oducts can potentially detect jailbroken devices.		>	Apple MDM [InstalledApplicationList / ManagedApplicationLis
				>	t]; Host Status via Apple MDM [DeviceInformation / SecurityI
				>	nfo / ProfileList / restrictions and compliance queries]; Ne
				>	twork Traffic Flow via Apple Network Extension / Enterprise
				>	VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow me
				>	tadata]. Alert on a sequence or state change inconsistent wi
				>	th the device/app baseline, approved management policy, or e
				>	xpected user workflow; do not infer unobserved API calls, fi
				>	le/process activity, or payload content from management stat
				>	e alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'CredentialStoreAppList', 'description': 'Banking, enterprise SSO, password manager, email app bundle IDs.'}, {'field': 'CredentialStoreAppCount', 'description': 'Default 2 — single app might not justify targeted Keychain dump.'}, {'field': 'CredentialDumpMin', 'description': 'Default 10KB.'}, {'field': 'CredentialDumpMax', 'description': 'Default 500KB — cap to exclude media exfil.'}, {'field': 'AppCDNList', 'description': 'Per-device CDN baseline.'}, {'field': 'ExfilWindow', 'description': 'Default 300s.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:41:41.799000+00:00
description	Application vetting services may be able to detect known privilege escalation exploits contained within applications, as well as searching application packages for strings that correlate to known password store locations. Mobile security products can potentially detect jailbroken devices.	For iOS, detect Credentials from Password Store by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application State via Apple MDM [InstalledApplicationList / ManagedApplicationList]; Host Status via Apple MDM [DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries]; Network Traffic Flow via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_version	1.0	1.1
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'Application Vetting', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'iOS:MDM', 'channel': 'InstalledApplicationList / ManagedApplicationList'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--85a533a4-5fa4-4dba-b45d-f0717bedd6e6', 'name': 'Sensor Health', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--85a533a4-5fa4-4dba-b45d-f0717bedd6e6', 'name': 'iOS:MDM', 'channel': 'DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'iOS:NetworkExtension', 'channel': 'NEFilterFlow / per-app VPN / secure-web-gateway flow metadata'}

[AN1745] Analytic 1745

Current version: 1.1

Version changed from: 1.0 → 1.1

	Old Description			New Description
t	1	On Android, the user can use the device settings menu to vie	t	1	For Android, detect Subvert Trust Controls by correlating an
	>	w trusted CA certificates and look for unexpected or unknown		>	alyst-visible device/network evidence and management state;
	>	certificates. A mobile security product could similarly exa		>	use streaming or batched telemetry only where the documented
	>	mine the trusted CA certificate store for anomalies. Users c		>	collector is deployed. Correlate Application Permission via
	>	an use the device settings menu to view which applications o		>	Android Enterprise DPC / Application Vetting [DevicePolicyM
	>	n the device are allowed to install unknown applications. O		>	anager.getPermissionGrantState(); PackageManager manifest/re
	>	n iOS, the user can use the device settings menu to view ins		>	quested-permission review]; File Creation via Application Ve
	>	talled Configuration Profiles and look for unexpected or unk		>	tting / Forensic Acquisition [Dynamic filesystem trace or ac
	>	nown profiles. A Mobile Device Management (MDM) system could		>	quired app-container/filesystem artifacts: PackageInstaller.
	>	use the iOS MDM APIs to examine the list of installed Confi		>	install() with installer_source NOT IN $ApprovedInstallSourc
	>	guration Profiles for anomalies.		>	es$ within $PolicyViolationWindow$ of settings change]; Syst
				>	em Settings via Android Enterprise DPC [DevicePolicyManager
				>	policy/compliance/security-state queries and SecurityLog eve
				>	nts where supported]. Alert on a sequence or state change in
				>	consistent with the device/app baseline, approved management
				>	policy, or expected user workflow; do not infer unobserved
				>	API calls, file/process activity, or payload content from ma
				>	nagement state alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'MDMAgentPackageList', 'description': 'MDM agent, OTA update service. Derive from MDM platform documentation.'}, {'field': 'ApprovedInstallSources', 'description': 'com.android.vending + MDM agent package. Minimal.'}, {'field': 'PolicyViolationWindow', 'description': 'Default 1800s (30 min) between settings change and install.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:41:38.122000+00:00
description	On Android, the user can use the device settings menu to view trusted CA certificates and look for unexpected or unknown certificates. A mobile security product could similarly examine the trusted CA certificate store for anomalies. Users can use the device settings menu to view which applications on the device are allowed to install unknown applications. On iOS, the user can use the device settings menu to view installed Configuration Profiles and look for unexpected or unknown profiles. A Mobile Device Management (MDM) system could use the iOS MDM APIs to examine the list of installed Configuration Profiles for anomalies.	For Android, detect Subvert Trust Controls by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; File Creation via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: PackageInstaller.install() with installer_source NOT IN $ApprovedInstallSources$ within $PolicyViolationWindow$ of settings change]; System Settings via Android Enterprise DPC [DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_version	1.0	1.1
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--56c2b384-77f8-461f-a71a-76f7888ebfb6', 'name': 'User Interface', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: PackageInstaller.install() with installer_source NOT IN $ApprovedInstallSources$ within $PolicyViolationWindow$ of settings change'}
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--56c2b384-77f8-461f-a71a-76f7888ebfb6', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported'}

[AN1746] Analytic 1746

Current version: 1.1

Version changed from: 1.0 → 1.1

	Old Description			New Description
t	1	On Android, the user can use the device settings menu to vie	t	1	For iOS, detect Subvert Trust Controls from documented manag
	>	w trusted CA certificates and look for unexpected or unknown		>	ement, network, or vetting evidence; treat state queries as
	>	certificates. A mobile security product could similarly exa		>	periodic observations rather than real-time events. Correlat
	>	mine the trusted CA certificate store for anomalies. Users c		>	e Application Permission via Application Vetting [Code-signi
	>	an use the device settings menu to view which applications o		>	ng entitlements and Info.plist privacy usage-description key
	>	n the device are allowed to install unknown applications. O		>	s]; File Creation via Application Vetting / Forensic Acquisi
	>	n iOS, the user can use the device settings menu to view ins		>	tion [Dynamic filesystem trace or acquired app-container/fil
	>	talled Configuration Profiles and look for unexpected or unk		>	esystem artifacts: app binary written to device with signing
	>	nown profiles. A Mobile Device Management (MDM) system could		>	certificate matching manually-trusted enterprise cert NOT I
	>	use the iOS MDM APIs to examine the list of installed Confi		>	N $EnterpriseCertAllowList$ within $ProfileInstallWindow$];
	>	guration Profiles for anomalies.		>	Protected Configuration via Apple MDM [DeviceInformation / S
				>	ecurityInfo / ProfileList / restrictions and compliance quer
				>	ies]. Alert on a sequence or state change inconsistent with
				>	the device/app baseline, approved management policy, or expe
				>	cted user workflow; do not infer unobserved API calls, file/
				>	process activity, or payload content from management state a
				>	lone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'EnterpriseCertAllowList', 'description': 'Approved enterprise signing certificate fingerprints. Derive from IT certificate management system.'}, {'field': 'ProfileInstallWindow', 'description': 'Default 3600s between profile/cert trust and app install.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:41:38.748000+00:00
description	On Android, the user can use the device settings menu to view trusted CA certificates and look for unexpected or unknown certificates. A mobile security product could similarly examine the trusted CA certificate store for anomalies. Users can use the device settings menu to view which applications on the device are allowed to install unknown applications. On iOS, the user can use the device settings menu to view installed Configuration Profiles and look for unexpected or unknown profiles. A Mobile Device Management (MDM) system could use the iOS MDM APIs to examine the list of installed Configuration Profiles for anomalies.	For iOS, detect Subvert Trust Controls from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Application Permission via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]; File Creation via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: app binary written to device with signing certificate matching manually-trusted enterprise cert NOT IN $EnterpriseCertAllowList$ within $ProfileInstallWindow$]; Protected Configuration via Apple MDM [DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_version	1.0	1.1
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--56c2b384-77f8-461f-a71a-76f7888ebfb6', 'name': 'User Interface', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'mobile:ApplicationVetting', 'channel': 'Code-signing entitlements and Info.plist privacy usage-description keys'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: app binary written to device with signing certificate matching manually-trusted enterprise cert NOT IN $EnterpriseCertAllowList$ within $ProfileInstallWindow$'}
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--6c62144a-cd5c-401c-ada9-58c4c74cd9d2', 'name': 'iOS:MDM', 'channel': 'DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries'}

[AN1757] Analytic 1757

Current version: 1.1

Version changed from: 1.0 → 1.1

	Old Description			New Description
t	1	Mobile security products can potentially detect jailbroken d	t	1	For iOS, detect Keychain by correlating analyst-visible devi
	>	evices. Application vetting services may be able to detect k		>	ce/network evidence and management state; use streaming or b
	>	nown privilege escalation exploits contained within applicat		>	atched telemetry only where the documented collector is depl
	>	ions, as well as searching application packages for strings		>	oyed. Correlate Application State via Apple MDM [InstalledAp
	>	that correlate to known password store locations.		>	plicationList / ManagedApplicationList]; Host Status via App
				>	le MDM [DeviceInformation / SecurityInfo / ProfileList / res
				>	trictions and compliance queries]; Network Traffic Flow via
				>	Apple Network Extension / Enterprise VPN [NEFilterFlow / per
				>	-app VPN / secure-web-gateway flow metadata]. Alert on a seq
				>	uence or state change inconsistent with the device/app basel
				>	ine, approved management policy, or expected user workflow;
				>	do not infer unobserved API calls, file/process activity, or
				>	payload content from management state alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'CredentialStoreAppList', 'description': 'Banking, enterprise, password manager, email bundle IDs.'}, {'field': 'CredentialStoreAppCount', 'description': 'Default 2.'}, {'field': 'CredentialDumpMin', 'description': 'Default 10KB.'}, {'field': 'CredentialDumpMax', 'description': 'Default 500KB.'}, {'field': 'AppCDNList', 'description': 'Per-device CDN baseline.'}, {'field': 'ExfilWindow', 'description': 'Default 300s.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:41:42.526000+00:00
description	Mobile security products can potentially detect jailbroken devices. Application vetting services may be able to detect known privilege escalation exploits contained within applications, as well as searching application packages for strings that correlate to known password store locations.	For iOS, detect Keychain by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application State via Apple MDM [InstalledApplicationList / ManagedApplicationList]; Host Status via Apple MDM [DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries]; Network Traffic Flow via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_version	1.0	1.1
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--85a533a4-5fa4-4dba-b45d-f0717bedd6e6', 'name': 'Sensor Health', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'iOS:MDM', 'channel': 'InstalledApplicationList / ManagedApplicationList'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'Application Vetting', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--85a533a4-5fa4-4dba-b45d-f0717bedd6e6', 'name': 'iOS:MDM', 'channel': 'DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'iOS:NetworkExtension', 'channel': 'NEFilterFlow / per-app VPN / secure-web-gateway flow metadata'}

[AN1835] Analytic 1835

Current version: 1.1

Version changed from: 1.0 → 1.1

+For Android, detect Disguise Root/Jailbreak Indicators by co
->
+rrelating analyst-visible device/network evidence and manage
+ment state; use streaming or batched telemetry only where th
+e documented collector is deployed. Correlate File Metadata
+via Application Vetting / Forensic Acquisition [Dynamic file
+system trace or acquired app-container/filesystem artifacts:
+ binary with file_permissions including setuid bit (mode & 0
+) at path NOT IN $KnownSystemBinPaths$ — setuid outside
+system bin directories is the renamed-root-binary indicator]
+; Host Status via Android Enterprise DPC [DevicePolicyManage
+r policy/compliance/security-state queries and SecurityLog e
+vents where supported]; Process Metadata via Application Vet
+ting / Instrumented Dynamic Analysis [Dynamic API/runtime tr
+ace: process executing with effective UID=0]. Alert on a seq
+uence or state change inconsistent with the device/app basel
+ine, approved management policy, or expected user workflow;
+do not infer unobserved API calls, file/process activity, or
+ payload content from management state alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'KnownSystemBinPaths', 'description': '/system/bin, /system/xbin, /system/vendor/bin. Vary by Android version and OEM.'}, {'field': 'PrivilegedAppList', 'description': 'System apps, MDM agent, OTA service.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:41:33.989000+00:00
description	Mobile security products can use attestation to detect compromised devices.	For Android, detect Disguise Root/Jailbreak Indicators by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate File Metadata via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: binary with file_permissions including setuid bit (mode & 04000) at path NOT IN $KnownSystemBinPaths$ — setuid outside system bin directories is the renamed-root-binary indicator]; Host Status via Android Enterprise DPC [DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported]; Process Metadata via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: process executing with effective UID=0]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_version	1.0	1.1
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--85a533a4-5fa4-4dba-b45d-f0717bedd6e6', 'name': 'Sensor Health', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--639e87f3-acb6-448a-9645-258f20da4bc5', 'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: binary with file_permissions including setuid bit (mode & 04000) at path NOT IN $KnownSystemBinPaths$ — setuid outside system bin directories is the renamed-root-binary indicator'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--85a533a4-5fa4-4dba-b45d-f0717bedd6e6', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported'}
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--ee575f4a-2d4f-48f6-b18b-89067760adc1', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: process executing with effective UID=0'}

[AN1836] Analytic 1836

Current version: 1.1

Version changed from: 1.0 → 1.1

+For iOS, detect Disguise Root/Jailbreak Indicators by correl
->
+ating analyst-visible device/network evidence and management
+ state; use streaming or batched telemetry only where the do
+cumented collector is deployed. Correlate Application State
+via Apple MDM [InstalledApplicationList / ManagedApplication
+List]; Host Status via Apple MDM [DeviceInformation / Securi
+tyInfo / ProfileList / restrictions and compliance queries];
+ Network Traffic Flow via Apple Network Extension / Enterpri
+se VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow
+ metadata]. Alert on a sequence or state change inconsistent
+ with the device/app baseline, approved management policy, o
+r expected user workflow; do not infer unobserved API calls,
+ file/process activity, or payload content from management s
+tate alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'AppBaselineDomains', 'description': 'Per-device CDN baseline for all enrolled apps. Any traffic not matching enrolled app baselines is unattributable.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:41:34.627000+00:00
description	Mobile security products can use attestation to detect compromised devices.	For iOS, detect Disguise Root/Jailbreak Indicators by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application State via Apple MDM [InstalledApplicationList / ManagedApplicationList]; Host Status via Apple MDM [DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries]; Network Traffic Flow via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_version	1.0	1.1
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--85a533a4-5fa4-4dba-b45d-f0717bedd6e6', 'name': 'Sensor Health', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'iOS:MDM', 'channel': 'InstalledApplicationList / ManagedApplicationList'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--85a533a4-5fa4-4dba-b45d-f0717bedd6e6', 'name': 'iOS:MDM', 'channel': 'DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries'}
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'iOS:NetworkExtension', 'channel': 'NEFilterFlow / per-app VPN / secure-web-gateway flow metadata'}

Patches

[AN1644] Analytic 1644

Current version: 1.1

	Old Description			New Description
t	1	Correlates (1) an application obtaining or maintaining eleva	t	1	For Android, detect Prevent Application Removal from documen
	>	ted control mechanisms capable of resisting removal (device		>	ted management, network, or vetting evidence; treat state qu
	>	administrator, accessibility control, managed-owner posture)		>	eries as periodic observations rather than real-time events.
	>	, (2) user navigation into uninstall or application-manageme		>	Correlate Application Permission via Android Enterprise DPC
	>	nt flows, and (3) immediate UI redirection, back-navigation		>	/ Application Vetting [DevicePolicyManager.getPermissionGra
	>	injection, modal dismissal, or failed uninstall completion f		>	ntState(); PackageManager manifest/requested-permission revi
	>	ollowed by continued app presence. Defender observes a causa		>	ew]; OS API Execution via Application Vetting / Instrumented
	>	l chain where a removal attempt is actively disrupted and th		>	Dynamic Analysis [Dynamic API/runtime trace: App invokes ac
	>	e target application remains installed.		>	cessibility global actions (back, home, recents) or DevicePo
				>	licyManager removal-resistance operations when package-manag
				>	ement or uninstall UI is in foreground — active uninstall in
				>	terference]. Alert on a sequence or state change inconsisten
				>	t with the device/app baseline, approved management policy,
				>	or expected user workflow; do not infer unobserved API calls
				>	, file/process activity, or payload content from management
				>	state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.376000+00:00	2026-10-13 17:42:49.563000+00:00
description	Correlates (1) an application obtaining or maintaining elevated control mechanisms capable of resisting removal (device administrator, accessibility control, managed-owner posture), (2) user navigation into uninstall or application-management flows, and (3) immediate UI redirection, back-navigation injection, modal dismissal, or failed uninstall completion followed by continued app presence. Defender observes a causal chain where a removal attempt is actively disrupted and the target application remains installed.	For Android, detect Prevent Application Removal from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; OS API Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: App invokes accessibility global actions (back, home, recents) or DevicePolicyManager removal-resistance operations when package-management or uninstall UI is in foreground — active uninstall interference]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:MDMLog', 'channel': 'application enabled as device administrator, device owner, profile owner, or equivalent elevated management role before uninstall attempt'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindow', 'description': 'Correlation window between uninstall UI entry, interference event, and continued install state'}	{'field': 'RemovalResistanceAllowList', 'description': 'MDM agent (legitimate Device Admin that cannot be removed by user is expected). Any other app using removal-resistance mechanisms should be flagged. Derive from MDM enrollment policy.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:MDMLog', 'channel': 'application granted accessibility service privileges capable of screen observation or global action invocation before removal attempt'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes accessibility global actions (back, home, recents) or DevicePolicyManager removal-resistance operations when package-management or uninstall UI is in foreground — active uninstall interference'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': 'application invokes accessibility global actions (back/home/recents) or observes package-management UI immediately after uninstall/settings screen becomes foreground'}
x_mitre_mutable_elements	{'field': 'ProtectedRoleSet', 'description': 'Set of elevated roles considered removal-resistant (device admin, owner modes, accessibility)'}
x_mitre_mutable_elements	{'field': 'GlobalActionSet', 'description': 'UI actions considered suspicious during uninstall flows (BACK, HOME, RECENTS)'}
x_mitre_mutable_elements	{'field': 'AllowedAccessibilityApps', 'description': 'Known legitimate accessibility services expected to use global actions'}
x_mitre_mutable_elements	{'field': 'UninstallRetryThreshold', 'description': 'Number of repeated uninstall attempts before escalation'}
x_mitre_mutable_elements	{'field': 'UplinkBytesThreshold', 'description': 'Outbound traffic threshold confirming continued meaningful activity after failed removal'}

[AN1646] Analytic 1646

Current version: 1.1

	Old Description			New Description
t	1	Defender correlates an app enumerating installed packages (P	t	1	For Android, detect Software Discovery by correlating analys
	>	ackageManager queries or shell 'pm list packages') with sele		>	t-visible device/network evidence and management state; use
	>	ctive checks for high-value targets (banking/identity/securi		>	streaming or batched telemetry only where the documented col
	>	ty apps) and near-term persistence/egress of the inventory.		>	lector is deployed. Correlate API Calls via Application Vett
	>	Chain: capability to query apps → burst of enumeration calls		>	ing / Instrumented Dynamic Analysis [Dynamic API/runtime tra
	>	or shell listing → optional foreground target detection → l		>	ce: PackageManager.getInstalledPackages() or getInstalledApp
	>	ocal inventory file → small POST to remote endpoint.		>	lications() called by app NOT IN $AppEnumAllowList$]; Applic
				>	ation State via Android Enterprise / EMM [Managed package in
				>	ventory/status and package metadata]; Network Connection Cre
				>	ation via Android Enterprise Network Logging / Enterprise VP
				>	N [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / Con
				>	nectEvent; VPN flow metadata]. Alert on a sequence or state
				>	change inconsistent with the device/app baseline, approved m
				>	anagement policy, or expected user workflow; do not infer un
				>	observed API calls, file/process activity, or payload conten
				>	t from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.380000+00:00	2026-10-13 17:41:12.164000+00:00
description	Defender correlates an app enumerating installed packages (PackageManager queries or shell 'pm list packages') with selective checks for high-value targets (banking/identity/security apps) and near-term persistence/egress of the inventory. Chain: capability to query apps → burst of enumeration calls or shell listing → optional foreground target detection → local inventory file → small POST to remote endpoint.	For Android, detect Software Discovery by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: PackageManager.getInstalledPackages() or getInstalledApplications() called by app NOT IN $AppEnumAllowList$]; Application State via Android Enterprise / EMM [Managed package inventory/status and package metadata]; Network Connection Creation via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[1]	{'field': 'MinEnumCount', 'description': 'Minimum count of package queries or listed rows to treat as inventory (e.g., ≥50).'}	{'field': 'AppCDNList', 'description': 'Per-app CDN. Derive by measurement.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'android:logcat', 'channel': 'PackageManager getInstalledApplications\|getInstalledPackages\|getPackagesHoldingPermissions burst for . TYPE_WINDOW_STATE_CHANGED shows foreground app then immediate package queries by '}	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: PackageManager.getInstalledPackages() or getInstalledApplications() called by app NOT IN $AppEnumAllowList$'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindowSeconds', 'description': 'Max time from enumeration to persist/exfil (e.g., 10–120s).'}	{'field': 'AppEnumAllowList', 'description': 'MDM agent, system diagnostic apps. Minimal.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--685f917a-e95e-4ba0-ade1-c7d354dae6e0', 'name': 'android:logcat', 'channel': "Command 'pm list packages' executed by app sandbox or child proc"}	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'android:EMM', 'channel': 'Managed package inventory/status and package metadata'}
x_mitre_mutable_elements[2]	{'field': 'TargetAppWatchlist', 'description': 'List of sensitive app package prefixes (banking/IdP/AV/MDM) to raise severity.'}	{'field': 'FollowOnWindow', 'description': 'Default 120s. Tightening: 30s.'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'android:logcat', 'channel': 'CREATE/WRITE /data/data//(files\|databases)/(app_inventory\|pkg_list).*\\\\.(json\|txt\|db)'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba', 'name': 'android:EnterpriseNetworkLog', 'channel': 'DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_mutable_elements	{'field': 'PersistPathRegex', 'description': 'Regex for inventory artifacts in the app container.'}
x_mitre_mutable_elements	{'field': 'ExfilDomainAllowlist', 'description': 'Known-good analytics/CDN endpoints to suppress FPs.'}
x_mitre_mutable_elements	{'field': 'UserContext', 'description': 'Work Profile/Kiosk/Jamf/Intune policy context to scope benign inventory jobs.'}

[AN1647] Analytic 1647

Current version: 1.1

	Old Description			New Description
t	1	Defender correlates attempts to inventory installed apps via	t	1	For iOS, detect Software Discovery by correlating analyst-vi
	>	LaunchServices/URL-scheme probing or private APIs (e.g., LS		>	sible device/network evidence and management state; use stre
	>	ApplicationWorkspace) with checks for high-value targets and		>	aming or batched telemetry only where the documented collect
	>	quick persistence/egress. Chain: capability/attempt (URL sc		>	or is deployed. Correlate API Calls via Application Vetting
	>	heme spray or LSWorkspace calls) → large scheme/app probe se		>	/ Instrumented Dynamic Analysis [Dynamic API/runtime trace:
	>	t → optional webview hits to brand domains → local inventory		>	UIApplication.canOpenURL() called > $URLProbeThreshold$ time
	>	cache → small egress.		>	s with schemes NOT declared in app's LSApplicationQueriesSch
				>	emes within $ProbeWindow$]; Application State via Apple MDM
				>	[InstalledApplicationList / ManagedApplicationList]; Network
				>	Connection Creation via Apple Network Extension / Enterpris
				>	e VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow
				>	metadata]. Alert on a sequence or state change inconsistent
				>	with the device/app baseline, approved management policy, or
				>	expected user workflow; do not infer unobserved API calls,
				>	file/process activity, or payload content from management st
				>	ate alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.382000+00:00	2026-10-13 17:41:12.771000+00:00
description	Defender correlates attempts to inventory installed apps via LaunchServices/URL-scheme probing or private APIs (e.g., LSApplicationWorkspace) with checks for high-value targets and quick persistence/egress. Chain: capability/attempt (URL scheme spray or LSWorkspace calls) → large scheme/app probe set → optional webview hits to brand domains → local inventory cache → small egress.	For iOS, detect Software Discovery by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: UIApplication.canOpenURL() called > $URLProbeThreshold$ times with schemes NOT declared in app's LSApplicationQueriesSchemes within $ProbeWindow$]; Application State via Apple MDM [InstalledApplicationList / ManagedApplicationList]; Network Connection Creation via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[3]	{'field': 'PersistPathRegex', 'description': 'Regex for inventory artifacts in container.'}	{'field': 'FollowOnWindow', 'description': 'Default 120s.'}
x_mitre_mutable_elements[1]	{'field': 'MinProbeCount', 'description': 'Minimum count of scheme/app probes to treat as inventory (e.g., ≥40).'}	{'field': 'ProbeWindow', 'description': 'Default 30s.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'iOS:unifiedlog', 'channel': 'LSApplicationWorkspace or canOpenURL probe bursts for many URL schemes'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'mobile:DynamicAnalysis', 'channel': "Dynamic API/runtime trace: UIApplication.canOpenURL() called > $URLProbeThreshold$ times with schemes NOT declared in app's LSApplicationQueriesSchemes within $ProbeWindow$"}
x_mitre_mutable_elements[0]	{'field': 'TimeWindowSeconds', 'description': 'Max time from probe burst to persist/exfil (e.g., 10–120s).'}	{'field': 'URLProbeThreshold', 'description': 'Default 10 undeclared scheme probes within window. iOS enforces 50-probe limit total.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'iOS:unifiedlog', 'channel': 'Repeated canOpenURL checks across diverse schemes (≥N within short window)'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'iOS:MDM', 'channel': 'InstalledApplicationList / ManagedApplicationList'}
x_mitre_mutable_elements[2]	{'field': 'TargetBundleWatchlist', 'description': 'Bundle IDs/schemes of sensitive targets (banking/IdP/AV/MDM).'}	{'field': 'AppCDNList', 'description': 'Per-app CDN. Derive by measurement.'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'iOS:unifiedlog', 'channel': 'CREATE/WRITE container paths like /Library/Caches/app_inventory.*\\\\.(json\|plist\|db)'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba', 'name': 'iOS:NetworkExtension', 'channel': 'NEFilterFlow / per-app VPN / secure-web-gateway flow metadata'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_mutable_elements	{'field': 'ExfilDomainAllowlist', 'description': 'Allowlist of enterprise analytics/CDN to reduce FPs.'}
x_mitre_mutable_elements	{'field': 'JailbreakContext', 'description': 'Flag to escalate if private APIs appear on non-managed devices.'}

[AN1648] Analytic 1648

Current version: 1.1

	Old Description			New Description
t	1	Defender correlates an app process performing a burst of OS/	t	1	For Android, detect System Information Discovery by correlat
	>	device attribute lookups (build, hardware, SDK level, system		>	ing analyst-visible device/network evidence and management s
	>	properties) with near-term execution branching (feature gat		>	tate; use streaming or batched telemetry only where the docu
	>	ing, module load, permission workflow changes) and/or immedi		>	mented collector is deployed. Correlate API Calls via Applic
	>	ate outbound communications, indicating environment evaluati		>	ation Vetting / Instrumented Dynamic Analysis [Dynamic API/r
	>	on used to shape follow-on actions.		>	untime trace: android.os.Build field reads > $SysInfoFieldTh
				>	reshold$ distinct fields within $SysInfoWindow$ by app NOT I
				>	N $SysInfoAllowList$ at launch or in background]; Applicatio
				>	n State via Android Enterprise / EMM [Managed package invent
				>	ory/status and package metadata]; Network Connection Creatio
				>	n via Android Enterprise Network Logging / Enterprise VPN [D
				>	evicePolicyManager.retrieveNetworkLogs(): DnsEvent / Connect
				>	Event; VPN flow metadata]. Alert on a sequence or state chan
				>	ge inconsistent with the device/app baseline, approved manag
				>	ement policy, or expected user workflow; do not infer unobse
				>	rved API calls, file/process activity, or payload content fr
				>	om management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.378000+00:00	2026-10-13 17:41:22.536000+00:00
description	Defender correlates an app process performing a burst of OS/device attribute lookups (build, hardware, SDK level, system properties) with near-term execution branching (feature gating, module load, permission workflow changes) and/or immediate outbound communications, indicating environment evaluation used to shape follow-on actions.	For Android, detect System Information Discovery by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: android.os.Build field reads > $SysInfoFieldThreshold$ distinct fields within $SysInfoWindow$ by app NOT IN $SysInfoAllowList$ at launch or in background]; Application State via Android Enterprise / EMM [Managed package inventory/status and package metadata]; Network Connection Creation via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[3]	{'field': 'BackgroundOnly', 'description': 'If true, require the burst occurs while app is background to reduce noise from legitimate settings/about-device screens.'}	{'field': 'AppCDNList', 'description': 'Per-app CDN. Derive by measurement.'}
x_mitre_mutable_elements[1]	{'field': 'MinSystemInfoSignals', 'description': 'Minimum number of distinct system-attribute reads/queries within window to count as ‘broad fingerprinting’ (tune to telemetry fidelity).'}	{'field': 'SysInfoWindow', 'description': 'Default 30s at launch.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'android:logcat', 'channel': 'Application accesses android.os.Build fields or device configuration APIs (MODEL, MANUFACTURER, VERSION.SDK_INT, HARDWARE)'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: android.os.Build field reads > $SysInfoFieldThreshold$ distinct fields within $SysInfoWindow$ by app NOT IN $SysInfoAllowList$ at launch or in background'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindowSeconds', 'description': 'Correlation window for system-info collection burst → outbound transmission (e.g., 60–900s).'}	{'field': 'SysInfoFieldThreshold', 'description': 'Default 5 distinct Build fields within window. Single-field reads are legitimate.'}
x_mitre_mutable_elements[2]	{'field': 'DistinctAttributeThreshold', 'description': 'How many distinct attribute categories (build fields, cpu, locale, patch level, network identifiers) must be observed.'}	{'field': 'SysInfoAllowList', 'description': 'MDM agent, crash reporter, analytics SDK (if pre-approved). Derive from MDM catalog.'}
x_mitre_mutable_elements[4]	{'field': 'AllowlistedPackages', 'description': 'Legitimate device management, diagnostics, carrier services, and enterprise security apps expected to collect device inventory.'}	{'field': 'FollowOnWindow', 'description': 'Default 120s.'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'android:EMM', 'channel': 'Managed package inventory/status and package metadata'}
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba', 'name': 'android:EnterpriseNetworkLog', 'channel': 'DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_mutable_elements	{'field': 'NewDomainWindowSeconds', 'description': 'Window for ‘newly contacted domain’ enrichment after fingerprinting burst.'}
x_mitre_mutable_elements	{'field': 'SmallPostByteRange', 'description': 'Approximate payload size range used for ‘fingerprint submit’ heuristic (environment dependent).'}

[AN1649] Analytic 1649

Current version: 1.1

	Old Description			New Description
t	1	Defender correlates an app querying device model and iOS ver	t	1	For iOS, detect System Information Discovery by correlating
	>	sion (often limited to UIDevice-visible attributes) with sub		>	analyst-visible device/network evidence and management state
	>	sequent behavior divergence (capability gating, alternate co		>	; use streaming or batched telemetry only where the document
	>	de paths) and/or near-term outbound connections, suggesting		>	ed collector is deployed. Correlate API Calls via Applicatio
	>	device fingerprinting for decision-making rather than normal		>	n Vetting / Instrumented Dynamic Analysis [Dynamic API/runti
	>	telemetry.		>	me trace: UIDevice.current.model]; Application State via App
				>	le MDM [InstalledApplicationList / ManagedApplicationList];
				>	Network Connection Creation via Apple Network Extension / En
				>	terprise VPN [NEFilterFlow / per-app VPN / secure-web-gatewa
				>	y flow metadata]. Alert on a sequence or state change incons
				>	istent with the device/app baseline, approved management pol
				>	icy, or expected user workflow; do not infer unobserved API
				>	calls, file/process activity, or payload content from manage
				>	ment state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.375000+00:00	2026-10-13 17:41:23.158000+00:00
description	Defender correlates an app querying device model and iOS version (often limited to UIDevice-visible attributes) with subsequent behavior divergence (capability gating, alternate code paths) and/or near-term outbound connections, suggesting device fingerprinting for decision-making rather than normal telemetry.	For iOS, detect System Information Discovery by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: UIDevice.current.model]; Application State via Apple MDM [InstalledApplicationList / ManagedApplicationList]; Network Connection Creation via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'iOS:unifiedlog', 'channel': 'Application invokes UIDevice queries (model, systemVersion, name)'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: UIDevice.current.model'}
x_mitre_mutable_elements[0]	{'field': 'QueryFrequencyThreshold', 'description': 'Baseline-dependent threshold for distinguishing normal app telemetry from discovery behavior'}	{'field': 'SysInfoAllowList', 'description': 'MDM agent, analytics SDK (pre-approved), crash reporter.'}
x_mitre_mutable_elements[2]	{'field': 'DeviceModelBaseline', 'description': 'Allows tuning for environments with homogeneous vs heterogeneous device fleets'}	{'field': 'AppCDNList', 'description': 'Per-app CDN. Derive by measurement.'}
x_mitre_mutable_elements[1]	{'field': 'QueryToExecutionDeviationWindow', 'description': 'Defines acceptable delay between device queries and execution changes'}	{'field': 'SysInfoWindow', 'description': 'Default 30s at launch.'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'iOS:MDM', 'channel': 'InstalledApplicationList / ManagedApplicationList'}
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba', 'name': 'iOS:NetworkExtension', 'channel': 'NEFilterFlow / per-app VPN / secure-web-gateway flow metadata'}
x_mitre_mutable_elements		{'field': 'FollowOnWindow', 'description': 'Default 120s.'}

[AN1650] Analytic 1650

Current version: 2.0

	Old Description			New Description
t	1	OLD: Application vetting services could look for `android.pe	t	1	For Android, detect Call Log by correlating analyst-visible
	>	rmission.READ_CALL_LOG` in an Android application’s manifest		>	device/network evidence and management state; use streaming
	>	. Most applications do not need call log access, so extra sc		>	or batched telemetry only where the documented collector is
	>	rutiny could be applied to those that request it. On Androi		>	deployed. Correlate API Calls via Application Vetting / Inst
	>	d, the user can manage which applications have permission to		>	rumented Dynamic Analysis [Dynamic API/runtime trace: Conten
	>	access the call log through the device settings screen, rev		>	tResolver.query(CallLog.Calls) with query_count > $CallLogQu
	>	oking the permission if necessary. NEW: A defender observes		>	eryThreshold$ by app NOT IN $ApprovedDialerApps$]; Network T
	>	an Android application requesting for `android.permission.R		>	raffic Flow via Android Enterprise Network Logging / Enterpr
	>	EAD_CALL_LOG`, which may also be listed in the application's		>	ise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent
	>	manifest file.		>	/ ConnectEvent; VPN flow metadata]; Permissions Request via
				>	Android Enterprise DPC / Application Vetting [DevicePolicyM
				>	anager.getPermissionGrantState(); PackageManager manifest/re
				>	quested-permission review]. Alert on a sequence or state cha
				>	nge inconsistent with the device/app baseline, approved mana
				>	gement policy, or expected user workflow; do not infer unobs
				>	erved API calls, file/process activity, or payload content f
				>	rom management state alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ApprovedDialerApps', 'description': 'Default dialer, approved call backup apps. Minimal.'}, {'field': 'CallLogQueryThreshold', 'description': 'Default 10 queries/2min — low threshold; call log has minimal legitimate background access.'}, {'field': 'CallLogUplinkThreshold', 'description': 'Default 20KB — call records are small; even 200 records fit in ~20KB.'}, {'field': 'AppCDNList', 'description': 'Per-app CDN. Derive by measurement.'}, {'field': 'ExfilWindow', 'description': 'Default 120s.'}]

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.381000+00:00	2026-10-13 17:41:48.808000+00:00
description	OLD: Application vetting services could look for `android.permission.READ_CALL_LOG` in an Android application’s manifest. Most applications do not need call log access, so extra scrutiny could be applied to those that request it. On Android, the user can manage which applications have permission to access the call log through the device settings screen, revoking the permission if necessary. NEW: A defender observes an Android application requesting for `android.permission.READ_CALL_LOG`, which may also be listed in the application's manifest file.	For Android, detect Call Log by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: ContentResolver.query(CallLog.Calls) with query_count > $CallLogQueryThreshold$ by app NOT IN $ApprovedDialerApps$]; Network Traffic Flow via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]; Permissions Request via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'android:logcat', 'channel': 'Invocation of CallLogs.getLastOutgoingCall()'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: ContentResolver.query(CallLog.Calls) with query_count > $CallLogQueryThreshold$ by app NOT IN $ApprovedDialerApps$'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:MDMLog', 'channel': 'Application granted or retaining the READ_CALL_LOG permission. '}	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'android:EnterpriseNetworkLog', 'channel': 'DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--e2f72131-14d1-411f-8e8c-aa3453dd5456', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}

[AN1651] Analytic 1651

Current version: 1.0

	Old Description			New Description
t	1	Application vetting services could look for `android.permiss	t	1	For iOS, detect Call Log by correlating analyst-visible devi
	>	ion.READ_CALL_LOG` in an Android application’s manifest. Mos		>	ce/network evidence and management state; use streaming or b
	>	t applications do not need call log access, so extra scrutin		>	atched telemetry only where the documented collector is depl
	>	y could be applied to those that request it. On Android, th		>	oyed. Correlate Application State via Apple MDM [InstalledAp
	>	e user can manage which applications have permission to acce		>	plicationList / ManagedApplicationList]; Host Status via App
	>	ss the call log through the device settings screen, revoking		>	le MDM [DeviceInformation / SecurityInfo / ProfileList / res
	>	the permission if necessary.		>	trictions and compliance queries]; Network Traffic Flow via
				>	Apple Network Extension / Enterprise VPN [NEFilterFlow / per
				>	-app VPN / secure-web-gateway flow metadata]. Alert on a seq
				>	uence or state change inconsistent with the device/app basel
				>	ine, approved management policy, or expected user workflow;
				>	do not infer unobserved API calls, file/process activity, or
				>	payload content from management state alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'CommunicationAppList', 'description': 'Phone, FaceTime, WhatsApp, Signal — apps that generate call history.'}, {'field': 'CallLogDumpMin', 'description': 'Default 5KB.'}, {'field': 'CallLogDumpMax', 'description': 'Default 1MB — call records are small; this is generous.'}, {'field': 'AppCDNList', 'description': 'Per-device CDN baseline.'}, {'field': 'ExfilWindow', 'description': 'Default 300s.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:41:49.465000+00:00
description	Application vetting services could look for `android.permission.READ_CALL_LOG` in an Android application’s manifest. Most applications do not need call log access, so extra scrutiny could be applied to those that request it. On Android, the user can manage which applications have permission to access the call log through the device settings screen, revoking the permission if necessary.	For iOS, detect Call Log by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application State via Apple MDM [InstalledApplicationList / ManagedApplicationList]; Host Status via Apple MDM [DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries]; Network Traffic Flow via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'Application Vetting', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'iOS:MDM', 'channel': 'InstalledApplicationList / ManagedApplicationList'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--56c2b384-77f8-461f-a71a-76f7888ebfb6', 'name': 'User Interface', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--85a533a4-5fa4-4dba-b45d-f0717bedd6e6', 'name': 'iOS:MDM', 'channel': 'DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'iOS:NetworkExtension', 'channel': 'NEFilterFlow / per-app VPN / secure-web-gateway flow metadata'}

[AN1652] Analytic 1652

Current version: 1.1

	Old Description			New Description
t	1	Correlates (1) acquisition or presence of elevated control p	t	1	For Android, detect Device Lockout from documented managemen
	>	aths capable of forcing a lock state or blocking user intera		>	t, network, or vetting evidence; treat state queries as peri
	>	ction, (2) invocation of screen-locking or UI-denial behavio		>	odic observations rather than real-time events. Correlate Ap
	>	r such as DevicePolicyManager lock operations, persistent ov		>	plication Permission via Android Enterprise DPC / Applicatio
	>	erlays, accessibility-driven navigation interruption, or for		>	n Vetting [DevicePolicyManager.getPermissionGrantState(); Pa
	>	eground lock-screen impersonation, and (3) immediate transit		>	ckageManager manifest/requested-permission review]; OS API E
	>	ion of the device into an unavailable or repeatedly re-locke		>	xecution via Application Vetting / Instrumented Dynamic Anal
	>	d state while the responsible application remains installed		>	ysis [Dynamic API/runtime trace: App invokes DevicePolicyMan
	>	and active. The defender observes a causal chain where an ap		>	ager.lockNow(), creates persistent fullscreen overlay (TYPE_
	>	plication first gains the ability to control lock-related be		>	APPLICATION_OVERLAY covering full screen), or uses accessibi
	>	havior, then forces or simulates lockout, and the device bec		>	lity to block UI interaction — lock or UI-denial API invocat
	>	omes unusable to the legitimate user.		>	ion]. Alert on a sequence or state change inconsistent with
				>	the device/app baseline, approved management policy, or expe
				>	cted user workflow; do not infer unobserved API calls, file/
				>	process activity, or payload content from management state a
				>	lone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.381000+00:00	2026-10-13 17:40:45.071000+00:00
description	Correlates (1) acquisition or presence of elevated control paths capable of forcing a lock state or blocking user interaction, (2) invocation of screen-locking or UI-denial behavior such as DevicePolicyManager lock operations, persistent overlays, accessibility-driven navigation interruption, or foreground lock-screen impersonation, and (3) immediate transition of the device into an unavailable or repeatedly re-locked state while the responsible application remains installed and active. The defender observes a causal chain where an application first gains the ability to control lock-related behavior, then forces or simulates lockout, and the device becomes unusable to the legitimate user.	For Android, detect Device Lockout from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; OS API Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: App invokes DevicePolicyManager.lockNow(), creates persistent fullscreen overlay (TYPE_APPLICATION_OVERLAY covering full screen), or uses accessibility to block UI interaction — lock or UI-denial API invocation]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:MDMLog', 'channel': 'application enabled as device administrator, device owner, or profile owner before screen-lock or password-control activity'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindow', 'description': 'Correlation window between privileged control acquisition, lockout action, and resulting device lock state'}	{'field': 'MDMAdminAllowList', 'description': 'MDM agent packages only. Any other app with Device Admin or accessibility-based lock capability is anomalous.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:MDMLog', 'channel': 'application granted accessibility service privileges capable of intercepting UI flow or sustaining user-interaction denial before lockout event'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes DevicePolicyManager.lockNow(), creates persistent fullscreen overlay (TYPE_APPLICATION_OVERLAY covering full screen), or uses accessibility to block UI interaction — lock or UI-denial API invocation'}
x_mitre_mutable_elements[1]	{'field': 'ProtectedRoleSet', 'description': 'Set of elevated roles that materially increase lockout capability, such as device admin, device owner, profile owner, or accessibility service'}	{'field': 'LockDurationThreshold', 'description': 'Default 60s. Legitimate app-initiated locks (screen timeout) are brief; sustained programmatic lock without user interaction = lockout evasion.'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': 'application invokes lock-related or UI-denial framework operations, including DevicePolicyManager lock actions, persistent overlay behavior, or accessibility-driven navigation interference immediately before device enters locked or unusable state'}
x_mitre_mutable_elements	{'field': 'LockActionSet', 'description': 'Framework actions treated as lockout-relevant, including lockNow, password-control changes, overlay persistence, and UI-denial actions'}
x_mitre_mutable_elements	{'field': 'AllowedAdminApps', 'description': 'Baseline of legitimate enterprise or security apps expected to invoke lock-related controls'}
x_mitre_mutable_elements	{'field': 'RelockThreshold', 'description': 'Number of repeated lock or lock-like transitions in a short interval required before escalation'}
x_mitre_mutable_elements	{'field': 'UplinkBytesThreshold', 'description': 'Outbound traffic threshold confirming continued meaningful activity after lockout'}

[AN1653] Analytic 1653

Current version: 1.1

	Old Description			New Description
t	1	The defender observes a newly enrolled or recently activated	t	1	For Android, detect Compromise Hardware Supply Chain by corr
	>	device presenting abnormal integrity, hardware-backed attes		>	elating analyst-visible device/network evidence and manageme
	>	tation, or firmware/build relationships at the management pl		>	nt state; use streaming or batched telemetry only where the
	>	ane, followed by privileged or system-context access to prot		>	documented collector is deployed. Correlate Application Perm
	>	ected resources or framework paths, and then outbound commun		>	ission via Android Enterprise DPC / Application Vetting [Dev
	>	ication inconsistent with setup state, lock state, or recent		>	icePolicyManager.getPermissionGrantState(); PackageManager m
	>	user interaction. The causal sequence is strongest when the		>	anifest/requested-permission review]; Application State via
	>	device has not yet reached a normal trusted posture but sti		>	Android Enterprise / EMM [Managed package inventory/status a
	>	ll exhibits system-level capability use or network activity.		>	nd package metadata]; Network Traffic Content via Enterprise
				>	Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy
				>	transaction metadata where enterprise decryption/inspection
				>	is deployed]. Alert on a sequence or state change inconsist
				>	ent with the device/app baseline, approved management policy
				>	, or expected user workflow; do not infer unobserved API cal
				>	ls, file/process activity, or payload content from managemen
				>	t state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.381000+00:00	2026-10-13 17:42:52.358000+00:00
description	The defender observes a newly enrolled or recently activated device presenting abnormal integrity, hardware-backed attestation, or firmware/build relationships at the management plane, followed by privileged or system-context access to protected resources or framework paths, and then outbound communication inconsistent with setup state, lock state, or recent user interaction. The causal sequence is strongest when the device has not yet reached a normal trusted posture but still exhibits system-level capability use or network activity.	For Android, detect Compromise Hardware Supply Chain by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; Application State via Android Enterprise / EMM [Managed package inventory/status and package metadata]; Network Traffic Content via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:MDMLog', 'channel': 'Device enrollment or compliance event shows failed or degraded verified boot, hardware-backed attestation mismatch, patch/build/baseband inconsistency, or unexpected device property drift near first contact'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'MobileEDR:telemetry', 'channel': 'Protected resource use or privileged framework access occurs while device is locked, before normal setup completion, or from an app/service not in foreground and not on approved preload list'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'android:EMM', 'channel': 'Managed package inventory/status and package metadata'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': 'Privileged or OEM-context framework/API use tied to telephony, device policy, accessibility, overlay, input injection, package visibility, or protected settings modification from an identity not expected for the device model or approved image'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'webproxy:applog', 'channel': 'DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Protected resource use, privileged API invocation, or telephony/accessibility/overlay access occurs from system-app context while device is locked or before normal setup completion'}

[AN1654] Analytic 1654

Current version: 1.1

	Old Description			New Description
t	1	The defender observes a device at activation, supervision, o	t	1	For iOS, detect Compromise Hardware Supply Chain by correlat
	>	r enrollment time with unusual management-plane posture, inv		>	ing analyst-visible device/network evidence and management s
	>	entory, or trust characteristics and then relies primarily o		>	tate; use streaming or batched telemetry only where the docu
	>	n downstream network effects and device state inconsistencie		>	mented collector is deployed. Correlate Application Permissi
	>	s rather than direct low-level process telemetry. On iOS, th		>	on via Application Vetting [Code-signing entitlements and In
	>	e most reliable sequence is supervision/attestation or inven		>	fo.plist privacy usage-description keys]; Application State
	>	tory concern near first contact followed by network egress o		>	via Apple MDM [InstalledApplicationList / ManagedApplication
	>	r protected-state behavior that is inconsistent with lock st		>	List]; Network Traffic Content via Enterprise Secure Web Gat
	>	ate, setup phase, or expected managed app activity.		>	eway / Proxy [DNS/HTTP(S) inspection or proxy transaction me
				>	tadata where enterprise decryption/inspection is deployed].
				>	Alert on a sequence or state change inconsistent with the de
				>	vice/app baseline, approved management policy, or expected u
				>	ser workflow; do not infer unobserved API calls, file/proces
				>	s activity, or payload content from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.378000+00:00	2026-10-13 17:42:53.085000+00:00
description	The defender observes a device at activation, supervision, or enrollment time with unusual management-plane posture, inventory, or trust characteristics and then relies primarily on downstream network effects and device state inconsistencies rather than direct low-level process telemetry. On iOS, the most reliable sequence is supervision/attestation or inventory concern near first contact followed by network egress or protected-state behavior that is inconsistent with lock state, setup phase, or expected managed app activity.	For iOS, detect Compromise Hardware Supply Chain by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]; Application State via Apple MDM [InstalledApplicationList / ManagedApplicationList]; Network Traffic Content via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'iOS:MDMLog', 'channel': 'Supervised enrollment, activation, or inventory event reveals unexpected device property relationships, anomalous managed posture, unexplained configuration drift near first contact, or identity/inventory characteristics inconsistent with approved procurement baseline'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'mobile:ApplicationVetting', 'channel': 'Code-signing entitlements and Info.plist privacy usage-description keys'}
x_mitre_log_source_references[3]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'iOS:unifiedlog', 'channel': 'Supplemental anomaly in baseband, IOKit, accessory, security, or activation-related subsystem logging temporally adjacent to suspicious posture or network behavior'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Supplemental baseband, IOKit, accessory, security, or activation-related subsystem anomalies on supervised device at activation — Unified Log supplemental confirmation'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'VPN:MobileProxy', 'channel': 'Supervised or newly activated device initiates outbound connections to destinations outside Apple, MDM, update, or enterprise-managed baselines while locked, with no recent user interaction, or before expected app enrollment completion'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'iOS:MDM', 'channel': 'InstalledApplicationList / ManagedApplicationList'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'MobileEDR:telemetry', 'channel': 'Managed app or device-originated network activity occurs while the device is locked or before expected managed app initialization sequence, inconsistent with expected background refresh baseline'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'webproxy:applog', 'channel': 'DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed'}

[AN1655] Analytic 1655

Current version: 1.0

+For Android, detect Account Access Removal by correlating an
->
+alyst-visible device/network evidence and management state;
+use streaming or batched telemetry only where the documented
+ collector is deployed. Correlate API Calls via Application
+Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime
+ trace: DevicePolicyManager.resetPassword() or lockNow() or
+wipeData() called by caller NOT IN $MDMAgentPackageList$]; A
+pplication Permission via Android Enterprise DPC / Applicati
+on Vetting [DevicePolicyManager.getPermissionGrantState(); P
+ackageManager manifest/requested-permission review]; Host St
+atus via Android Enterprise DPC [DevicePolicyManager policy/
+compliance/security-state queries and SecurityLog events whe
+re supported]. Alert on a sequence or state change inconsist
+ent with the device/app baseline, approved management policy
+, or expected user workflow; do not infer unobserved API cal
+ls, file/process activity, or payload content from managemen
+t state alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'MDMAgentPackageList', 'description': 'MDM agent and approved Device Admin packages. Derive from MDM platform.'}, {'field': 'LockoutWindow', 'description': 'Default 300s between Device Admin API call and device check-in failure.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:41:59.223000+00:00
description	Application vetting services could closely scrutinize applications that request Device Administrator permissions.	For Android, detect Account Access Removal by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: DevicePolicyManager.resetPassword() or lockNow() or wipeData() called by caller NOT IN $MDMAgentPackageList$]; Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; Host Status via Android Enterprise DPC [DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'Application Vetting', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: DevicePolicyManager.resetPassword() or lockNow() or wipeData() called by caller NOT IN $MDMAgentPackageList$'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--85a533a4-5fa4-4dba-b45d-f0717bedd6e6', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported'}

[AN1656] Analytic 1656

Current version: 1.0

	Old Description			New Description
t	1	The user can view a list of device administrators and applic	t	1	For Android, detect Virtualization Solution by correlating a
	>	ations that have registered Accessibility services in device		>	nalyst-visible device/network evidence and management state;
	>	settings. Applications that register an Accessibility servi		>	use streaming or batched telemetry only where the documente
	>	ce or request device administrator permissions should be scr		>	d collector is deployed. Correlate Application Permission vi
	>	utinized further for malicious behavior. Application vettin		>	a Android Enterprise DPC / Application Vetting [DevicePolicy
	>	g services can look for applications that request permission		>	Manager.getPermissionGrantState(); PackageManager manifest/r
	>	s to Accessibility services or application overlay. Monitor		>	equested-permission review]; Application State via Android E
	>	for API calls that are related to GooglePlayServices.		>	nterprise / EMM [Managed package inventory/status and packag
				>	e metadata]; Network Traffic Flow via Android Enterprise Net
				>	work Logging / Enterprise VPN [DevicePolicyManager.retrieveN
				>	etworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]. A
				>	lert on a sequence or state change inconsistent with the dev
				>	ice/app baseline, approved management policy, or expected us
				>	er workflow; do not infer unobserved API calls, file/process
				>	activity, or payload content from management state alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'MDMApprovedCatalog', 'description': 'MDM-managed app list.'}, {'field': 'SystemAppList', 'description': 'Android system components legitimately using AVF.'}, {'field': 'ResourceAnomalyThreshold', 'description': 'CPU or RAM delta above declared-app baseline. Derive from device resource baseline measurement.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:42:17.605000+00:00
description	The user can view a list of device administrators and applications that have registered Accessibility services in device settings. Applications that register an Accessibility service or request device administrator permissions should be scrutinized further for malicious behavior. Application vetting services can look for applications that request permissions to Accessibility services or application overlay. Monitor for API calls that are related to GooglePlayServices.	For Android, detect Virtualization Solution by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; Application State via Android Enterprise / EMM [Managed package inventory/status and package metadata]; Network Traffic Flow via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--e2f72131-14d1-411f-8e8c-aa3453dd5456', 'name': 'User Interface', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'Application Vetting', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'android:EMM', 'channel': 'Managed package inventory/status and package metadata'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'Process', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'android:EnterpriseNetworkLog', 'channel': 'DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata'}

[AN1657] Analytic 1657

Current version: 1.1

	Old Description			New Description
t	1	The defender correlates app-driven shell-launch behavior wit	t	1	For Android, detect Unix Shell from documented management, n
	>	h subsequent execution of Unix shell processes or shell-scri		>	etwork, or vetting evidence; treat state queries as periodic
	>	pt activity under the same app context, especially when exec		>	observations rather than real-time events. Correlate Comman
	>	ution occurs from background state, without recent user inte		>	d Execution via Application Vetting / Instrumented Dynamic A
	>	raction, or is followed by file-system, privilege-escalation		>	nalysis [Dynamic API/runtime trace: Unix shell process (sh,
	>	, or network effects inconsistent with the app's declared ro		>	bash, busybox sh, toybox) spawns as child of app process wit
	>	le. The analytic prioritizes Android-observable control-plan		>	h command-line arguments indicating scripted operation — she
	>	e effects: Runtime or ProcessBuilder invocation, spawn of sh		>	ll with arguments confirms script execution not interactive
	>	/toybox/toolbox/su or equivalent shell process, script-file		>	terminal]; Process Creation via Application Vetting / Manage
	>	staging or redirected output, and post-execution network or		>	d Device Telemetry [Application invokes Runtime.exec(), Proc
	>	local artifact creation.		>	essBuilder.start(), or JNI-backed launcher with sh, bash, to
				>	ybox, toolbox, or su as command argument NOT IN $ApprovedShe
				>	llApps$ — explicit Unix shell invocation]. Alert on a sequen
				>	ce or state change inconsistent with the device/app baseline
				>	, approved management policy, or expected user workflow; do
				>	not infer unobserved API calls, file/process activity, or pa
				>	yload content from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.383000+00:00	2026-10-13 17:40:45.764000+00:00
description	The defender correlates app-driven shell-launch behavior with subsequent execution of Unix shell processes or shell-script activity under the same app context, especially when execution occurs from background state, without recent user interaction, or is followed by file-system, privilege-escalation, or network effects inconsistent with the app's declared role. The analytic prioritizes Android-observable control-plane effects: Runtime or ProcessBuilder invocation, spawn of sh/toybox/toolbox/su or equivalent shell process, script-file staging or redirected output, and post-execution network or local artifact creation.	For Android, detect Unix Shell from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Command Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: Unix shell process (sh, bash, busybox sh, toybox) spawns as child of app process with command-line arguments indicating scripted operation — shell with arguments confirms script execution not interactive terminal]; Process Creation via Application Vetting / Managed Device Telemetry [Application invokes Runtime.exec(), ProcessBuilder.start(), or JNI-backed launcher with sh, bash, toybox, toolbox, or su as command argument NOT IN $ApprovedShellApps$ — explicit Unix shell invocation]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'MobileEDR:telemetry', 'channel': 'Application invokes Runtime.exec, ProcessBuilder, JNI-backed command launcher, or equivalent command-execution bridge immediately before shell or command process creation'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--685f917a-e95e-4ba0-ade1-c7d354dae6e0', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Unix shell process (sh, bash, busybox sh, toybox) spawns as child of app process with command-line arguments indicating scripted operation — shell with arguments confirms script execution not interactive terminal'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindow', 'description': 'Correlation window between shell-launch method use, Unix shell process creation, and follow-on file or network effects'}	{'field': 'ApprovedShellApps', 'description': 'Terminal emulator apps (developer fleet only). Production managed devices: empty — no app should spawn Unix shells. Derive from IT device classification.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--685f917a-e95e-4ba0-ade1-c7d354dae6e0', 'name': 'MobileEDR:telemetry', 'channel': 'Application spawns Unix shell process or superuser binary such as sh, su, toybox, toolbox, or shell-like child process with parameters during execution phase'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'mobile:DynamicAnalysis', 'channel': 'Application invokes Runtime.exec(), ProcessBuilder.start(), or JNI-backed launcher with sh, bash, toybox, toolbox, or su as command argument NOT IN $ApprovedShellApps$ — explicit Unix shell invocation'}
x_mitre_mutable_elements[1]	{'field': 'AllowedAppList', 'description': 'Apps legitimately expected to run shells, such as approved terminal apps, enterprise support tools, device management agents, or developer tooling'}	{'field': 'ShellActivityWindow', 'description': 'Default 30s between shell spawn and follow-on file/network activity.'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_mutable_elements	{'field': 'AllowedProcessPatterns', 'description': 'Expected shell binaries, parent-child process chains, and helper-process patterns for approved apps'}
x_mitre_mutable_elements	{'field': 'ForegroundStateRequired', 'description': 'Whether Unix shell execution should occur only during active user-driven workflows'}
x_mitre_mutable_elements	{'field': 'CommandArgumentRiskPatterns', 'description': 'Environment-specific list of suspicious shell arguments, pipes, redirection, chaining operators, or privilege-escalation references'}
x_mitre_mutable_elements	{'field': 'SensitivePathPatterns', 'description': 'Environment-specific list of high-value file paths or system locations touched after shell execution'}
x_mitre_mutable_elements	{'field': 'PostExecutionWriteThreshold', 'description': 'Minimum number or size of artifacts created after shell execution to increase confidence'}
x_mitre_mutable_elements	{'field': 'UplinkBytesThreshold', 'description': 'Minimum outbound volume after shell execution to treat network behavior as meaningful'}

[AN1658] Analytic 1658

Current version: 1.1

	Old Description			New Description
t	1	The defender correlates managed-app process-launch or shell-	t	1	For iOS, detect Unix Shell from documented management, netwo
	>	like execution effects with subsequent file or network activ		>	rk, or vetting evidence; treat state queries as periodic obs
	>	ity by the same app, then raises confidence when execution o		>	ervations rather than real-time events. Correlate Command Ex
	>	ccurs in background context, without recent user interaction		>	ecution via Application Vetting / Instrumented Dynamic Analy
	>	, or appears tied to command delivery or output exfiltration		>	sis [Dynamic API/runtime trace: Shell or command-executing c
	>	. Because direct Unix-shell observability is typically weake		>	hild process with arguments spawned under managed app contex
	>	r on iOS and child processes remain constrained by the app s		>	t on supervised iOS device]; Process Creation via Applicatio
	>	andbox, the analytic anchors on process-execution effects wh		>	n Vetting / Managed Device Telemetry [Managed iOS app invoke
	>	ere available and then on lifecycle, file, and network side		>	s process-launch behavior resulting in sh, bash, or equivale
	>	effects rather than assuming rich shell-parameter visibility		>	nt shell child process on supervised device — any shell spaw
	>	in all environments.		>	n on stock iOS is a jailbreak indicator]. Alert on a sequenc
				>	e or state change inconsistent with the device/app baseline,
				>	approved management policy, or expected user workflow; do n
				>	ot infer unobserved API calls, file/process activity, or pay
				>	load content from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.378000+00:00	2026-10-13 17:40:46.350000+00:00
description	The defender correlates managed-app process-launch or shell-like execution effects with subsequent file or network activity by the same app, then raises confidence when execution occurs in background context, without recent user interaction, or appears tied to command delivery or output exfiltration. Because direct Unix-shell observability is typically weaker on iOS and child processes remain constrained by the app sandbox, the analytic anchors on process-execution effects where available and then on lifecycle, file, and network side effects rather than assuming rich shell-parameter visibility in all environments.	For iOS, detect Unix Shell from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Command Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: Shell or command-executing child process with arguments spawned under managed app context on supervised iOS device]; Process Creation via Application Vetting / Managed Device Telemetry [Managed iOS app invokes process-launch behavior resulting in sh, bash, or equivalent shell child process on supervised device — any shell spawn on stock iOS is a jailbreak indicator]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'MobileEDR:telemetry', 'channel': 'Managed app invokes lower-level OS process-launch or command-execution behavior before file or network effects, including interpreter-like execution flow where visible to sensor'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--685f917a-e95e-4ba0-ade1-c7d354dae6e0', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Shell or command-executing child process with arguments spawned under managed app context on supervised iOS device'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindow', 'description': 'Correlation window between shell-like execution indication, process effects, and follow-on file or network behavior'}	{'field': 'ApprovedShellApps', 'description': 'Terminal emulator apps (developer fleet only). Production managed devices: empty — no app should spawn Unix shells. Derive from IT device classification.'}
x_mitre_mutable_elements[1]	{'field': 'AllowedAppList', 'description': 'Managed apps legitimately expected to perform debugging, remote support, or enterprise automation tasks'}	{'field': 'ShellActivityWindow', 'description': 'Default 30s between shell spawn and follow-on file/network activity.'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'mobile:DynamicAnalysis', 'channel': 'Managed iOS app invokes process-launch behavior resulting in sh, bash, or equivalent shell child process on supervised device — any shell spawn on stock iOS is a jailbreak indicator'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_mutable_elements	{'field': 'AllowedProcessPatterns', 'description': 'Expected helper-process or process-launch patterns for approved managed apps'}
x_mitre_mutable_elements	{'field': 'ForegroundStateRequired', 'description': 'Whether shell-like execution should occur only during active user-driven workflows'}
x_mitre_mutable_elements	{'field': 'ArtifactPathPatterns', 'description': 'Expected temporary or output file locations for approved app behavior'}
x_mitre_mutable_elements	{'field': 'UplinkBytesThreshold', 'description': 'Minimum outbound volume after shell-like execution to treat network behavior as meaningful'}

[AN1659] Analytic 1659

Current version: 1.0

	Old Description			New Description
t	1	On Android, the user can review which applications can use p	t	1	For Android, detect Generate Traffic from Victim by correlat
	>	remium SMS features in the "Special access" page within appl		>	ing analyst-visible device/network evidence and management s
	>	ication settings. Application vetting services can detect w		>	tate; use streaming or batched telemetry only where the docu
	>	hen applications request the `SEND_SMS` permission, which sh		>	mented collector is deployed. Correlate API Calls via Applic
	>	ould be infrequently used.		>	ation Vetting / Instrumented Dynamic Analysis [Dynamic API/r
				>	untime trace: SmsManager.sendTextMessage() called by app NOT
				>	IN $ApprovedMessagingApps$]; Network Connection Creation vi
				>	a Android Enterprise Network Logging / Enterprise VPN [Devic
				>	ePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEven
				>	t; VPN flow metadata]; Permissions Request via Android Enter
				>	prise DPC / Application Vetting [DevicePolicyManager.getPerm
				>	issionGrantState(); PackageManager manifest/requested-permis
				>	sion review]. Alert on a sequence or state change inconsiste
				>	nt with the device/app baseline, approved management policy,
				>	or expected user workflow; do not infer unobserved API call
				>	s, file/process activity, or payload content from management
				>	state alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ApprovedMessagingApps', 'description': 'Default SMS, approved messaging apps. Minimal.'}, {'field': 'PremiumNumberPattern', 'description': 'Country-specific premium short code ranges. Derive from carrier/regulatory database. Update per regulatory changes.'}, {'field': 'SMSRateThreshold', 'description': 'Default 5 premium SMS within window. Tightening: 2.'}, {'field': 'SMSWindow', 'description': 'Default 60s.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:42:03.045000+00:00
description	On Android, the user can review which applications can use premium SMS features in the "Special access" page within application settings. Application vetting services can detect when applications request the `SEND_SMS` permission, which should be infrequently used.	For Android, detect Generate Traffic from Victim by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: SmsManager.sendTextMessage() called by app NOT IN $ApprovedMessagingApps$]; Network Connection Creation via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]; Permissions Request via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--56c2b384-77f8-461f-a71a-76f7888ebfb6', 'name': 'User Interface', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: SmsManager.sendTextMessage() called by app NOT IN $ApprovedMessagingApps$'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'Application Vetting', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba', 'name': 'android:EnterpriseNetworkLog', 'channel': 'DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--e2f72131-14d1-411f-8e8c-aa3453dd5456', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}

[AN1660] Analytic 1660

Current version: 1.0

	Old Description			New Description
t	1	On Android, the user can review which applications can use p	t	1	For iOS, detect Generate Traffic from Victim by correlating
	>	remium SMS features in the "Special access" page within appl		>	analyst-visible device/network evidence and management state
	>	ication settings. Application vetting services can detect w		>	; use streaming or batched telemetry only where the document
	>	hen applications request the `SEND_SMS` permission, which sh		>	ed collector is deployed. Correlate Application State via Ap
	>	ould be infrequently used.		>	ple MDM [InstalledApplicationList / ManagedApplicationList];
				>	Network Connection Creation via Apple Network Extension / E
				>	nterprise VPN [NEFilterFlow / per-app VPN / secure-web-gatew
				>	ay flow metadata]; Network Traffic Flow via Apple Network Ex
				>	tension / Enterprise VPN [NEFilterFlow / per-app VPN / secur
				>	e-web-gateway flow metadata]. Alert on a sequence or state c
				>	hange inconsistent with the device/app baseline, approved ma
				>	nagement policy, or expected user workflow; do not infer uno
				>	bserved API calls, file/process activity, or payload content
				>	from management state alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'AdNetworkDomainList', 'description': 'Known ad network FQDNs. Derive from ad industry DNS data.'}, {'field': 'HTTPRateThreshold', 'description': 'Default 100 requests/60s — above human interaction rate. Derive from legitimate app baseline.'}, {'field': 'FraudWindow', 'description': 'Default 60s.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:42:03.819000+00:00
description	On Android, the user can review which applications can use premium SMS features in the "Special access" page within application settings. Application vetting services can detect when applications request the `SEND_SMS` permission, which should be infrequently used.	For iOS, detect Generate Traffic from Victim by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application State via Apple MDM [InstalledApplicationList / ManagedApplicationList]; Network Connection Creation via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]; Network Traffic Flow via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--56c2b384-77f8-461f-a71a-76f7888ebfb6', 'name': 'User Interface', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'iOS:MDM', 'channel': 'InstalledApplicationList / ManagedApplicationList'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'Application Vetting', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba', 'name': 'iOS:NetworkExtension', 'channel': 'NEFilterFlow / per-app VPN / secure-web-gateway flow metadata'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'iOS:NetworkExtension', 'channel': 'NEFilterFlow / per-app VPN / secure-web-gateway flow metadata'}

[AN1661] Analytic 1661

Current version: 1.0

	Old Description			New Description
t	1	Unexpected behavior from an application could be an indicato	t	1	For Android, detect Match Legitimate Name or Location from d
	>	r of masquerading. Application vetting services may potentia		>	ocumented management, network, or vetting evidence; treat st
	>	lly determine if an application contains suspicious code and		>	ate queries as periodic observations rather than real-time e
	>	/or metadata.		>	vents. Correlate Application Permission via Android Enterpri
				>	se DPC / Application Vetting [DevicePolicyManager.getPermiss
				>	ionGrantState(); PackageManager manifest/requested-permissio
				>	n review]; File Creation via Application Vetting / Forensic
				>	Acquisition [Dynamic filesystem trace or acquired app-contai
				>	ner/filesystem artifacts: PackageInstaller.install() writes
				>	binary to device storage for impersonating app — install eve
				>	nt is the enrollment of impersonating app]; File Metadata vi
				>	a Application Vetting / Forensic Acquisition [Dynamic filesy
				>	stem trace or acquired app-container/filesystem artifacts: a
				>	pp package_name distance <= $NameDistanceThreshold$ from $Kn
				>	ownAppCatalog$ entry]. Alert on a sequence or state change i
				>	nconsistent with the device/app baseline, approved managemen
				>	t policy, or expected user workflow; do not infer unobserved
				>	API calls, file/process activity, or payload content from m
				>	anagement state alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'NameDistanceThreshold', 'description': 'Default Levenshtein 2. Same as T1655 parent.'}, {'field': 'KnownAppCatalog', 'description': 'MDM-approved catalog with cert fingerprints.'}, {'field': 'IconHashThreshold', 'description': 'Default perceptual hash distance < 10.'}, {'field': 'MDMApprovedCatalog', 'description': 'MDM-managed app list.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:42:08.422000+00:00
description	Unexpected behavior from an application could be an indicator of masquerading. Application vetting services may potentially determine if an application contains suspicious code and/or metadata.	For Android, detect Match Legitimate Name or Location from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; File Creation via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: PackageInstaller.install() writes binary to device storage for impersonating app — install event is the enrollment of impersonating app]; File Metadata via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: app package_name distance <= $NameDistanceThreshold$ from $KnownAppCatalog$ entry]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--bf0ff551-a5a7-40e5-bff9-f9405011b1f4', 'name': 'User Interface', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'Application Vetting', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: PackageInstaller.install() writes binary to device storage for impersonating app — install event is the enrollment of impersonating app'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--639e87f3-acb6-448a-9645-258f20da4bc5', 'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: app package_name distance <= $NameDistanceThreshold$ from $KnownAppCatalog$ entry'}

[AN1662] Analytic 1662

Current version: 1.0

	Old Description			New Description
t	1	Unexpected behavior from an application could be an indicato	t	1	For iOS, detect Match Legitimate Name or Location by correla
	>	r of masquerading. Application vetting services may potentia		>	ting analyst-visible device/network evidence and management
	>	lly determine if an application contains suspicious code and		>	state; use streaming or batched telemetry only where the doc
	>	/or metadata.		>	umented collector is deployed. Correlate Application Permiss
				>	ion via Application Vetting [Code-signing entitlements and I
				>	nfo.plist privacy usage-description keys]; File Metadata via
				>	Application Vetting / Forensic Acquisition [Dynamic filesys
				>	tem trace or acquired app-container/filesystem artifacts: di
				>	splay_name Levenshtein distance <= $NameDistanceThreshold$ f
				>	rom $KnownIOSAppCatalog$ entry]; Network Traffic Flow via Ap
				>	ple Network Extension / Enterprise VPN [NEFilterFlow / per-a
				>	pp VPN / secure-web-gateway flow metadata]. Alert on a seque
				>	nce or state change inconsistent with the device/app baselin
				>	e, approved management policy, or expected user workflow; do
				>	not infer unobserved API calls, file/process activity, or p
				>	ayload content from management state alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'NameDistanceThreshold', 'description': 'Default Levenshtein distance 2.'}, {'field': 'KnownIOSAppCatalog', 'description': 'Enterprise app display names + Apple system app names.'}, {'field': 'ImpersonatedAppPermissionProfile', 'description': 'Permission set of each known app that could be impersonated. Derive from MDM catalog.'}, {'field': 'ImpersonatedAppCDN', 'description': 'Known CDN for each enterprise app that could be impersonated.'}, {'field': 'PostInstallWindow', 'description': 'Default 3600s after install.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:42:09.093000+00:00
description	Unexpected behavior from an application could be an indicator of masquerading. Application vetting services may potentially determine if an application contains suspicious code and/or metadata.	For iOS, detect Match Legitimate Name or Location by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]; File Metadata via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: display_name Levenshtein distance <= $NameDistanceThreshold$ from $KnownIOSAppCatalog$ entry]; Network Traffic Flow via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--bf0ff551-a5a7-40e5-bff9-f9405011b1f4', 'name': 'User Interface', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'mobile:ApplicationVetting', 'channel': 'Code-signing entitlements and Info.plist privacy usage-description keys'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'Application Vetting', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--639e87f3-acb6-448a-9645-258f20da4bc5', 'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: display_name Levenshtein distance <= $NameDistanceThreshold$ from $KnownIOSAppCatalog$ entry'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'iOS:NetworkExtension', 'channel': 'NEFilterFlow / per-app VPN / secure-web-gateway flow metadata'}

[AN1663] Analytic 1663

Current version: 1.1

	Old Description			New Description
t	1	The defender correlates repeated or periodic app-attributed	t	1	For Android, detect One-Way Communication by correlating ana
	>	retrieval from a legitimate public web-service platform with		>	lyst-visible device/network evidence and management state; u
	>	runtime conditions showing that the retrieval is not aligne		>	se streaming or batched telemetry only where the documented
	>	d to normal foreground consumption, user interaction, or app		>	collector is deployed. Correlate Application Permission via
	>	roved app role. The strongest Android evidence is a managed		>	Android Enterprise DPC / Application Vetting [DevicePolicyMa
	>	or installed app repeatedly issuing inbound-oriented GET, fe		>	nager.getPermissionGrantState(); PackageManager manifest/req
	>	tch, sync, or content-pull operations to social, collaborati		>	uested-permission review]; Application State via Android Ent
	>	on, paste, code-hosting, cloud-storage, messaging, or generi		>	erprise / EMM [Managed package inventory/status and package
	>	c HTTPS platforms while the app is backgrounded, while the d		>	metadata]; Network Traffic Content via Enterprise Secure Web
	>	evice is locked, or without recent user interaction, and wit		>	Gateway / Proxy [DNS/HTTP(S) inspection or proxy transactio
	>	hout a corresponding outbound writeback to that same service		>	n metadata where enterprise decryption/inspection is deploye
	>	class during the operational window. The detection is stren		>	d]. Alert on a sequence or state change inconsistent with th
	>	gthened when the retrieval is temporally adjacent to schedul		>	e device/app baseline, approved management policy, or expect
	>	ed/background execution, local state changes, or later downs		>	ed user workflow; do not infer unobserved API calls, file/pr
	>	tream effects that do not require the same public platform t		>	ocess activity, or payload content from management state alo
	>	o receive output.		>	ne.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.382000+00:00	2026-10-13 17:40:46.919000+00:00
description	The defender correlates repeated or periodic app-attributed retrieval from a legitimate public web-service platform with runtime conditions showing that the retrieval is not aligned to normal foreground consumption, user interaction, or approved app role. The strongest Android evidence is a managed or installed app repeatedly issuing inbound-oriented GET, fetch, sync, or content-pull operations to social, collaboration, paste, code-hosting, cloud-storage, messaging, or generic HTTPS platforms while the app is backgrounded, while the device is locked, or without recent user interaction, and without a corresponding outbound writeback to that same service class during the operational window. The detection is strengthened when the retrieval is temporally adjacent to scheduled/background execution, local state changes, or later downstream effects that do not require the same public platform to receive output.	For Android, detect One-Way Communication by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; Application State via Android Enterprise / EMM [Managed package inventory/status and package metadata]; Network Traffic Content via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[1]	{'field': 'AllowedAppList', 'description': 'Approved app identities vary by organization, role, and device group.'}	{'field': 'PollingIntervalThreshold', 'description': 'Default 900s (15 min) maximum interval between fetches to same platform from background. More frequent background polling without user activity = C2 check-in.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'VPN:MobileProxy', 'channel': 'App-attributed HTTP GET, content fetch, sync pull, or inbound-oriented HTTPS session to public web-service domain recurred within TimeWindow without app-attributed POST, PUT, PATCH, upload, comment, message send, or API write to same service class'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindow', 'description': 'Correlation window used to evaluate recurring retrieval and absence of same-service writeback.'}	{'field': 'ApprovedPlatformApps', 'description': 'Apps approved for periodic read access to each platform. News readers (RSS/social), weather apps — legitimate pollers. Unknown apps periodically polling paste/code platforms are anomalous.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'VPN:MobileProxy', 'channel': 'Repeated app-attributed retrieval from same public web-service domain or API endpoint occurred at stable recurrence interval with low outbound volume relative to inbound content'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'android:EMM', 'channel': 'Managed package inventory/status and package metadata'}
x_mitre_mutable_elements[2]	{'field': 'AllowedServiceClasses', 'description': 'Some apps legitimately retrieve content from collaboration, messaging, storage, or code-hosting services.'}	{'field': 'CommandProcessWindow', 'description': 'Default 30s between platform content retrieval and behavioral change (new connection, file write). Command processing is near-synchronous.'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'VPN:MobileProxy', 'channel': 'Inbound content retrieval from public web-service domain occurred without subsequent writeback to same service class and was followed by local or downstream activity outside normal app sync profile'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'webproxy:applog', 'channel': 'DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'MobileEDR:telemetry', 'channel': 'AppState=background when repeated retrieval from public web-service domain began and no foreground transition occurred during the retrieval sequence'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'MobileEDR:telemetry', 'channel': 'DeviceLockState=locked during repeated inbound retrieval sequence from public web-service platform'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'MobileEDR:telemetry', 'channel': 'LastUserInteractionDelta exceeded threshold before repeated retrieval sequence from public web-service domain from same app identity'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:MDMLog', 'channel': 'App identity performing repeated one-way retrieval was unmanaged, outside approved app baseline, or not permitted to use detected public web-service class for background content retrieval'}
x_mitre_mutable_elements	{'field': 'AllowedReadOnlyMappings', 'description': 'Defines which apps are expected to only retrieve, and under what foreground/background conditions.'}
x_mitre_mutable_elements	{'field': 'RecentUserInteractionWindow', 'description': 'Defines how close retrieval must be to user activity to be considered expected'}
x_mitre_mutable_elements	{'field': 'BeaconIntervalTolerance', 'description': 'Allowed recurrence interval for benign refresh, sync, or polling behavior differs by app category'}
x_mitre_mutable_elements	{'field': 'ForegroundStateRequired', 'description': 'Some apps should only retrieve from certain public service classes while foregrounded'}
x_mitre_mutable_elements	{'field': 'InboundOutboundRatioThreshold', 'description': 'Expected ratio of inbound to outbound bytes for benign app refresh behavior varies by workload.'}

[AN1664] Analytic 1664

Current version: 1.1

	Old Description			New Description
t	1	The defender correlates repeated retrieval-oriented communic	t	1	For iOS, detect One-Way Communication by correlating analyst
	>	ation from a supervised device or managed iOS app to a legit		>	-visible device/network evidence and management state; use s
	>	imate public web-service platform where the activity remains		>	treaming or batched telemetry only where the documented coll
	>	primarily inbound and does not produce corresponding writeb		>	ector is deployed. Correlate Application Permission via Appl
	>	ack to that same service class during the operational window		>	ication Vetting [Code-signing entitlements and Info.plist pr
	>	. The strongest iOS evidence is managed-app or device-attrib		>	ivacy usage-description keys]; Application State via Apple M
	>	uted communication to collaboration, social, messaging, stor		>	DM [InstalledApplicationList / ManagedApplicationList]; Netw
	>	age, or generic HTTPS platforms where inbound fetches or con		>	ork Traffic Content via Enterprise Secure Web Gateway / Prox
	>	tent pulls recur during background refresh, while the device		>	y [DNS/HTTP(S) inspection or proxy transaction metadata wher
	>	is locked, or without recent user interaction, and no match		>	e enterprise decryption/inspection is deployed]. Alert on a
	>	ing POST, upload, update, or message-send activity to that s		>	sequence or state change inconsistent with the device/app ba
	>	ame public service class is observed. Because direct local r		>	seline, approved management policy, or expected user workflo
	>	untime visibility is weaker than Android, the primary analyt		>	w; do not infer unobserved API calls, file/process activity,
	>	ic is anchored on network directionality plus supervised man		>	or payload content from management state alone.
	>	aged-app and device-state context.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.383000+00:00	2026-10-13 17:40:47.482000+00:00
description	The defender correlates repeated retrieval-oriented communication from a supervised device or managed iOS app to a legitimate public web-service platform where the activity remains primarily inbound and does not produce corresponding writeback to that same service class during the operational window. The strongest iOS evidence is managed-app or device-attributed communication to collaboration, social, messaging, storage, or generic HTTPS platforms where inbound fetches or content pulls recur during background refresh, while the device is locked, or without recent user interaction, and no matching POST, upload, update, or message-send activity to that same public service class is observed. Because direct local runtime visibility is weaker than Android, the primary analytic is anchored on network directionality plus supervised managed-app and device-state context.	For iOS, detect One-Way Communication by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]; Application State via Apple MDM [InstalledApplicationList / ManagedApplicationList]; Network Traffic Content via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[1]	{'field': 'SupervisedRequired', 'description': 'Strongest app-governance and bundle-baseline analytics depend on supervised iOS devices.'}	{'field': 'PollingIntervalThreshold', 'description': 'Default 900s (15 min) maximum interval between fetches to same platform from background. More frequent background polling without user activity = C2 check-in.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'VPN:MobileProxy', 'channel': 'App-attributed HTTP GET, content fetch, sync pull, or inbound-oriented HTTPS session to public web-service domain recurred within TimeWindow without app-attributed POST, PUT, PATCH, upload, comment, message send, or API write to same service class'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'mobile:ApplicationVetting', 'channel': 'Code-signing entitlements and Info.plist privacy usage-description keys'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindow', 'description': 'Correlation window used to evaluate recurring retrieval and absence of same-service writeback.'}	{'field': 'ApprovedPlatformApps', 'description': 'Apps approved for periodic read access to each platform. News readers (RSS/social), weather apps — legitimate pollers. Unknown apps periodically polling paste/code platforms are anomalous.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'VPN:MobileProxy', 'channel': 'Repeated app-attributed retrieval from same public web-service domain or API endpoint occurred at stable recurrence interval with low outbound volume relative to inbound content'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'iOS:MDM', 'channel': 'InstalledApplicationList / ManagedApplicationList'}
x_mitre_mutable_elements[2]	{'field': 'AllowedManagedApps', 'description': 'Approved managed bundle identities vary by organization and device profile.'}	{'field': 'CommandProcessWindow', 'description': 'Default 30s between platform content retrieval and behavioral change (new connection, file write). Command processing is near-synchronous.'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'VPN:MobileProxy', 'channel': 'Inbound content retrieval from public web-service domain occurred without subsequent writeback to same service class and was followed by local or downstream activity outside normal app sync profile'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'webproxy:applog', 'channel': 'DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'MobileEDR:telemetry', 'channel': 'DeviceLockState=locked during repeated inbound retrieval sequence from public web-service platform'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'MobileEDR:telemetry', 'channel': 'LastUserInteractionDelta exceeded threshold before repeated retrieval sequence from public web-service domain from same app identity'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'iOS:MDMLog', 'channel': 'Bundle performing repeated one-way retrieval was not present in approved managed-app baseline or was not permitted to use detected public web-service class for background content retrieval'}
x_mitre_mutable_elements	{'field': 'AllowedServiceClasses', 'description': 'Some managed apps legitimately retrieve content from storage, collaboration, or messaging services.'}
x_mitre_mutable_elements	{'field': 'AllowedReadOnlyMappings', 'description': 'Defines which bundles are expected to retrieve without writeback, and in what context.'}
x_mitre_mutable_elements	{'field': 'BackgroundRefreshBaseline', 'description': 'Expected background retrieval behavior differs across managed app categories.'}
x_mitre_mutable_elements	{'field': 'RecentUserInteractionWindow', 'description': 'Defines how close retrieval must be to user activity to be considered expected.'}
x_mitre_mutable_elements	{'field': 'BeaconIntervalTolerance', 'description': 'Allowed recurrence interval for benign refresh, polling, or sync behavior differs by bundle type.'}
x_mitre_mutable_elements	{'field': 'InboundOutboundRatioThreshold', 'description': 'Expected ratio of inbound to outbound bytes for benign managed-app refresh behavior varies by workflow.'}

[AN1665] Analytic 1665

Current version: 1.1

	Old Description			New Description
t	1	An application is granted or maintains notification listener	t	1	For Android, detect Access Notifications from documented man
	>	access, observes notification content from other applicatio		>	agement, network, or vetting evidence; treat state queries a
	>	ns (including sensitive sources such as SMS/email/2FA apps),		>	s periodic observations rather than real-time events. Correl
	>	processes or stores notification payloads, and optionally s		>	ate Application Permission via Android Enterprise DPC / Appl
	>	uppresses or programmatically interacts with notifications (		>	ication Vetting [DevicePolicyManager.getPermissionGrantState
	>	dismiss/action triggers) without corresponding foreground us		>	(); PackageManager manifest/requested-permission review]; Ap
	>	er interaction. Detection correlates special access permissi		>	plication State via Android Enterprise / EMM [Managed packag
	>	on state + notification event interception + application bac		>	e inventory/status and package metadata]; OS API Execution v
	>	kground state + downstream data use (local write or network		>	ia Application Vetting / Instrumented Dynamic Analysis [Dyna
	>	transmission).		>	mic API/runtime trace: App intercepts notification content f
				>	rom source_app IN $HighValueNotifApps$ (banking, auth, messa
				>	ging) while AppState=background]. Alert on a sequence or sta
				>	te change inconsistent with the device/app baseline, approve
				>	d management policy, or expected user workflow; do not infer
				>	unobserved API calls, file/process activity, or payload con
				>	tent from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.377000+00:00	2026-10-13 17:42:30.968000+00:00
description	An application is granted or maintains notification listener access, observes notification content from other applications (including sensitive sources such as SMS/email/2FA apps), processes or stores notification payloads, and optionally suppresses or programmatically interacts with notifications (dismiss/action triggers) without corresponding foreground user interaction. Detection correlates special access permission state + notification event interception + application background state + downstream data use (local write or network transmission).	For Android, detect Access Notifications from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; Application State via Android Enterprise / EMM [Managed package inventory/status and package metadata]; OS API Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: App intercepts notification content from source_app IN $HighValueNotifApps$ (banking, auth, messaging) while AppState=background]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[1]	{'field': 'AllowedAppList', 'description': 'Enterprise-approved apps with legitimate notification access (e.g., accessibility tools, wearables)'}	{'field': 'HighValueNotifApps', 'description': 'Banking, 2FA authenticator, enterprise email, SMS apps whose notification content contains OTPs or credentials. Derive from MDM app catalog by data-sensitivity tier.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:MDMLog', 'channel': 'NotificationListenerService enabled OR notification access granted to app not in enterprise-approved list'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindow', 'description': 'Correlation window between notification interception and subsequent data write or network transmission varies by app behavior'}	{'field': 'NotificationAllowList', 'description': 'Approved notification management apps (Tasker-equivalent enterprise tools, approved wearable companions). Minimal. Derive from MDM catalog.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': 'App intercepts notification content from external package (e.g., messaging/auth apps) while in background OR without recent user interaction'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'android:EMM', 'channel': 'Managed package inventory/status and package metadata'}
x_mitre_mutable_elements[2]	{'field': 'ForegroundStateRequired', 'description': 'Whether notification access is expected only when the app is foregrounded'}	{'field': 'InteractionThreshold', 'description': 'Default 300s. Notification interception >5min after last user interaction with device locked = covert.'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'MobileEDR:telemetry', 'channel': 'Notification access event occurs while app_state=background AND device_state=locked OR no recent user interaction'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App intercepts notification content from source_app IN $HighValueNotifApps$ (banking, auth, messaging) while AppState=background'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_mutable_elements	{'field': 'UplinkBytesThreshold', 'description': 'Threshold for small outbound payloads indicative of notification content exfiltration'}
x_mitre_mutable_elements	{'field': 'SensitiveSourceApps', 'description': 'Apps whose notifications are considered sensitive (SMS, email, authenticator apps)'}

[AN1666] Analytic 1666

Current version: 1.1

	Old Description			New Description
t	1	The defender correlates Android accessibility or UI-automati	t	1	For Android, detect Input Injection from documented manageme
	>	on-capable behavior from an app identity with injected user-		>	nt, network, or vetting evidence; treat state queries as per
	>	interface actions occurring on behalf of the user in another		>	iodic observations rather than real-time events. Correlate A
	>	foreground application. The strongest Android evidence is a		>	pplication State via Android Enterprise / EMM [Managed packa
	>	ccessibility-enabled or similarly privileged app behavior th		>	ge inventory/status and package metadata]; OS API Execution
	>	at triggers programmatic clicks, global actions, or text ins		>	via Application Vetting / Instrumented Dynamic Analysis [Dyn
	>	ertion into another app's active UI, especially when those a		>	amic API/runtime trace: Accessibility-enabled app NOT IN $Ac
	>	ctions occur without matching user touch interaction, while		>	cessibilityAllowList$ invokes performAction() click, global
	>	the injecting app is backgrounded or foreground-service-only		>	action (GLOBAL_ACTION_BACK/HOME/RECENTS), or insertText() on
	>	, or when the target foreground app belongs to a sensitive c		>	a UI element belonging to a different foregrounded app — cr
	>	ategory such as banking, payments, identity, communications,		>	oss-app UI action is the]. Alert on a sequence or state chan
	>	or enterprise access. The detection is strengthened when th		>	ge inconsistent with the device/app baseline, approved manag
	>	e injected input sequence is followed by target-app navigati		>	ement policy, or expected user workflow; do not infer unobse
	>	on, form submission, transaction progression, or network act		>	rved API calls, file/process activity, or payload content fr
	>	ivity from the target context.		>	om management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.382000+00:00	2026-10-13 17:42:30.229000+00:00
description	The defender correlates Android accessibility or UI-automation-capable behavior from an app identity with injected user-interface actions occurring on behalf of the user in another foreground application. The strongest Android evidence is accessibility-enabled or similarly privileged app behavior that triggers programmatic clicks, global actions, or text insertion into another app's active UI, especially when those actions occur without matching user touch interaction, while the injecting app is backgrounded or foreground-service-only, or when the target foreground app belongs to a sensitive category such as banking, payments, identity, communications, or enterprise access. The detection is strengthened when the injected input sequence is followed by target-app navigation, form submission, transaction progression, or network activity from the target context.	For Android, detect Input Injection from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Application State via Android Enterprise / EMM [Managed package inventory/status and package metadata]; OS API Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: Accessibility-enabled app NOT IN $AccessibilityAllowList$ invokes performAction() click, global action (GLOBAL_ACTION_BACK/HOME/RECENTS), or insertText() on a UI element belonging to a different foregrounded app — cross-app UI action is the]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[1]	{'field': 'AllowedAppList', 'description': 'Approved accessibility, autofill, remote-assist, or QA/testing apps vary by organization and device group.'}	{'field': 'InjectionInteractionThreshold', 'description': 'Default 5s. UI actions occurring >5s after last detected user touch without expected foreground transition are injection-driven. Tightening: 2s.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': 'Accessibility-enabled app invoked programmatic click or action on behalf of user while a different app was foregrounded and injected action was not mapped to approved accessibility or autofill workflow'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'android:EMM', 'channel': 'Managed package inventory/status and package metadata'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindow', 'description': 'Correlation window linking injected actions to target-app navigation, submission, or downstream network effects.'}	{'field': 'AccessibilityAllowList', 'description': 'Approved assistive technology apps with legitimate UI automation need. Minimal list. Derive from MDM catalog accessibility policy.'}
x_mitre_mutable_elements[2]	{'field': 'AllowedAccessibilityApps', 'description': 'Approved accessibility-enabled apps vary by assistive and enterprise workflow.'}	{'field': 'TargetAppList', 'description': 'Banking, enterprise SSO, authentication, payment app packages. Injections against these raise confidence from Medium to High.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': 'Accessibility-enabled app invoked global action such as back, home, recents, or navigation control while target foreground app context changed within TimeWindow'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Accessibility-enabled app NOT IN $AccessibilityAllowList$ invokes performAction() click, global action (GLOBAL_ACTION_BACK/HOME/RECENTS), or insertText() on a UI element belonging to a different foregrounded app — cross-app UI action is the'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': 'Accessibility-enabled app inserted text into active field of different foreground app without user keyboard activity or approved autofill relationship'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'MobileEDR:telemetry', 'channel': 'Injecting app remained backgrounded or foreground-service-only while injected click, global action, or text insertion occurred in a different foreground app'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'MobileEDR:telemetry', 'channel': 'LastUserInteractionDelta exceeded threshold before injected UI action and no matching touch interaction was observed for the target foreground app during injection sequence'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'MobileEDR:telemetry', 'channel': 'Sensitive app category remained foregrounded during injected UI sequence from different app identity'}
x_mitre_mutable_elements	{'field': 'AllowedAutofillApps', 'description': 'Approved password managers or autofill-capable apps may legitimately inject text into fields.'}
x_mitre_mutable_elements	{'field': 'RecentUserInteractionWindow', 'description': 'Defines how close an injected action must be to user interaction to be considered expected.'}
x_mitre_mutable_elements	{'field': 'SensitiveForegroundAppCategories', 'description': 'Categories such as banking, payments, identity, communications, and enterprise access may warrant higher sensitivity.'}
x_mitre_mutable_elements	{'field': 'GlobalActionBurstThreshold', 'description': 'Threshold for repeated programmatic global actions within a short window.'}
x_mitre_mutable_elements	{'field': 'TextInjectionLengthThreshold', 'description': 'Minimum inserted text length or field-population pattern considered suspicious outside approved autofill workflows.'}
x_mitre_mutable_elements	{'field': 'ConsentOrSetupGracePeriod', 'description': 'Grace period allowed after explicit user enablement of approved accessibility or autofill workflows before injection is treated as suspicious.'}

[AN1667] Analytic 1667

Current version: 1.0

	Old Description			New Description
t	1	Monitor for pseudo-randomly generated domain names based on	t	1	For Android, detect Dynamic Resolution by correlating analys
	>	frequency analysis, Markov chains, entropy, proportion of di		>	t-visible device/network evidence and management state; use
	>	ctionary words, ratio of vowels to other characters, and mor		>	streaming or batched telemetry only where the documented col
	>	e.(Citation: Data Driven Security DGA) Additionally, check i		>	lector is deployed. Correlate API Calls via Application Vett
	>	f the suspicious domain has been recently registered, if it		>	ing / Instrumented Dynamic Analysis [Dynamic API/runtime tra
	>	has been rarely visited, or if the domain had a spike in act		>	ce: InetAddress.getByName() or DnsResolver called > $DGACand
	>	ivity after being dormant.(Citation: unit42_strat_aged_domai		>	idateThreshold$ times with algorithmically-distinct hostname
	>	n_det) Content delivery network (CDN) domains may trigger th		>	s in $DGAWindow$ — rapid programmatic resolution attempts];
	>	ese detections due to the format of their domain names.		>	Network Connection Creation via Android Enterprise Network L
				>	ogging / Enterprise VPN [DevicePolicyManager.retrieveNetwork
				>	Logs(): DnsEvent / ConnectEvent; VPN flow metadata]; Network
				>	Traffic Flow via Android Enterprise Network Logging / Enter
				>	prise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEve
				>	nt / ConnectEvent; VPN flow metadata]. Alert on a sequence o
				>	r state change inconsistent with the device/app baseline, ap
				>	proved management policy, or expected user workflow; do not
				>	infer unobserved API calls, file/process activity, or payloa
				>	d content from management state alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'NXDOMAINThreshold', 'description': 'Default 20 per device per app within window. Tightening: 10. Derive from per-app DNS baseline.'}, {'field': 'DGAWindow', 'description': 'Default 60s.'}, {'field': 'DGASuccessWindow', 'description': 'Default 30s between last NXDOMAIN and successful resolution.'}, {'field': 'AppBaselineDomains', 'description': 'Per-app known CDN/update domains from 30-day baseline.'}, {'field': 'DGACandidateThreshold', 'description': 'Default 10 distinct hostname queries within window.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:41:53.964000+00:00
description	Monitor for pseudo-randomly generated domain names based on frequency analysis, Markov chains, entropy, proportion of dictionary words, ratio of vowels to other characters, and more.(Citation: Data Driven Security DGA) Additionally, check if the suspicious domain has been recently registered, if it has been rarely visited, or if the domain had a spike in activity after being dormant.(Citation: unit42_strat_aged_domain_det) Content delivery network (CDN) domains may trigger these detections due to the format of their domain names.	For Android, detect Dynamic Resolution by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: InetAddress.getByName() or DnsResolver called > $DGACandidateThreshold$ times with algorithmically-distinct hostnames in $DGAWindow$ — rapid programmatic resolution attempts]; Network Connection Creation via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]; Network Traffic Flow via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--764ee29e-48d6-4934-8e6b-7a606aaaafc0', 'name': 'Application Vetting', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: InetAddress.getByName() or DnsResolver called > $DGACandidateThreshold$ times with algorithmically-distinct hostnames in $DGAWindow$ — rapid programmatic resolution attempts'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba', 'name': 'android:EnterpriseNetworkLog', 'channel': 'DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata'}
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'android:EnterpriseNetworkLog', 'channel': 'DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata'}

[AN1668] Analytic 1668

Current version: 1.0

	Old Description			New Description
t	1	Monitor for pseudo-randomly generated domain names based on	t	1	For iOS, detect Dynamic Resolution by correlating analyst-vi
	>	frequency analysis, Markov chains, entropy, proportion of di		>	sible device/network evidence and management state; use stre
	>	ctionary words, ratio of vowels to other characters, and mor		>	aming or batched telemetry only where the documented collect
	>	e.(Citation: Data Driven Security DGA) Additionally, check i		>	or is deployed. Correlate Application Permission via Applica
	>	f the suspicious domain has been recently registered, if it		>	tion Vetting [Code-signing entitlements and Info.plist priva
	>	has been rarely visited, or if the domain had a spike in act		>	cy usage-description keys]; Network Connection Creation via
	>	ivity after being dormant.(Citation: unit42_strat_aged_domai		>	Apple Network Extension / Enterprise VPN [NEFilterFlow / per
	>	n_det) Content delivery network (CDN) domains may trigger th		>	-app VPN / secure-web-gateway flow metadata]; Network Traffi
	>	ese detections due to the format of their domain names.		>	c Flow via Apple Network Extension / Enterprise VPN [NEFilte
				>	rFlow / per-app VPN / secure-web-gateway flow metadata]. Ale
				>	rt on a sequence or state change inconsistent with the devic
				>	e/app baseline, approved management policy, or expected user
				>	workflow; do not infer unobserved API calls, file/process a
				>	ctivity, or payload content from management state alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'MDMApprovedCatalog', 'description': 'MDM-managed app list.'}, {'field': 'NXDOMAINThreshold', 'description': 'Default 20 per device within window. Derive from per-device DNS baseline.'}, {'field': 'DGAWindow', 'description': 'Default 60s.'}, {'field': 'AppBaselineDomains', 'description': 'Per-app network destination baseline, 30-day.'}, {'field': 'DGASuccessWindow', 'description': 'Default 30s between last NXDOMAIN and successful resolution.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:41:54.592000+00:00
description	Monitor for pseudo-randomly generated domain names based on frequency analysis, Markov chains, entropy, proportion of dictionary words, ratio of vowels to other characters, and more.(Citation: Data Driven Security DGA) Additionally, check if the suspicious domain has been recently registered, if it has been rarely visited, or if the domain had a spike in activity after being dormant.(Citation: unit42_strat_aged_domain_det) Content delivery network (CDN) domains may trigger these detections due to the format of their domain names.	For iOS, detect Dynamic Resolution by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]; Network Connection Creation via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]; Network Traffic Flow via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--764ee29e-48d6-4934-8e6b-7a606aaaafc0', 'name': 'Application Vetting', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'mobile:ApplicationVetting', 'channel': 'Code-signing entitlements and Info.plist privacy usage-description keys'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba', 'name': 'iOS:NetworkExtension', 'channel': 'NEFilterFlow / per-app VPN / secure-web-gateway flow metadata'}
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'iOS:NetworkExtension', 'channel': 'NEFilterFlow / per-app VPN / secure-web-gateway flow metadata'}

[AN1669] Analytic 1669

Current version: 1.1

	Old Description			New Description
t	1	A defender correlates navigation to external web content in	t	1	For Android, detect Drive-By Compromise by correlating analy
	>	a browser or embedded WebView with immediate script-heavy or		>	st-visible device/network evidence and management state; use
	>	exploit-preparation network activity, followed by abnormal		>	streaming or batched telemetry only where the documented co
	>	browser/WebView process behavior, suspicious file or downloa		>	llector is deployed. Correlate File Creation via Application
	>	d artifacts, or rapid post-visit capability shifts such as n		>	Vetting / Forensic Acquisition [Dynamic filesystem trace or
	>	ew package install attempts, overlay prompts, permission req		>	acquired app-container/filesystem artifacts: open() with O_
	>	uests, or outbound command traffic inconsistent with normal		>	CREAT for APK or binary file in /sdcard/ or /data/local/tmp/
	>	browsing.		>	by browser process within $DriveByWindow$ — payload drop co
				>	nfirms exploit code execution]; Network Traffic Content via
				>	Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspectio
				>	n or proxy transaction metadata where enterprise decryption/
				>	inspection is deployed]; Process Creation via Application Ve
				>	tting / Managed Device Telemetry [execve()]. Alert on a sequ
				>	ence or state change inconsistent with the device/app baseli
				>	ne, approved management policy, or expected user workflow; d
				>	o not infer unobserved API calls, file/process activity, or
				>	payload content from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.376000+00:00	2026-10-13 17:41:32.626000+00:00
description	A defender correlates navigation to external web content in a browser or embedded WebView with immediate script-heavy or exploit-preparation network activity, followed by abnormal browser/WebView process behavior, suspicious file or download artifacts, or rapid post-visit capability shifts such as new package install attempts, overlay prompts, permission requests, or outbound command traffic inconsistent with normal browsing.	For Android, detect Drive-By Compromise by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate File Creation via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: open() with O_CREAT for APK or binary file in /sdcard/ or /data/local/tmp/ by browser process within $DriveByWindow$ — payload drop confirms exploit code execution]; Network Traffic Content via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed]; Process Creation via Application Vetting / Managed Device Telemetry [execve()]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[3]	{'field': 'NewDomainBurstThreshold', 'description': 'Threshold for the number of newly observed domains contacted in a short browsing window.'}	{'field': 'DriveByWindow', 'description': 'Default 30s between URL navigation and process spawn.'}
x_mitre_mutable_elements[1]	{'field': 'AllowedBrowserApps', 'description': 'Allow-list of expected browsers or sanctioned WebView-hosting apps used in the enterprise.'}	{'field': 'DomainAgeDays', 'description': 'Default 30 days. Newly registered domain + browser exploit = high-confidence.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:MDMLog', 'channel': 'New permission prompt, package install attempt, accessibility/overlay special access request, or other post-browse capability escalation following browser/WebView activity'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: open() with O_CREAT for APK or binary file in /sdcard/ or /data/local/tmp/ by browser process within $DriveByWindow$ — payload drop confirms exploit code execution'}
x_mitre_mutable_elements[0]	{'field': 'NavigationToExploitWindow', 'description': 'Time window used to correlate web navigation with redirects, fingerprinting, downloads, or post-visit capability changes.'}	{'field': 'URLReputationThreshold', 'description': 'Default score 50/100. Derive from threat intel feed vendor scoring.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': 'Browser/WebView framework usage indicating external URL load, script execution enablement, file download initiation, intent handoff, or package install prompt sequence'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'webproxy:applog', 'channel': 'DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed'}
x_mitre_mutable_elements[2]	{'field': 'RedirectChainThreshold', 'description': 'Threshold for suspicious number of redirects or cross-domain hops during a single browsing session.'}	{'field': 'KnownBrowserChildren', 'description': 'Renderer, GPU process, browser service workers. Derive from browser process baseline.'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'NSM:Flow', 'channel': 'Application-layer web traffic showing suspicious redirect chains, iframe/ad-tech cascades, user-agent or environment fingerprinting requests, or staged payload retrieval after page visit'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'mobile:DynamicAnalysis', 'channel': 'execve()'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'MobileEDR:telemetry', 'channel': 'Browser/WebView process creates downloaded payloads, temporary files, dropped archives, or unusual cached web artifacts shortly after visiting external content'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'MobileEDR:telemetry', 'channel': 'Browser or WebView-hosting application brought to foreground and navigates to external content, followed by abnormal state transition, crash, restart, or process spawn behavior'}
x_mitre_mutable_elements	{'field': 'DownloadArtifactThreshold', 'description': 'Threshold for suspicious downloaded or cached artifacts created after navigation.'}
x_mitre_mutable_elements	{'field': 'PostVisitCapabilityShiftRequired', 'description': 'Determines whether to require a new install/prompt/permission/overlay event after browsing to raise confidence.'}
x_mitre_mutable_elements	{'field': 'AllowedAdTechDomains', 'description': 'Baseline of normal advertising/CDN/tracking domains to reduce false positives from legitimate browsing.'}

[AN1670] Analytic 1670

Current version: 1.1

	Old Description			New Description
t	1	A defender correlates Safari or embedded web content navigat	t	1	For iOS, detect Drive-By Compromise by correlating analyst-v
	>	ion with short-lived but abnormal web session behavior such		>	isible device/network evidence and management state; use str
	>	as staged redirects, environment fingerprinting, or exploit-		>	eaming or batched telemetry only where the documented collec
	>	preparation fetches, followed by browser/WebView instability		>	tor is deployed. Correlate Network Connection Creation via A
	>	, unusual file handling, profile/download prompts, or near-t		>	pple Network Extension / Enterprise VPN [NEFilterFlow / per-
	>	erm changes in device or application behavior inconsistent w		>	app VPN / secure-web-gateway flow metadata]; Network Traffic
	>	ith normal browsing.		>	Content via Enterprise Secure Web Gateway / Proxy [DNS/HTTP
				>	(S) inspection or proxy transaction metadata where enterpris
				>	e decryption/inspection is deployed]; Process Creation via A
				>	pplication Vetting / Managed Device Telemetry [com.apple.Web
				>	Kit or com.apple.WebContent process fault at level=fault wit
				>	hin $DriveByWindow$ of navigation to flagged URL — kernel fa
				>	ult in WebKit subsystem is the exploit-execution signal]. Al
				>	ert on a sequence or state change inconsistent with the devi
				>	ce/app baseline, approved management policy, or expected use
				>	r workflow; do not infer unobserved API calls, file/process
				>	activity, or payload content from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.383000+00:00	2026-10-13 17:41:33.302000+00:00
description	A defender correlates Safari or embedded web content navigation with short-lived but abnormal web session behavior such as staged redirects, environment fingerprinting, or exploit-preparation fetches, followed by browser/WebView instability, unusual file handling, profile/download prompts, or near-term changes in device or application behavior inconsistent with normal browsing.	For iOS, detect Drive-By Compromise by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Network Connection Creation via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]; Network Traffic Content via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed]; Process Creation via Application Vetting / Managed Device Telemetry [com.apple.WebKit or com.apple.WebContent process fault at level=fault within $DriveByWindow$ of navigation to flagged URL — kernel fault in WebKit subsystem is the exploit-execution signal]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[3]	{'field': 'FingerprintingRequestThreshold', 'description': 'Threshold for suspicious browser/environment enumeration requests during browsing session.'}	{'field': 'SafariBrowsingBaseline', 'description': 'Known CDN/content destinations from 30-day Safari baseline. Derive by measurement.'}
x_mitre_mutable_elements[1]	{'field': 'AllowedBrowserApps', 'description': 'Allow-list of expected browsers and sanctioned embedded web container apps.'}	{'field': 'DomainAgeDays', 'description': 'Default 30 days.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'NSM:Flow', 'channel': 'Application-layer web traffic showing suspicious redirect chains, iframe/ad-tech cascades, user-agent or environment fingerprinting requests, or staged payload retrieval after page visit'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba', 'name': 'iOS:NetworkExtension', 'channel': 'NEFilterFlow / per-app VPN / secure-web-gateway flow metadata'}
x_mitre_mutable_elements[0]	{'field': 'NavigationToExploitWindow', 'description': 'Time window linking Safari/WebView navigation to redirects, downloads, crashes, or post-visit state changes.'}	{'field': 'URLReputationThreshold', 'description': 'Default score 50/100.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'MobileEDR:telemetry', 'channel': 'Browser/WebView process creates downloaded payloads, temporary files, dropped archives, or unusual cached web artifacts shortly after visiting external content'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'webproxy:applog', 'channel': 'DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed'}
x_mitre_mutable_elements[2]	{'field': 'RedirectChainThreshold', 'description': 'Threshold for suspicious redirect depth or cross-domain chaining.'}	{'field': 'DriveByWindow', 'description': 'Default 30s.'}
x_mitre_mutable_elements[4]	{'field': 'DownloadArtifactThreshold', 'description': 'Threshold for suspicious downloaded files, profiles, or cached artifacts created after page visit.'}	{'field': 'PostExploitWindow', 'description': 'Default 60s between WebKit fault and post-exploit connection.'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'MobileEDR:telemetry', 'channel': 'Browser or WebView-hosting application brought to foreground and navigates to external content, followed by abnormal state transition, crash, restart, or process spawn behavior'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'mobile:DynamicAnalysis', 'channel': 'com.apple.WebKit or com.apple.WebContent process fault at level=fault within $DriveByWindow$ of navigation to flagged URL — kernel fault in WebKit subsystem is the exploit-execution signal'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'iOS:MDMLog', 'channel': 'Post-browse configuration profile prompt, managed/unmanaged app handoff anomaly, or compliance-relevant state change shortly after browser activity'}
x_mitre_mutable_elements	{'field': 'PostVisitBehaviorShiftThreshold', 'description': 'Threshold for abnormal changes in app/device behavior after browsing, such as repeated browser crashes or unexpected handoffs.'}
x_mitre_mutable_elements	{'field': 'AllowedAdTechDomains', 'description': 'Baseline of expected ad-tech, CDN, and analytics domains to suppress benign browsing noise.'}

[AN1675] Analytic 1675

Current version: 1.1

	Old Description			New Description
t	1	The defender correlates an app-attributed request to a legit	t	1	For Android, detect Dead Drop Resolver by correlating analys
	>	imate public web platform with a subsequent outbound connect		>	t-visible device/network evidence and management state; use
	>	ion to a newly derived or previously unseen destination with		>	streaming or batched telemetry only where the documented col
	>	in a short time window. The behavior is strengthened when th		>	lector is deployed. Correlate Application Permission via And
	>	e initial request retrieves structured or encoded content fo		>	roid Enterprise DPC / Application Vetting [DevicePolicyManag
	>	llowed by a pivot to a different domain or IP that was not p		>	er.getPermissionGrantState(); PackageManager manifest/reques
	>	reviously contacted by the app, especially when occurring wi		>	ted-permission review]; Application State via Android Enterp
	>	thout user interaction, in background state, or immediately		>	rise / EMM [Managed package inventory/status and package met
	>	after app initialization or scheduled execution. This sequen		>	adata]; Network Traffic Content via Enterprise Secure Web Ga
	>	ce reflects resolver retrieval followed by dynamic C2 resolu		>	teway / Proxy [DNS/HTTP(S) inspection or proxy transaction m
	>	tion.		>	etadata where enterprise decryption/inspection is deployed].
				>	Alert on a sequence or state change inconsistent with the d
				>	evice/app baseline, approved management policy, or expected
				>	user workflow; do not infer unobserved API calls, file/proce
				>	ss activity, or payload content from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.379000+00:00	2026-10-13 17:40:49.193000+00:00
description	The defender correlates an app-attributed request to a legitimate public web platform with a subsequent outbound connection to a newly derived or previously unseen destination within a short time window. The behavior is strengthened when the initial request retrieves structured or encoded content followed by a pivot to a different domain or IP that was not previously contacted by the app, especially when occurring without user interaction, in background state, or immediately after app initialization or scheduled execution. This sequence reflects resolver retrieval followed by dynamic C2 resolution.	For Android, detect Dead Drop Resolver by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; Application State via Android Enterprise / EMM [Managed package inventory/status and package metadata]; Network Traffic Content via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[3]	{'field': 'UserInteractionThreshold', 'description': 'Defines acceptable delay between user interaction and network activity.'}	{'field': 'ResolverPivotWindow', 'description': 'Default 120s between dead-drop fetch and C2 pivot connection. Tightening: 30s — synchronous resolve-then-connect.'}
x_mitre_mutable_elements[1]	{'field': 'NewDomainThreshold', 'description': 'Defines what qualifies as a previously unseen or rare destination for the app or device.'}	{'field': 'ApprovedPlatformApps', 'description': 'Apps approved for each public platform: social media apps for their own platform, productivity apps for their cloud storage. Non-platform apps accessing these platforms in background are anomalous.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'VPN:MobileProxy', 'channel': 'App-attributed HTTP GET or HTTPS session to public web platform (social, paste, collaboration, cloud storage, code-hosting) returned content followed by outbound connection to a different domain or IP within TimeWindow'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}
x_mitre_log_source_references[3]	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'MobileEDR:telemetry', 'channel': 'AppState=background or foreground_service active when resolver retrieval request occurred and pivot connection followed without foreground transition'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Background work scheduler or persistent service triggered the platform retrieval without user interaction'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindow', 'description': 'Maximum allowed time between resolver retrieval and pivot connection (e.g., 5–60 seconds).'}	{'field': 'AppDeclaredCDN', 'description': 'Per-app declared network destinations. Legitimate platform accesses (e.g., Slack app connecting to slack.com) should be in this list. Any platform access outside declared CDN is the dead-drop signal.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'VPN:MobileProxy', 'channel': 'DNS query or TLS SNI for previously unseen domain occurred within TimeWindow after session to legitimate web-service domain from same app identity'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'android:EMM', 'channel': 'Managed package inventory/status and package metadata'}
x_mitre_mutable_elements[2]	{'field': 'AllowedServiceToDestinationMapping', 'description': 'Legitimate mappings between apps and expected downstream services.'}	{'field': 'AppBaselineDomains', 'description': '30-day per-app network destination baseline.'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'VPN:MobileProxy', 'channel': 'Initial session to public web-service domain transferred small response payload followed by connection to new external endpoint with different ASN or domain category'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'webproxy:applog', 'channel': 'DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'MobileEDR:telemetry', 'channel': 'LastUserInteractionDelta exceeded threshold before resolver retrieval and subsequent pivot connection sequence'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': 'Background work scheduler, job execution, or persistent service triggered network request to public web-service followed by second outbound connection within TimeWindow'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:MDMLog', 'channel': 'App initiating resolver→pivot sequence was unmanaged or not authorized to communicate with detected web-service class or external infrastructure'}
x_mitre_mutable_elements	{'field': 'PayloadSizeThreshold', 'description': 'Small resolver responses followed by larger pivot traffic can indicate extraction behavior.'}

[AN1676] Analytic 1676

Current version: 1.1

	Old Description			New Description
t	1	The defender correlates a supervised-device or managed-app r	t	1	For iOS, detect Dead Drop Resolver by correlating analyst-vi
	>	equest to a legitimate web platform with a subsequent connec		>	sible device/network evidence and management state; use stre
	>	tion to a newly derived destination that is not part of the		>	aming or batched telemetry only where the documented collect
	>	expected service interaction. Because iOS has weaker app-lev		>	or is deployed. Correlate Application Permission via Applica
	>	el telemetry, the strongest signal is a network-level sequen		>	tion Vetting [Code-signing entitlements and Info.plist priva
	>	ce where a request to a known public platform is immediately		>	cy usage-description keys]; Application State via Apple MDM
	>	followed by a connection to a different domain or IP, parti		>	[InstalledApplicationList / ManagedApplicationList]; Network
	>	cularly when the device is locked, no recent user interactio		>	Traffic Content via Enterprise Secure Web Gateway / Proxy [
	>	n occurred, and the bundle is not expected to interact with		>	DNS/HTTP(S) inspection or proxy transaction metadata where e
	>	such downstream infrastructure.		>	nterprise decryption/inspection is deployed]. Alert on a seq
				>	uence or state change inconsistent with the device/app basel
				>	ine, approved management policy, or expected user workflow;
				>	do not infer unobserved API calls, file/process activity, or
				>	payload content from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.381000+00:00	2026-10-13 17:40:49.802000+00:00
description	The defender correlates a supervised-device or managed-app request to a legitimate web platform with a subsequent connection to a newly derived destination that is not part of the expected service interaction. Because iOS has weaker app-level telemetry, the strongest signal is a network-level sequence where a request to a known public platform is immediately followed by a connection to a different domain or IP, particularly when the device is locked, no recent user interaction occurred, and the bundle is not expected to interact with such downstream infrastructure.	For iOS, detect Dead Drop Resolver by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]; Application State via Apple MDM [InstalledApplicationList / ManagedApplicationList]; Network Traffic Content via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[3]	{'field': 'BackgroundRefreshBaseline', 'description': 'Expected background network behavior for managed apps.'}	{'field': 'ResolverPivotWindow', 'description': 'Default 120s between dead-drop fetch and C2 pivot connection. Tightening: 30s — synchronous resolve-then-connect.'}
x_mitre_mutable_elements[1]	{'field': 'NewDomainThreshold', 'description': 'Defines rarity or novelty of domain for the device or bundle.'}	{'field': 'ApprovedPlatformApps', 'description': 'Apps approved for each public platform: social media apps for their own platform, productivity apps for their cloud storage. Non-platform apps accessing these platforms in background are anomalous.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'VPN:MobileProxy', 'channel': 'App-attributed HTTP GET or HTTPS session to public web platform (social, paste, collaboration, cloud storage, code-hosting) returned content followed by outbound connection to a different domain or IP within TimeWindow'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'mobile:ApplicationVetting', 'channel': 'Code-signing entitlements and Info.plist privacy usage-description keys'}
x_mitre_log_source_references[3]	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'MobileEDR:telemetry', 'channel': 'LastUserInteractionDelta exceeded threshold before resolver request and pivot connection sequence'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Background task or networking subsystem event immediately before platform retrieval'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindow', 'description': 'Maximum allowed time between resolver retrieval and pivot connection.'}	{'field': 'AppDeclaredCDN', 'description': 'Per-app declared network destinations. Legitimate platform accesses (e.g., Slack app connecting to slack.com) should be in this list. Any platform access outside declared CDN is the dead-drop signal.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'VPN:MobileProxy', 'channel': 'DNS query or TLS SNI for previously unseen domain occurred within TimeWindow after session to legitimate web-service domain from same app identity'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'iOS:MDM', 'channel': 'InstalledApplicationList / ManagedApplicationList'}
x_mitre_mutable_elements[2]	{'field': 'AllowedServiceToDestinationMapping', 'description': 'Expected relationships between apps and external services.'}	{'field': 'AppBaselineDomains', 'description': '30-day per-app network destination baseline.'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'MobileEDR:telemetry', 'channel': 'DeviceLockState=locked or BackgroundRefresh active during resolver→pivot sequence'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'webproxy:applog', 'channel': 'DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'iOS:MDMLog', 'channel': 'Bundle performing resolver→pivot sequence not present in approved managed-app baseline or lacks expected service relationship'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'iOS:unifiedlog', 'channel': 'Background task or networking subsystem event occurred immediately before resolver retrieval and pivot connection sequence'}
x_mitre_mutable_elements	{'field': 'UserInteractionThreshold', 'description': 'Defines acceptable timing between user activity and network requests.'}

[AN1677] Analytic 1677

Current version: 1.1

	Old Description			New Description
t	1	From the defender’s view: an app retrieves opaque code (DEX/	t	1	For Android, detect Download New Code at Runtime by correlat
	>	SO/JAR/JS) over the network or IPC, writes it into an app-wr		>	ing analyst-visible device/network evidence and management s
	>	itable path, optionally performs verification-bypass behavio		>	tate; use streaming or batched telemetry only where the docu
	>	rs (reflection, addJavascriptInterface exposure, or execmem		>	mented collector is deployed. Correlate File Metadata via Ap
	>	friction), and then loads/executes that code via DexClassLoa		>	plication Vetting / Forensic Acquisition [Dynamic filesystem
	>	der/PathClassLoader, dlopen, or WebView bridge invocation wi		>	trace or acquired app-container/filesystem artifacts: app_v
	>	thin a short window. The analytic correlates Network Content		>	ersion in MDM == prior_version while dynamic code load from
	>	→ File Creation/Modification → OS API Execution (loader/sys		>	network is observed — confirms this is not a legitimate upda
	>	call/SELinux friction) → Module Load (DexClassLoader/dlopen)		>	te]; Module Load via Application Vetting / Instrumented Dyna
	>	and, for WebView paths, Application Log signals of JavaScri		>	mic Analysis [Dynamic API/runtime trace: DexClassLoader() or
	>	pt interface attachment.		>	System.load() or WebView.loadUrl(javascript:) called with c
				>	ontent_source='network_download' within $CodeDownloadWindow$
				>	of download event]; Network Connection Creation via Android
				>	Enterprise Network Logging / Enterprise VPN [DevicePolicyMa
				>	nager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN fl
				>	ow metadata]. Alert on a sequence or state change inconsiste
				>	nt with the device/app baseline, approved management policy,
				>	or expected user workflow; do not infer unobserved API call
				>	s, file/process activity, or payload content from management
				>	state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.379000+00:00	2026-10-13 17:41:04.223000+00:00
description	From the defender’s view: an app retrieves opaque code (DEX/SO/JAR/JS) over the network or IPC, writes it into an app-writable path, optionally performs verification-bypass behaviors (reflection, addJavascriptInterface exposure, or execmem friction), and then loads/executes that code via DexClassLoader/PathClassLoader, dlopen, or WebView bridge invocation within a short window. The analytic correlates Network Content → File Creation/Modification → OS API Execution (loader/syscall/SELinux friction) → Module Load (DexClassLoader/dlopen) and, for WebView paths, Application Log signals of JavaScript interface attachment.	For Android, detect Download New Code at Runtime by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate File Metadata via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: app_version in MDM == prior_version while dynamic code load from network is observed — confirms this is not a legitimate update]; Module Load via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: DexClassLoader() or System.load() or WebView.loadUrl(javascript:) called with content_source='network_download' within $CodeDownloadWindow$ of download event]; Network Connection Creation via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'android:logcat', 'channel': 'SELinux AVC for execmem/execute_no_trans/mprotect following recent writes by same UID'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba', 'name': 'android:EnterpriseNetworkLog', 'channel': 'DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata'}
x_mitre_mutable_elements[1]	{'field': 'ContentTypeList', 'description': 'List of MIME types considered ‘code-like’ (octet-stream, zip, java-archive, x-dex, x-sharedlib, javascript).'}	{'field': 'CodeDownloadWindow', 'description': 'Default 120s between download and load event. Tightening: 30s.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'NSM:Flow', 'channel': 'HTTP(S)/QUIC download of executable/opaque content (application/octet-stream, application/zip, application/java-archive, application/x-dex, application/x-sharedlib, text/javascript)'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--639e87f3-acb6-448a-9645-258f20da4bc5', 'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: app_version in MDM == prior_version while dynamic code load from network is observed — confirms this is not a legitimate update'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindowSeconds', 'description': 'Max correlation window between download → write → load (e.g., 10–60s depending on device/workload).'}	{'field': 'AppCDNList', 'description': 'Per-app CDN/update endpoints from 30-day baseline. Tightening: strict list — catches any novel download destination. Derive by measurement.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'android:logcat', 'channel': 'Create/write under /data/data//(files\|cache)/ or /storage/emulated/0/ with extension .dex/.jar/.so/.zip/.tmp/.js and elevated entropy'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--c0a4a086-cc20-4e1e-b7cb-29d99dfa3fb1', 'name': 'mobile:DynamicAnalysis', 'channel': "Dynamic API/runtime trace: DexClassLoader() or System.load() or WebView.loadUrl(javascript:) called with content_source='network_download' within $CodeDownloadWindow$ of download event"}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--c0a4a086-cc20-4e1e-b7cb-29d99dfa3fb1', 'name': 'android:logcat', 'channel': 'DexClassLoader\|PathClassLoader load from app-writable path OR dlopen of a freshly created .so'}
x_mitre_mutable_elements	{'field': 'WritablePathRegex', 'description': 'Regex for app-writable destinations to watch (/data/data//(files\|cache)/, /storage/emulated/0/...).'}
x_mitre_mutable_elements	{'field': 'PayloadEntropyThreshold', 'description': 'Entropy cutoff to flag likely code blobs (e.g., ≥ 7.2).'}
x_mitre_mutable_elements	{'field': 'KnownGoodCDNAllowlist', 'description': 'CDNs/domains expected for legitimate updates to reduce FPs.'}
x_mitre_mutable_elements	{'field': 'KnownGoodLoaderAllowlist', 'description': 'Bundles/libs known to legitimately load from writable paths (dev/test apps).'}
x_mitre_mutable_elements	{'field': 'JSInterfaceNameList', 'description': 'Names of allowed WebView JS interfaces for the org (e.g., analytics only).'}
x_mitre_mutable_elements	{'field': 'UserContext', 'description': 'Foreground/background, Work Profile, dev mode to scope alerts.'}

[AN1678] Analytic 1678

Current version: 1.1

	Old Description			New Description
t	1	From the defender’s view: a sandboxed app retrieves code-lik	t	1	For iOS, detect Download New Code at Runtime by correlating
	>	e content (JS/Mach-O/bundles), writes it to container tmp/Ca		>	analyst-visible device/network evidence and management state
	>	ches, performs memory permission changes (RW→RX/RWX) or dire		>	; use streaming or batched telemetry only where the document
	>	ctly loads via dyld/dlopen from writable paths, sometimes pr		>	ed collector is deployed. Correlate Application Permission v
	>	eceded by 3rd-party hotpatch frameworks (e.g., JSPatch-like		>	ia Application Vetting [Code-signing entitlements and Info.p
	>	behavior) or script engine evaluation. The analytic correlat		>	list privacy usage-description keys]; Network Traffic Conten
	>	es Network Content → File Creation → OS API Execution (memor		>	t via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) ins
	>	y permission change) → Module Load (dyld/dlopen) and/or Proc		>	pection or proxy transaction metadata where enterprise decry
	>	ess Access (codesign validation touches), with optional scri		>	ption/inspection is deployed]; Network Traffic Flow via Appl
	>	pting engine events.		>	e Network Extension / Enterprise VPN [NEFilterFlow / per-app
				>	VPN / secure-web-gateway flow metadata]. Alert on a sequenc
				>	e or state change inconsistent with the device/app baseline,
				>	approved management policy, or expected user workflow; do n
				>	ot infer unobserved API calls, file/process activity, or pay
				>	load content from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.381000+00:00	2026-10-13 17:41:04.821000+00:00
description	From the defender’s view: a sandboxed app retrieves code-like content (JS/Mach-O/bundles), writes it to container tmp/Caches, performs memory permission changes (RW→RX/RWX) or directly loads via dyld/dlopen from writable paths, sometimes preceded by 3rd-party hotpatch frameworks (e.g., JSPatch-like behavior) or script engine evaluation. The analytic correlates Network Content → File Creation → OS API Execution (memory permission change) → Module Load (dyld/dlopen) and/or Process Access (codesign validation touches), with optional scripting engine events.	For iOS, detect Download New Code at Runtime by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]; Network Traffic Content via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed]; Network Traffic Flow via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[3]	{'field': 'PayloadEntropyThreshold', 'description': 'Entropy cutoff to flag code blobs (e.g., ≥ 7.3).'}	{'field': 'VersionCheckWindow', 'description': 'Default 86400s — confirm version has not changed in 24hr before download event.'}
x_mitre_mutable_elements[1]	{'field': 'ContentTypeList', 'description': 'MIME list treated as code-like (octet-stream, zip, javascript, x-mach-o).'}	{'field': 'AppBaselineDomains', 'description': 'Full per-app network destination baseline, 30-day.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'iOS:unifiedlog', 'channel': 'Per-App VPN flow with code-like content types (application/octet-stream, application/zip, text/javascript, application/x-mach-o)'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'mobile:ApplicationVetting', 'channel': 'Code-signing entitlements and Info.plist privacy usage-description keys'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindowSeconds', 'description': 'Max correlation window between download → write → load (e.g., 15–60s).'}	{'field': 'AppCDNList', 'description': 'Per-app declared CDN/update endpoints, 30-day baseline.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'iOS:unifiedlog', 'channel': 'Create/write in /var/mobile/Containers/Data/Application//(tmp\|Library/Caches)/ for .js/.bundle/.dylib/.zip with elevated entropy'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'webproxy:applog', 'channel': 'DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed'}
x_mitre_mutable_elements[2]	{'field': 'WritablePathRegex', 'description': 'Regex for app container tmp/Caches writable paths.'}	{'field': 'MinPayloadSize', 'description': 'Default 1024 bytes.'}
x_mitre_mutable_elements[4]	{'field': 'KnownJITAllowlist', 'description': 'Bundles that legitimately do JIT/script eval to reduce RWX noise.'}	{'field': 'CodeDownloadWindow', 'description': 'Default 120s between download and new destination.'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'iOS:unifiedlog', 'channel': 'mmap/mprotect transitions to PROT_EXEC for pages associated with recently written files'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'iOS:NetworkExtension', 'channel': 'NEFilterFlow / per-app VPN / secure-web-gateway flow metadata'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--c0a4a086-cc20-4e1e-b7cb-29d99dfa3fb1', 'name': 'iOS:unifiedlog', 'channel': 'dlopen/image load from app-writable path (tmp, Caches) outside bundled resources'}
x_mitre_mutable_elements	{'field': 'WritableLoadPathRegex', 'description': 'Regex for loads from writable paths only (exclude app bundle).'}
x_mitre_mutable_elements	{'field': 'UnsignedExecPolicy', 'description': 'Handle enterprise/dev-provisioned unsigned execution contexts.'}
x_mitre_mutable_elements	{'field': 'UserContext', 'description': 'Foreground/background or Work Profile state to filter noise.'}

[AN1681] Analytic 1681

Current version: 1.1

	Old Description			New Description
t	1	Defender observes an application establishing recurrent HTTP	t	1	For Android, detect Web Protocols by correlating analyst-vis
	>	S or FCM-based communication sessions exhibiting structured		>	ible device/network evidence and management state; use strea
	>	cadence, asymmetric request/response sizes, or persistent lo		>	ming or batched telemetry only where the documented collecto
	>	w-volume polling inconsistent with declared application func		>	r is deployed. Correlate API Calls via Application Vetting /
	>	tionality, potentially embedding command data within web pro		>	Instrumented Dynamic Analysis [Dynamic API/runtime trace: F
	>	tocol traffic.		>	irebaseMessaging.getToken() called for project_id NOT IN $FC
				>	MAllowList$ — rogue FCM project registration is the adversar
				>	y enabling C2 over Google infrastructure]; Network Connectio
				>	n Creation via Android Enterprise Network Logging / Enterpri
				>	se VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent
				>	/ ConnectEvent; VPN flow metadata]; Network Traffic Content
				>	via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspe
				>	ction or proxy transaction metadata where enterprise decrypt
				>	ion/inspection is deployed]. Alert on a sequence or state ch
				>	ange inconsistent with the device/app baseline, approved man
				>	agement policy, or expected user workflow; do not infer unob
				>	served API calls, file/process activity, or payload content
				>	from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.383000+00:00	2026-10-13 17:41:29.364000+00:00
description	Defender observes an application establishing recurrent HTTPS or FCM-based communication sessions exhibiting structured cadence, asymmetric request/response sizes, or persistent low-volume polling inconsistent with declared application functionality, potentially embedding command data within web protocol traffic.	For Android, detect Web Protocols by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: FirebaseMessaging.getToken() called for project_id NOT IN $FCMAllowList$ — rogue FCM project registration is the adversary enabling C2 over Google infrastructure]; Network Connection Creation via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]; Network Traffic Content via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'NSM:Flow', 'channel': 'HTTPS sessions exhibiting periodic request cadence or structured payload exchanges inconsistent with application baseline'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: FirebaseMessaging.getToken() called for project_id NOT IN $FCMAllowList$ — rogue FCM project registration is the adversary enabling C2 over Google infrastructure'}
x_mitre_mutable_elements[0]	{'field': 'BeaconIntervalVarianceThreshold', 'description': 'Defines acceptable deviation in HTTPS polling cadence'}	{'field': 'AppBaselineDomains', 'description': 'Per-app CDN/update domains from 30-day baseline.'}
x_mitre_mutable_elements[2]	{'field': 'AppNetworkRoleBaseline', 'description': 'Expected mapping between application category and network endpoints'}	{'field': 'BeaconVarianceThreshold', 'description': 'Default 15% interval variance.'}
x_mitre_mutable_elements[1]	{'field': 'PayloadSymmetryThreshold', 'description': 'Defines acceptable ratio between request and response sizes'}	{'field': 'FCMAllowList', 'description': 'Enterprise FCM project IDs for deployed apps. Derive from app developer registration.'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba', 'name': 'android:EnterpriseNetworkLog', 'channel': 'DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata'}
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'webproxy:applog', 'channel': 'DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed'}

[AN1682] Analytic 1682

Current version: 1.1

	Old Description			New Description
t	1	Defender observes an application establishing recurrent HTTP	t	1	For iOS, detect Web Protocols by correlating analyst-visible
	>	S or APNS-related communications exhibiting structured caden		>	device/network evidence and management state; use streaming
	>	ce, abnormal session persistence, or notification-triggered		>	or batched telemetry only where the documented collector is
	>	network bursts inconsistent with user interaction patterns o		>	deployed. Correlate API Calls via Application Vetting / Ins
	>	r declared application behavior.		>	trumented Dynamic Analysis [Dynamic API/runtime trace: UNUse
				>	rNotificationCenter or legacy UIApplication.registerForRemot
				>	eNotifications with Apple Team ID NOT IN $APNSAllowList$ — r
				>	ogue APNS sender registration]; Network Connection Creation
				>	via Apple Network Extension / Enterprise VPN [NEFilterFlow /
				>	per-app VPN / secure-web-gateway flow metadata]; Network Tr
				>	affic Content via Enterprise Secure Web Gateway / Proxy [DNS
				>	/HTTP(S) inspection or proxy transaction metadata where ente
				>	rprise decryption/inspection is deployed]. Alert on a sequen
				>	ce or state change inconsistent with the device/app baseline
				>	, approved management policy, or expected user workflow; do
				>	not infer unobserved API calls, file/process activity, or pa
				>	yload content from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.381000+00:00	2026-10-13 17:41:29.999000+00:00
description	Defender observes an application establishing recurrent HTTPS or APNS-related communications exhibiting structured cadence, abnormal session persistence, or notification-triggered network bursts inconsistent with user interaction patterns or declared application behavior.	For iOS, detect Web Protocols by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: UNUserNotificationCenter or legacy UIApplication.registerForRemoteNotifications with Apple Team ID NOT IN $APNSAllowList$ — rogue APNS sender registration]; Network Connection Creation via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]; Network Traffic Content via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'NSM:Flow', 'channel': 'HTTPS sessions exhibiting periodic request cadence or structured payload exchanges inconsistent with application baseline'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: UNUserNotificationCenter or legacy UIApplication.registerForRemoteNotifications with Apple Team ID NOT IN $APNSAllowList$ — rogue APNS sender registration'}
x_mitre_mutable_elements[0]	{'field': 'NotificationWakeFrequencyThreshold', 'description': 'Baseline deviation tolerance for background wake events'}	{'field': 'AppBaselineDomains', 'description': 'Per-app CDN/update domains from 30-day baseline.'}
x_mitre_mutable_elements[2]	{'field': 'SessionPersistenceThreshold', 'description': 'Threshold for abnormal TLS session duration'}	{'field': 'BeaconVarianceThreshold', 'description': 'Default 15% interval variance.'}
x_mitre_mutable_elements[1]	{'field': 'HTTPSCadenceAnomalyThreshold', 'description': 'Acceptable deviation in recurring web traffic timing'}	{'field': 'APNSAllowList', 'description': 'Enterprise Apple Team IDs for deployed apps. Derive from Apple Developer account.'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba', 'name': 'iOS:NetworkExtension', 'channel': 'NEFilterFlow / per-app VPN / secure-web-gateway flow metadata'}
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'webproxy:applog', 'channel': 'DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed'}

[AN1683] Analytic 1683

Current version: 1.1

	Old Description			New Description
t	1	Defender correlates an app escalating file visibility (permi	t	1	For Android, detect Stored Application Data by correlating a
	>	ssions/flags, legacy storage modes) with enumeration of othe		>	nalyst-visible device/network evidence and management state;
	>	r apps’ storage or exported ContentProviders, followed by bu		>	use streaming or batched telemetry only where the documente
	>	lk reads/copies from target paths (including shared/external		>	d collector is deployed. Correlate Application Permission vi
	>	storage) and optional archive/encode then share/upload. Seq		>	a Android Enterprise DPC / Application Vetting [DevicePolicy
	>	uence: storage capability/permission gain → target discovery		>	Manager.getPermissionGrantState(); PackageManager manifest/r
	>	(provider queries, directory listing) → high-volume cross-a		>	equested-permission review]; File Access via Application Vet
	>	pp data reads from writable/shared paths → archive/encode →		>	ting / Forensic Acquisition [Dynamic filesystem trace or acq
	>	exfil/share within a short window.		>	uired app-container/filesystem artifacts: open() for read on
				>	path IN /sdcard/ OR on path with file_permissions=777]; Net
				>	work Traffic Flow via Android Enterprise Network Logging / E
				>	nterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): Dn
				>	sEvent / ConnectEvent; VPN flow metadata]. Alert on a sequen
				>	ce or state change inconsistent with the device/app baseline
				>	, approved management policy, or expected user workflow; do
				>	not infer unobserved API calls, file/process activity, or pa
				>	yload content from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.379000+00:00	2026-10-13 17:41:05.433000+00:00
description	Defender correlates an app escalating file visibility (permissions/flags, legacy storage modes) with enumeration of other apps’ storage or exported ContentProviders, followed by bulk reads/copies from target paths (including shared/external storage) and optional archive/encode then share/upload. Sequence: storage capability/permission gain → target discovery (provider queries, directory listing) → high-volume cross-app data reads from writable/shared paths → archive/encode → exfil/share within a short window.	For Android, detect Stored Application Data by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; File Access via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: open() for read on path IN /sdcard/ OR on path with file_permissions=777]; Network Traffic Flow via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[3]	{'field': 'MinBytesRead', 'description': 'Lower bound on cumulative read volume to avoid noisy single-file accesses.'}	{'field': 'AppCDNList', 'description': 'Per-app known upload destinations. Derive by measurement.'}
x_mitre_mutable_elements[1]	{'field': 'ExternalStoragePathRegex', 'description': 'Regex for cross-app paths on external/shared storage to monitor.'}	{'field': 'ApprovedStorageReaders', 'description': 'Media players, file managers, MDM agent. Derive from MDM catalog.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--1887a270-576a-4049-84de-ef746b2572d6', 'name': 'android:logcat', 'channel': 'Runtime grant or manifest presence for MANAGE_EXTERNAL_STORAGE/READ_EXTERNAL_STORAGE/READ_MEDIA_*; legacy external storage mode detection'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindowSeconds', 'description': 'Correlation window to tie discovery → reads → package → exfil (e.g., 15–120s).'}	{'field': 'HighValueAppList', 'description': 'Banking, email, authenticator, messaging app packages. Derive from MDM app catalog by data-sensitivity tier.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'android:logcat', 'channel': 'QUERY on exported ContentProviders of other packages (content:///*) or MediaStore scoped queries immediately preceding file reads'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--235b7491-2d2b-4617-9a52-3c0783680f71', 'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: open() for read on path IN /sdcard/ OR on path with file_permissions=777'}
x_mitre_mutable_elements[2]	{'field': 'SuspiciousProviders', 'description': 'List of exported/weakly-protected content providers under scrutiny.'}	{'field': 'UplinkThreshold', 'description': 'Default 500KB. Tightening: 100KB. Derive from per-app upload baseline.'}
x_mitre_mutable_elements[4]	{'field': 'ArchiveExtensions', 'description': 'Extensions considered packaging (.zip,.gz,.7z,.tar,.db copies).'}	{'field': 'ExfilWindow', 'description': 'Default 120s.'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--235b7491-2d2b-4617-9a52-3c0783680f71', 'name': 'android:logcat', 'channel': 'READ or COPY operations where path matches external/shared locations of other apps (e.g., /storage/emulated/0/Android/data//files/, /storage/emulated/0/Download//*)'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'android:EnterpriseNetworkLog', 'channel': 'DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'android:logcat', 'channel': 'CREATE/WRITE of archive or container (.zip/.gz/.7z/.db copy) that aggregates files pulled from other-package paths'}
x_mitre_mutable_elements	{'field': 'ExfilDomainAllowlist', 'description': 'Known good CDNs/APIs to reduce false positives.'}
x_mitre_mutable_elements	{'field': 'UserContext', 'description': 'Foreground/background, Work Profile, developer mode to scope alerts.'}

[AN1684] Analytic 1684

Current version: 1.1

	Old Description			New Description
t	1	Defender correlates attempts to access other apps’ data via	t	1	For iOS, detect Stored Application Data by correlating analy
	>	shared containers (App Groups), Photos/Files providers, past		>	st-visible device/network evidence and management state; use
	>	eboard abuse, or jailbroken cross-container reads, followed		>	streaming or batched telemetry only where the documented co
	>	by aggregation/packaging and optional exfil/share. Sequence:		>	llector is deployed. Correlate Application State via Apple M
	>	capability/consent (TCC/entitlements) → target discovery (A		>	DM [InstalledApplicationList / ManagedApplicationList]; Host
	>	ppGroup/Photos/Files enumeration, URL schemes) → bulk read f		>	Status via Apple MDM [DeviceInformation / SecurityInfo / Pr
	>	rom shared/foreign container or provider → package/encode →		>	ofileList / restrictions and compliance queries]; Network Tr
	>	exfil/share.		>	affic Flow via Apple Network Extension / Enterprise VPN [NEF
				>	ilterFlow / per-app VPN / secure-web-gateway flow metadata].
				>	Alert on a sequence or state change inconsistent with the d
				>	evice/app baseline, approved management policy, or expected
				>	user workflow; do not infer unobserved API calls, file/proce
				>	ss activity, or payload content from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.381000+00:00	2026-10-13 17:41:06.038000+00:00
description	Defender correlates attempts to access other apps’ data via shared containers (App Groups), Photos/Files providers, pasteboard abuse, or jailbroken cross-container reads, followed by aggregation/packaging and optional exfil/share. Sequence: capability/consent (TCC/entitlements) → target discovery (AppGroup/Photos/Files enumeration, URL schemes) → bulk read from shared/foreign container or provider → package/encode → exfil/share.	For iOS, detect Stored Application Data by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application State via Apple MDM [InstalledApplicationList / ManagedApplicationList]; Host Status via Apple MDM [DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries]; Network Traffic Flow via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[3]	{'field': 'MinBytesRead', 'description': 'Lower bound on cumulative read size to signal collection vs casual access.'}	{'field': 'AppCDNList', 'description': 'Per-device CDN baseline, 30-day.'}
x_mitre_mutable_elements[1]	{'field': 'AppGroupAllowlist', 'description': 'Allowed App Group IDs for each bundle to reduce FPs.'}	{'field': 'DataDumpMin', 'description': 'Default 50KB — minimum for meaningful app database content.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--1887a270-576a-4049-84de-ef746b2572d6', 'name': 'iOS:unifiedlog', 'channel': 'Privacy (TCC) prompts/grants for Photos/Files or access changes indicating new visibility into user/app data'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'iOS:MDM', 'channel': 'InstalledApplicationList / ManagedApplicationList'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindowSeconds', 'description': 'Correlation window for consent/discovery → read → package → exfil (e.g., 20–180s).'}	{'field': 'HighValueAppList', 'description': 'Banking, authentication, enterprise email, cryptocurrency wallet bundle IDs. Derive from MDM app catalog by data-sensitivity tier.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--235b7491-2d2b-4617-9a52-3c0783680f71', 'name': 'iOS:unifiedlog', 'channel': 'READ operations from App Group containers (/var/mobile/Containers/Shared/AppGroup/...) or Files/Photos provider mountpoints, especially when group not owned by bundle'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--85a533a4-5fa4-4dba-b45d-f0717bedd6e6', 'name': 'iOS:MDM', 'channel': 'DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries'}
x_mitre_mutable_elements[2]	{'field': 'ProviderScope', 'description': 'Files/Photos provider collections permitted for the app.'}	{'field': 'DataDumpMax', 'description': 'Default 10MB — cap to exclude media exfil which is larger.'}
x_mitre_mutable_elements[4]	{'field': 'ArchiveExtensions', 'description': 'Packaging extensions to track when aggregating data.'}	{'field': 'ExfilWindow', 'description': 'Default 300s after jailbreak detection.'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'iOS:unifiedlog', 'channel': 'Repeated or large UIPasteboard reads; background pasteboard access shortly before packaging'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'iOS:NetworkExtension', 'channel': 'NEFilterFlow / per-app VPN / secure-web-gateway flow metadata'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'iOS:unifiedlog', 'channel': 'CREATE/WRITE of archive/container (.zip/.gz/.7z/.db export) aggregating recently read items'}
x_mitre_mutable_elements	{'field': 'ExfilDomainAllowlist', 'description': 'Known-good enterprise domains/CDNs for uploads.'}
x_mitre_mutable_elements	{'field': 'UserContext', 'description': 'Foreground/background and Work Profile state to scope analytics.'}

[AN1687] Analytic 1687

Current version: 1.0

	Old Description			New Description
t	1	Mobile security products can potentially detect rogue Wi-Fi	t	1	For Android, detect Adversary-in-the-Middle by correlating a
	>	access points if the adversary is attempting to decrypt traf		>	nalyst-visible device/network evidence and management state;
	>	fic using an untrusted SSL certificate. Application vetting		>	use streaming or batched telemetry only where the documente
	>	services should look for applications that request VPN acce		>	d collector is deployed. Correlate File Modification via App
	>	ss. These applications should be heavily scrutinized since V		>	lication Vetting / Forensic Acquisition [Dynamic filesystem
	>	PN functionality is not very common. On both Android and iO		>	trace or acquired app-container/filesystem artifacts: write(
	>	S, the user must grant consent to an application to act as a		>	) to /sdcard/ path]; Network Traffic Content via Enterprise
	>	VPN. Both platforms also provide visual context to the user		>	Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy
	>	in the top status bar when a VPN connection is active. The		>	transaction metadata where enterprise decryption/inspection
	>	user can see registered VPN services in the device settings.		>	is deployed]; Protected Configuration via Android Enterprise
	>			>	DPC [DevicePolicyManager policy/compliance/security-state q
				>	ueries and SecurityLog events where supported]. Alert on a s
				>	equence or state change inconsistent with the device/app bas
				>	eline, approved management policy, or expected user workflow
				>	; do not infer unobserved API calls, file/process activity,
				>	or payload content from management state alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ApprovedVPNApps', 'description': 'IT-managed VPN app packages. Minimal.'}, {'field': 'HighValueAppList', 'description': 'Banking, payment, enterprise apps writing to external storage.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:41:56.555000+00:00
description	Mobile security products can potentially detect rogue Wi-Fi access points if the adversary is attempting to decrypt traffic using an untrusted SSL certificate. Application vetting services should look for applications that request VPN access. These applications should be heavily scrutinized since VPN functionality is not very common. On both Android and iOS, the user must grant consent to an application to act as a VPN. Both platforms also provide visual context to the user in the top status bar when a VPN connection is active. The user can see registered VPN services in the device settings.	For Android, detect Adversary-in-the-Middle by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate File Modification via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: write() to /sdcard/ path]; Network Traffic Content via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed]; Protected Configuration via Android Enterprise DPC [DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba', 'name': 'Network Traffic', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--84572de3-9583-4c73-aabd-06ea88123dd8', 'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: write() to /sdcard/ path'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--6c62144a-cd5c-401c-ada9-58c4c74cd9d2', 'name': 'Application Vetting', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'webproxy:applog', 'channel': 'DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--e2f72131-14d1-411f-8e8c-aa3453dd5456', 'name': 'User Interface', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--6c62144a-cd5c-401c-ada9-58c4c74cd9d2', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported'}

[AN1688] Analytic 1688

Current version: 1.0

	Old Description			New Description
t	1	Mobile security products can potentially detect rogue Wi-Fi	t	1	For iOS, detect Adversary-in-the-Middle by correlating analy
	>	access points if the adversary is attempting to decrypt traf		>	st-visible device/network evidence and management state; use
	>	fic using an untrusted SSL certificate. Application vetting		>	streaming or batched telemetry only where the documented co
	>	services should look for applications that request VPN acce		>	llector is deployed. Correlate Application Permission via Ap
	>	ss. These applications should be heavily scrutinized since V		>	plication Vetting [Code-signing entitlements and Info.plist
	>	PN functionality is not very common. On both Android and iO		>	privacy usage-description keys]; Network Traffic Content via
	>	S, the user must grant consent to an application to act as a		>	Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspecti
	>	VPN. Both platforms also provide visual context to the user		>	on or proxy transaction metadata where enterprise decryption
	>	in the top status bar when a VPN connection is active. The		>	/inspection is deployed]; Protected Configuration via Apple
	>	user can see registered VPN services in the device settings.		>	MDM [DeviceInformation / SecurityInfo / ProfileList / restri
	>			>	ctions and compliance queries]. Alert on a sequence or state
				>	change inconsistent with the device/app baseline, approved
				>	management policy, or expected user workflow; do not infer u
				>	nobserved API calls, file/process activity, or payload conte
				>	nt from management state alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ApprovedVPNApps', 'description': 'IT-approved iOS VPN bundle IDs with Network Extension entitlement. Minimal.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:41:57.200000+00:00
description	Mobile security products can potentially detect rogue Wi-Fi access points if the adversary is attempting to decrypt traffic using an untrusted SSL certificate. Application vetting services should look for applications that request VPN access. These applications should be heavily scrutinized since VPN functionality is not very common. On both Android and iOS, the user must grant consent to an application to act as a VPN. Both platforms also provide visual context to the user in the top status bar when a VPN connection is active. The user can see registered VPN services in the device settings.	For iOS, detect Adversary-in-the-Middle by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]; Network Traffic Content via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed]; Protected Configuration via Apple MDM [DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba', 'name': 'Network Traffic', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'mobile:ApplicationVetting', 'channel': 'Code-signing entitlements and Info.plist privacy usage-description keys'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--6c62144a-cd5c-401c-ada9-58c4c74cd9d2', 'name': 'Application Vetting', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'webproxy:applog', 'channel': 'DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--e2f72131-14d1-411f-8e8c-aa3453dd5456', 'name': 'User Interface', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--6c62144a-cd5c-401c-ada9-58c4c74cd9d2', 'name': 'iOS:MDM', 'channel': 'DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries'}

[AN1689] Analytic 1689

Current version: 1.0

+For Android, detect Remote Access Software by correlating an
->
+alyst-visible device/network evidence and management state;
->
+use streaming or batched telemetry only where the documented
+ collector is deployed. Correlate Application Permission via
+ Android Enterprise DPC / Application Vetting [DevicePolicyM
+anager.getPermissionGrantState(); PackageManager manifest/re
+quested-permission review]; Network Connection Creation via
+Android Enterprise Network Logging / Enterprise VPN [DeviceP
+olicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent;
+ VPN flow metadata]; Network Traffic Flow via Android Enterp
+rise Network Logging / Enterprise VPN [DevicePolicyManager.r
+etrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow meta
+data]. Alert on a sequence or state change inconsistent with
+ the device/app baseline, approved management policy, or exp
+ected user workflow; do not infer unobserved API calls, file
+/process activity, or payload content from management state
+alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'RASAppSignatures', 'description': 'TeamViewer, AnyDesk, AirDroid, AirMirror package names.'}, {'field': 'ApprovedRASApps', 'description': 'IT-authorized remote support packages. Keep minimal.'}, {'field': 'RASInfrastructureIPs', 'description': 'Published IP ranges for approved RAS vendors. Derive from vendor documentation.'}, {'field': 'PersistentSessionThreshold', 'description': 'Default 300s — confirms active session vs connection test.'}, {'field': 'InteractiveRatioRange', 'description': 'Default inbound/outbound ratio 0.1–10.0 — interactive vs pure exfil. Derive from RAS session baseline.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:42:14.900000+00:00
description	Remote access software typically requires many privileged permissions, such as accessibility services or device administrator.	For Android, detect Remote Access Software by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; Network Connection Creation via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]; Network Traffic Flow via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--e2f72131-14d1-411f-8e8c-aa3453dd5456', 'name': 'User Interface', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba', 'name': 'android:EnterpriseNetworkLog', 'channel': 'DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata'}
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'android:EnterpriseNetworkLog', 'channel': 'DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata'}

[AN1690] Analytic 1690

Current version: 1.0

	Old Description			New Description
t	1	Remote access software typically requires many privileged pe	t	1	For iOS, detect Remote Access Software by correlating analys
	>	rmissions, such as accessibility services or device administ		>	t-visible device/network evidence and management state; use
	>	rator.		>	streaming or batched telemetry only where the documented col
				>	lector is deployed. Correlate Application Permission via App
				>	lication Vetting [Code-signing entitlements and Info.plist p
				>	rivacy usage-description keys]; Network Connection Creation
				>	via Apple Network Extension / Enterprise VPN [NEFilterFlow /
				>	per-app VPN / secure-web-gateway flow metadata]; Network Tr
				>	affic Flow via Apple Network Extension / Enterprise VPN [NEF
				>	ilterFlow / per-app VPN / secure-web-gateway flow metadata].
				>	Alert on a sequence or state change inconsistent with the d
				>	evice/app baseline, approved management policy, or expected
				>	user workflow; do not infer unobserved API calls, file/proce
				>	ss activity, or payload content from management state alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'RASAppBundleIDs', 'description': 'TeamViewer, AnyDesk, AirServer iOS bundle IDs.'}, {'field': 'ApprovedRASApps', 'description': 'IT-authorized iOS remote support bundles.'}, {'field': 'RASInfrastructureIPs', 'description': 'RAS vendor published IP ranges.'}, {'field': 'PersistentSessionThreshold', 'description': 'Default 300s.'}, {'field': 'InteractiveRatioRange', 'description': 'Default 0.1–10.0.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:42:15.565000+00:00
description	Remote access software typically requires many privileged permissions, such as accessibility services or device administrator.	For iOS, detect Remote Access Software by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]; Network Connection Creation via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]; Network Traffic Flow via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--e2f72131-14d1-411f-8e8c-aa3453dd5456', 'name': 'User Interface', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'mobile:ApplicationVetting', 'channel': 'Code-signing entitlements and Info.plist privacy usage-description keys'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba', 'name': 'iOS:NetworkExtension', 'channel': 'NEFilterFlow / per-app VPN / secure-web-gateway flow metadata'}
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'iOS:NetworkExtension', 'channel': 'NEFilterFlow / per-app VPN / secure-web-gateway flow metadata'}

[AN1691] Analytic 1691

Current version: 1.0

	Old Description			New Description
t	1	Application vetting services could look for applications att	t	1	For Android, detect System Checks by correlating analyst-vis
	>	empting to get `android.os.SystemProperties` or `getprop` wi		>	ible device/network evidence and management state; use strea
	>	th the runtime `exec()` commands. This could indicate some l		>	ming or batched telemetry only where the documented collecto
	>	evel of sandbox evasion, as Google recommends against using		>	r is deployed. Correlate API Calls via Application Vetting /
	>	system properties within applications.		>	Instrumented Dynamic Analysis [Dynamic API/runtime trace: g
				>	etNetworkInterfaces() OR NetworkInterface.getHardwareAddress
				>	() called within $ProcReadWindow$ of /proc reads by same app
				>	— network MAC OUI check completes hardware fingerprint]; Fi
				>	le Access via Application Vetting / Forensic Acquisition [Dy
				>	namic filesystem trace or acquired app-container/filesystem
				>	artifacts: open() for read on /proc/cpuinfo]; Network Connec
				>	tion Creation via Android Enterprise Network Logging / Enter
				>	prise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEve
				>	nt / ConnectEvent; VPN flow metadata]. Alert on a sequence o
				>	r state change inconsistent with the device/app baseline, ap
				>	proved management policy, or expected user workflow; do not
				>	infer unobserved API calls, file/process activity, or payloa
				>	d content from management state alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ProcReadAllowList', 'description': 'Performance monitoring, MDM agent. Minimal. Derive from MDM catalog.'}, {'field': 'ProcReadWindow', 'description': 'Default 30s — environment checks are synchronous.'}, {'field': 'AppCDNList', 'description': 'Per-app CDN. Derive by measurement.'}, {'field': 'FollowOnWindow', 'description': 'Default 120s.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:41:40.599000+00:00
description	Application vetting services could look for applications attempting to get `android.os.SystemProperties` or `getprop` with the runtime `exec()` commands. This could indicate some level of sandbox evasion, as Google recommends against using system properties within applications.	For Android, detect System Checks by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: getNetworkInterfaces() OR NetworkInterface.getHardwareAddress() called within $ProcReadWindow$ of /proc reads by same app — network MAC OUI check completes hardware fingerprint]; File Access via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: open() for read on /proc/cpuinfo]; Network Connection Creation via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'Application Vetting', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: getNetworkInterfaces() OR NetworkInterface.getHardwareAddress() called within $ProcReadWindow$ of /proc reads by same app — network MAC OUI check completes hardware fingerprint'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--235b7491-2d2b-4617-9a52-3c0783680f71', 'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: open() for read on /proc/cpuinfo'}
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba', 'name': 'android:EnterpriseNetworkLog', 'channel': 'DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata'}

[AN1692] Analytic 1692

Current version: 1.0

	Old Description			New Description
t	1	Application vetting services could look for applications att	t	1	For iOS, detect System Checks by correlating analyst-visible
	>	empting to get `android.os.SystemProperties` or `getprop` wi		>	device/network evidence and management state; use streaming
	>	th the runtime `exec()` commands. This could indicate some l		>	or batched telemetry only where the documented collector is
	>	evel of sandbox evasion, as Google recommends against using		>	deployed. Correlate API Calls via Application Vetting / Ins
	>	system properties within applications.		>	trumented Dynamic Analysis [Dynamic API/runtime trace: UIDev
				>	ice.currentDevice.model]; Application State via Apple MDM [I
				>	nstalledApplicationList / ManagedApplicationList]; Network C
				>	onnection Creation via Apple Network Extension / Enterprise
				>	VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow me
				>	tadata]. Alert on a sequence or state change inconsistent wi
				>	th the device/app baseline, approved management policy, or e
				>	xpected user workflow; do not infer unobserved API calls, fi
				>	le/process activity, or payload content from management stat
				>	e alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ProcReadWindow', 'description': 'Default 5s at cold launch.'}, {'field': 'SystemEnumAllowList', 'description': 'MDM agent, approved analytics SDK.'}, {'field': 'SimulatorModelPatterns', 'description': 'Known Xcode Simulator model strings (x86_64, iPhone Simulator, etc.). Derive from Apple developer documentation.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:41:41.211000+00:00
description	Application vetting services could look for applications attempting to get `android.os.SystemProperties` or `getprop` with the runtime `exec()` commands. This could indicate some level of sandbox evasion, as Google recommends against using system properties within applications.	For iOS, detect System Checks by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: UIDevice.currentDevice.model]; Application State via Apple MDM [InstalledApplicationList / ManagedApplicationList]; Network Connection Creation via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'Application Vetting', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: UIDevice.currentDevice.model'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'iOS:MDM', 'channel': 'InstalledApplicationList / ManagedApplicationList'}
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba', 'name': 'iOS:NetworkExtension', 'channel': 'NEFilterFlow / per-app VPN / secure-web-gateway flow metadata'}

[AN1693] Analytic 1693

Current version: 2.0

	Old Description			New Description
t	1	When vetting applications for potential security weaknesses,	t	1	For Android, detect URI Hijacking by correlating analyst-vis
	>	the vetting process could look for insecure use of Intents.		>	ible device/network evidence and management state; use strea
	>	Defenders should validate the entirety of the URI. For exam		>	ming or batched telemetry only where the documented collecto
	>	ple, the URI's scheme should be `https` and the URI's host s		>	r is deployed. Correlate API Calls via Application Vetting /
	>	hould be on a list of trusted hosts.(Citation: Android_Unsaf		>	Instrumented Dynamic Analysis [Dynamic API/runtime trace: P
	>	eURILoading_Sept2024) Developers should be encouraged to us		>	ackageManager reports two or more apps with identical URI sc
	>	e techniques to ensure that the intent can only be sent to a		>	heme intent-filter]; Application Permission via Android Ente
	>	n appropriate destination (e.g., use explicit rather than im		>	rprise DPC / Application Vetting [DevicePolicyManager.getPer
	>	plicit intents, permission checking, checking of the destina		>	missionGrantState(); PackageManager manifest/requested-permi
	>	tion app's signing certificate, or utilizing the App Links f		>	ssion review]; Network Traffic Content via Enterprise Secure
	>	eature). For mobile applications using OAuth, encourage use		>	Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy transa
	>	of best practice.(Citation: IETF-OAuthNativeApps)(Citation:		>	ction metadata where enterprise decryption/inspection is dep
	>	Android-AppLinks) On Android, users may be presented with a		>	loyed]. Alert on a sequence or state change inconsistent wit
	>	popup to select the appropriate application to open the URI		>	h the device/app baseline, approved management policy, or ex
	>	in. If the user sees an application they do not recognize,		>	pected user workflow; do not infer unobserved API calls, fil
	>	they can remove it.		>	e/process activity, or payload content from management state
				>	alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ApprovedURIOwners', 'description': 'URI to package owner mapping.'}, {'field': 'MDMApprovedCatalog', 'description': 'MDM-managed app list.'}, {'field': 'OAuthFlowWindow', 'description': 'Default 30s.'}]

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.378000+00:00	2026-10-13 17:41:44.481000+00:00
description	When vetting applications for potential security weaknesses, the vetting process could look for insecure use of Intents. Defenders should validate the entirety of the URI. For example, the URI's scheme should be `https` and the URI's host should be on a list of trusted hosts.(Citation: Android_UnsafeURILoading_Sept2024) Developers should be encouraged to use techniques to ensure that the intent can only be sent to an appropriate destination (e.g., use explicit rather than implicit intents, permission checking, checking of the destination app's signing certificate, or utilizing the App Links feature). For mobile applications using OAuth, encourage use of best practice.(Citation: IETF-OAuthNativeApps)(Citation: Android-AppLinks) On Android, users may be presented with a popup to select the appropriate application to open the URI in. If the user sees an application they do not recognize, they can remove it.	For Android, detect URI Hijacking by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: PackageManager reports two or more apps with identical URI scheme intent-filter]; Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; Network Traffic Content via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'Application Vetting', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: PackageManager reports two or more apps with identical URI scheme intent-filter'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--bf0ff551-a5a7-40e5-bff9-f9405011b1f4', 'name': 'User Interface', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'webproxy:applog', 'channel': 'DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed'}

[AN1694] Analytic 1694

Current version: 2.0

	Old Description			New Description
t	1	When vetting applications for potential security weaknesses,	t	1	For iOS, detect URI Hijacking by correlating analyst-visible
	>	the vetting process could look for insecure use of Intents.		>	device/network evidence and management state; use streaming
	>	Developers should be encouraged to use techniques to ensu		>	or batched telemetry only where the documented collector is
	>	re that the intent can only be sent to an appropriate destin		>	deployed. Correlate Application Permission via Application
	>	ation (e.g., use explicit rather than implicit intents, perm		>	Vetting [Code-signing entitlements and Info.plist privacy us
	>	ission checking, checking of the destination app's signing c		>	age-description keys]; Network Connection Creation via Apple
	>	ertificate, or utilizing the App Links feature). For mobile		>	Network Extension / Enterprise VPN [NEFilterFlow / per-app
	>	applications using OAuth, encourage use of best practice.(Ci		>	VPN / secure-web-gateway flow metadata]; Network Traffic Con
	>	tation: IETF-OAuthNativeApps)(Citation: SecureAuth_iOSOAuth_		>	tent via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S)
	>	2025)		>	inspection or proxy transaction metadata where enterprise de
				>	cryption/inspection is deployed]. Alert on a sequence or sta
				>	te change inconsistent with the device/app baseline, approve
				>	d management policy, or expected user workflow; do not infer
				>	unobserved API calls, file/process activity, or payload con
				>	tent from management state alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ApprovedURIOwners', 'description': 'URI to authorized bundle mapping from enterprise OAuth registration.'}, {'field': 'OAuthClientAllowList', 'description': 'Enterprise OAuth client_id to bundle mapping.'}, {'field': 'OAuthFlowWindow', 'description': 'Default 30s.'}]

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.382000+00:00	2026-10-13 17:41:45.153000+00:00
description	When vetting applications for potential security weaknesses, the vetting process could look for insecure use of Intents. Developers should be encouraged to use techniques to ensure that the intent can only be sent to an appropriate destination (e.g., use explicit rather than implicit intents, permission checking, checking of the destination app's signing certificate, or utilizing the App Links feature). For mobile applications using OAuth, encourage use of best practice.(Citation: IETF-OAuthNativeApps)(Citation: SecureAuth_iOSOAuth_2025)	For iOS, detect URI Hijacking by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]; Network Connection Creation via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]; Network Traffic Content via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'Application Vetting', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'mobile:ApplicationVetting', 'channel': 'Code-signing entitlements and Info.plist privacy usage-description keys'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--bf0ff551-a5a7-40e5-bff9-f9405011b1f4', 'name': 'User Interface', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba', 'name': 'iOS:NetworkExtension', 'channel': 'NEFilterFlow / per-app VPN / secure-web-gateway flow metadata'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'webproxy:applog', 'channel': 'DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed'}

[AN1695] Analytic 1695

Current version: 1.0

	Old Description			New Description
t	1	On Android, the user can review which applications have Devi	t	1	For Android, detect Endpoint Denial of Service by correlatin
	>	ce Administrator access in the device settings and revoke pe		>	g analyst-visible device/network evidence and management sta
	>	rmission where appropriate. Application vetting services ca		>	te; use streaming or batched telemetry only where the docume
	>	n detect and closely scrutinize applications that utilize De		>	nted collector is deployed. Correlate API Calls via Applicat
	>	vice Administrator access.		>	ion Vetting / Instrumented Dynamic Analysis [Dynamic API/run
				>	time trace: DevicePolicyManager.lockNow() or resetPassword()
				>	called by caller NOT IN $MDMAgentPackageList$]; Application
				>	Permission via Android Enterprise DPC / Application Vetting
				>	[DevicePolicyManager.getPermissionGrantState(); PackageMana
				>	ger manifest/requested-permission review]; Host Status via A
				>	ndroid Enterprise DPC [DevicePolicyManager policy/compliance
				>	/security-state queries and SecurityLog events where support
				>	ed]. Alert on a sequence or state change inconsistent with t
				>	he device/app baseline, approved management policy, or expec
				>	ted user workflow; do not infer unobserved API calls, file/p
				>	rocess activity, or payload content from management state al
				>	one.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'MDMAgentPackageList', 'description': 'MDM agent and approved Device Admin packages.'}, {'field': 'LockoutWindow', 'description': 'Default 300s.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:42:01.756000+00:00
description	On Android, the user can review which applications have Device Administrator access in the device settings and revoke permission where appropriate. Application vetting services can detect and closely scrutinize applications that utilize Device Administrator access.	For Android, detect Endpoint Denial of Service by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: DevicePolicyManager.lockNow() or resetPassword() called by caller NOT IN $MDMAgentPackageList$]; Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; Host Status via Android Enterprise DPC [DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--56c2b384-77f8-461f-a71a-76f7888ebfb6', 'name': 'User Interface', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: DevicePolicyManager.lockNow() or resetPassword() called by caller NOT IN $MDMAgentPackageList$'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'Application Vetting', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--85a533a4-5fa4-4dba-b45d-f0717bedd6e6', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported'}

[AN1696] Analytic 1696

Current version: 1.0

	Old Description			New Description
t	1	On Android, the user can review which applications have Devi	t	1	For iOS, detect Endpoint Denial of Service from documented m
	>	ce Administrator access in the device settings and revoke pe		>	anagement, network, or vetting evidence; treat state queries
	>	rmission where appropriate. Application vetting services ca		>	as periodic observations rather than real-time events. Corr
	>	n detect and closely scrutinize applications that utilize De		>	elate Application Permission via Application Vetting [Code-s
	>	vice Administrator access.		>	igning entitlements and Info.plist privacy usage-description
				>	keys]; Host Status via Apple MDM [DeviceInformation / Secur
				>	ityInfo / ProfileList / restrictions and compliance queries]
				>	. Alert on a sequence or state change inconsistent with the
				>	device/app baseline, approved management policy, or expected
				>	user workflow; do not infer unobserved API calls, file/proc
				>	ess activity, or payload content from management state alone
				>	.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'LockoutWindow', 'description': 'Default 300s between jailbreak detection and passcode state change.'}, {'field': 'LockoutThreshold', 'description': 'Default 1800s sustained unreachability — distinguish from brief connectivity loss.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:42:02.408000+00:00
description	On Android, the user can review which applications have Device Administrator access in the device settings and revoke permission where appropriate. Application vetting services can detect and closely scrutinize applications that utilize Device Administrator access.	For iOS, detect Endpoint Denial of Service from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Application Permission via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]; Host Status via Apple MDM [DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--56c2b384-77f8-461f-a71a-76f7888ebfb6', 'name': 'User Interface', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'mobile:ApplicationVetting', 'channel': 'Code-signing entitlements and Info.plist privacy usage-description keys'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'Application Vetting', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--85a533a4-5fa4-4dba-b45d-f0717bedd6e6', 'name': 'iOS:MDM', 'channel': 'DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries'}

[AN1697] Analytic 1697

Current version: 1.1

	Old Description			New Description
t	1	An app or app update arrives through an expected delivery pa	t	1	For Android, detect Supply Chain Compromise by correlating a
	>	th or presents as a known legitimate package identity, but i		>	nalyst-visible device/network evidence and management state;
	>	ts post-install or post-update behavior materially changes i		>	use streaming or batched telemetry only where the documente
	>	n ways inconsistent with its historical role. The defender c		>	d collector is deployed. Correlate Application Permission vi
	>	orrelates package identity and install/update context, newly		>	a Android Enterprise DPC / Application Vetting [DevicePolicy
	>	expanded capability state, changed runtime framework use, n		>	Manager.getPermissionGrantState(); PackageManager manifest/r
	>	ew sensor or storage behaviors, and new network destinations		>	equested-permission review]; Application State via Android E
	>	shortly after installation or update to identify likely sup		>	nterprise / EMM [Managed package inventory/status and packag
	>	ply-chain compromise rather than ordinary malicious sideload		>	e metadata]; OS API Execution via Application Vetting / Inst
	>	ing or unrelated post-compromise activity.		>	rumented Dynamic Analysis [Dynamic API/runtime trace: Known
				>	application begins first-seen or expanded use of content pro
				>	viders, account services, accessibility, or network destinat
				>	ions not in $AppBehaviorBaseline$ post-update]. Alert on a s
				>	equence or state change inconsistent with the device/app bas
				>	eline, approved management policy, or expected user workflow
				>	; do not infer unobserved API calls, file/process activity,
				>	or payload content from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.382000+00:00	2026-10-13 17:42:22.973000+00:00
description	An app or app update arrives through an expected delivery path or presents as a known legitimate package identity, but its post-install or post-update behavior materially changes in ways inconsistent with its historical role. The defender correlates package identity and install/update context, newly expanded capability state, changed runtime framework use, new sensor or storage behaviors, and new network destinations shortly after installation or update to identify likely supply-chain compromise rather than ordinary malicious sideloading or unrelated post-compromise activity.	For Android, detect Supply Chain Compromise by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; Application State via Android Enterprise / EMM [Managed package inventory/status and package metadata]; OS API Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: Known application begins first-seen or expanded use of content providers, account services, accessibility, or network destinations not in $AppBehaviorBaseline$ post-update]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[1]	{'field': 'AllowedAppList', 'description': 'Approved apps expected to change permissions, add services, or contact new destinations because of legitimate feature releases.'}	{'field': 'AppBehaviorBaseline', 'description': 'Per-app permission and API call baseline from prior version. Derive from MDM telemetry on known-good version. Any new API category post-update is anomalous.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--6c62144a-cd5c-401c-ada9-58c4c74cd9d2', 'name': 'android:MDMLog', 'channel': 'Managed app catalog, enterprise update policy, or trusted distribution posture remains unchanged while a known app exhibits materially different post-update behavior'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}
x_mitre_log_source_references[3]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': 'Known application begins first-seen or expanded use of content providers, account services, accessibility, package services, cryptographic routines, dynamic loading, or other framework interactions after update/install'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--6c62144a-cd5c-401c-ada9-58c4c74cd9d2', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindow', 'description': 'Maximum span between app install/update event and first suspicious post-delivery behavior.'}	{'field': 'AppNetworkBaseline', 'description': '30-day per-app network destination baseline anchored to prior version. Updated on each planned release. Derive by measurement. Tightening: strict domain allowlist per version.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:MDMLog', 'channel': 'Known application or newly updated version declares, gains, or activates expanded storage, sensor, communications, accessibility, or device-management capability inconsistent with prior baseline or app role'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'android:EMM', 'channel': 'Managed package inventory/status and package metadata'}
x_mitre_mutable_elements[2]	{'field': 'AllowedVersionChangeWindow', 'description': 'Grace period after a documented app release during which some behavior drift may be expected.'}	{'field': 'PostInstallWindow', 'description': 'Default 86400s (24hr) behavioral observation window post-install/update. Tightening: 3600s — catches immediate post-install C2.'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'MobileEDR:telemetry', 'channel': 'Updated or newly delivered application becomes active, launches background services, or executes shortly after install/update with minimal user interaction inconsistent with baseline'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Known application begins first-seen or expanded use of content providers, account services, accessibility, or network destinations not in $AppBehaviorBaseline$ post-update'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_mutable_elements	{'field': 'ForegroundStateRequired', 'description': 'Whether certain behaviors should only be considered suspicious when they occur without visible user interaction.'}
x_mitre_mutable_elements	{'field': 'RecentUserInteractionWindow', 'description': 'Threshold for determining whether immediate post-update activity was user-driven or autonomous.'}
x_mitre_mutable_elements	{'field': 'DestinationAllowList', 'description': 'Expected new destinations, APIs, CDNs, or telemetry endpoints associated with approved app updates.'}
x_mitre_mutable_elements	{'field': 'CapabilityDriftThreshold', 'description': 'Threshold for how many newly added or newly exercised permissions/capabilities are considered abnormal for a known app.'}
x_mitre_mutable_elements	{'field': 'BehaviorBaselinePopulation', 'description': 'Population of prior devices, versions, or user cohorts used to baseline normal app behavior.'}

[AN1698] Analytic 1698

Current version: 1.1

	Old Description			New Description
t	1	A managed or supervised app, app update, or enterprise-distr	t	1	For iOS, detect Supply Chain Compromise from documented mana
	>	ibuted build retains a legitimate-seeming identity but exhib		>	gement, network, or vetting evidence; treat state queries as
	>	its post-delivery behavior inconsistent with its expected ro		>	periodic observations rather than real-time events. Correla
	>	le, prior version, or distribution context. Because iOS expo		>	te Application Permission via Application Vetting [Code-sign
	>	ses less direct visibility into bundled dependency tampering		>	ing entitlements and Info.plist privacy usage-description ke
	>	or component-level supply-chain insertion, the defender pri		>	ys]; Application State via Apple MDM [InstalledApplicationLi
	>	oritizes supervised app inventory, signing/provisioning trus		>	st / ManagedApplicationList]; OS API Execution via Applicati
	>	t posture, entitlement and behavior drift after update, new		>	on Vetting / Instrumented Dynamic Analysis [Dynamic API/runt
	>	sensor/resource use, and new downstream network effects soon		>	ime trace: Known app begins first-seen use of protected fram
	>	after install or version change.		>	ework categories (location, microphone, contacts) or backgro
				>	und task patterns post-update]. Alert on a sequence or state
				>	change inconsistent with the device/app baseline, approved
				>	management policy, or expected user workflow; do not infer u
				>	nobserved API calls, file/process activity, or payload conte
				>	nt from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.380000+00:00	2026-10-13 17:42:23.637000+00:00
description	A managed or supervised app, app update, or enterprise-distributed build retains a legitimate-seeming identity but exhibits post-delivery behavior inconsistent with its expected role, prior version, or distribution context. Because iOS exposes less direct visibility into bundled dependency tampering or component-level supply-chain insertion, the defender prioritizes supervised app inventory, signing/provisioning trust posture, entitlement and behavior drift after update, new sensor/resource use, and new downstream network effects soon after install or version change.	For iOS, detect Supply Chain Compromise from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Application Permission via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]; Application State via Apple MDM [InstalledApplicationList / ManagedApplicationList]; OS API Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: Known app begins first-seen use of protected framework categories (location, microphone, contacts) or background task patterns post-update]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[1]	{'field': 'SupervisedOnly', 'description': 'Whether the analytic should only apply to supervised devices with high-confidence app inventory and managed distribution telemetry.'}	{'field': 'AppBehaviorBaseline', 'description': 'Per-app permission and API call baseline from prior version. Derive from MDM telemetry on known-good version. Any new API category post-update is anomalous.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--6c62144a-cd5c-401c-ada9-58c4c74cd9d2', 'name': 'iOS:MDMLog', 'channel': 'Managed app distribution, supervised install posture, or provisioning trust context remains expected while a known app exhibits materially different behavior after version change'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'mobile:ApplicationVetting', 'channel': 'Code-signing entitlements and Info.plist privacy usage-description keys'}
x_mitre_log_source_references[3]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': 'Known application begins first-seen or expanded use of protected frameworks, account services, background task APIs, crypto/network service APIs, or other runtime behaviors after update/install'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--6c62144a-cd5c-401c-ada9-58c4c74cd9d2', 'name': 'iOS:MDM', 'channel': 'DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindow', 'description': 'Maximum span between app install/version change and first suspicious post-delivery behavior.'}	{'field': 'AppNetworkBaseline', 'description': '30-day per-app network destination baseline anchored to prior version. Updated on each planned release. Derive by measurement. Tightening: strict domain allowlist per version.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'iOS:MDMLog', 'channel': 'Known application version declares, activates, or exhibits new entitlements, privacy permissions, or capability use inconsistent with prior baseline or business role'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'iOS:MDM', 'channel': 'InstalledApplicationList / ManagedApplicationList'}
x_mitre_mutable_elements[2]	{'field': 'AllowedAppList', 'description': 'Approved apps expected to expand capabilities or contact new destinations because of legitimate releases.'}	{'field': 'PostInstallWindow', 'description': 'Default 86400s (24hr) behavioral observation window post-install/update. Tightening: 3600s — catches immediate post-install C2.'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'MobileEDR:telemetry', 'channel': 'Updated or newly delivered application wakes, foregrounds, refreshes, or becomes active shortly after version change with weak recent user interaction'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Known app begins first-seen use of protected framework categories (location, microphone, contacts) or background task patterns post-update'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_mutable_elements	{'field': 'AllowedVersionChangeWindow', 'description': 'Grace period after approved releases during which some behavior drift may be expected.'}
x_mitre_mutable_elements	{'field': 'ForegroundStateRequired', 'description': 'Whether certain behaviors should only be treated as suspicious when they occur without expected visible user interaction.'}
x_mitre_mutable_elements	{'field': 'RecentUserInteractionWindow', 'description': 'Threshold for distinguishing autonomous post-update behavior from expected user-driven first-run flows.'}
x_mitre_mutable_elements	{'field': 'DestinationAllowList', 'description': 'Expected new domains, APIs, telemetry services, or CDNs associated with approved app updates.'}
x_mitre_mutable_elements	{'field': 'CapabilityDriftThreshold', 'description': 'Threshold for how much entitlement or capability drift is tolerated for a known app.'}

[AN1699] Analytic 1699

Current version: 1.0

+For Android, detect Exploitation for Client Execution by cor
->
+relating analyst-visible device/network evidence and managem
+ent state; use streaming or batched telemetry only where the
+ documented collector is deployed. Correlate Host Status via
+ Android Enterprise DPC [DevicePolicyManager policy/complian
+ce/security-state queries and SecurityLog events where suppo
+rted]; Network Connection Creation via Android Enterprise Ne
+twork Logging / Enterprise VPN [DevicePolicyManager.retrieve
+NetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata];
+Process Creation via Application Vetting / Managed Device Te
+lemetry [execve()]. Alert on a sequence or state change inco
+nsistent with the device/app baseline, approved management p
+olicy, or expected user workflow; do not infer unobserved AP
+I calls, file/process activity, or payload content from mana
+gement state alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'MediaProcessList', 'description': 'mediaserver, chromium, com.android.browser, com.android.mms, com.android.messaging. Expand per installed browser.'}, {'field': 'KnownMediaChildren', 'description': 'Renderer, GPU process, sandboxed service workers. Derive from media process baseline.'}, {'field': 'ExploitWindow', 'description': 'Default 10s between media process activity and child spawn.'}, {'field': 'AppBaselineDomains', 'description': 'Per-app CDN baseline.'}, {'field': 'PostExploitWindow', 'description': 'Default 30s between child spawn and C2 connection.'}, {'field': 'PatchLagThreshold', 'description': 'Default 30 days. Context only — not primary signal.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:42:09.755000+00:00
description	Network traffic analysis may reveal processes communicating with malicious domains.	For Android, detect Exploitation for Client Execution by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Host Status via Android Enterprise DPC [DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported]; Network Connection Creation via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]; Process Creation via Application Vetting / Managed Device Telemetry [execve()]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--764ee29e-48d6-4934-8e6b-7a606aaaafc0', 'name': 'Application Vetting', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--85a533a4-5fa4-4dba-b45d-f0717bedd6e6', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba', 'name': 'android:EnterpriseNetworkLog', 'channel': 'DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata'}
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'mobile:DynamicAnalysis', 'channel': 'execve()'}

[AN1700] Analytic 1700

Current version: 1.0

+For iOS, detect Exploitation for Client Execution by correla
->
+ting analyst-visible device/network evidence and management
+state; use streaming or batched telemetry only where the doc
+umented collector is deployed. Correlate Host Status via App
+le MDM [DeviceInformation / SecurityInfo / ProfileList / res
+trictions and compliance queries]; Network Connection Creati
+on via Apple Network Extension / Enterprise VPN [NEFilterFlo
+w / per-app VPN / secure-web-gateway flow metadata]; Process
+ Creation via Application Vetting / Managed Device Telemetry
+ [com.apple.WebContent or com.apple.imagent process shows un
+expected child spawn or memory fault at level=fault in Unifi
+ed Log — kernel fault in message-processing subsystem is exp
+loit execution signal]. Alert on a sequence or state change
+inconsistent with the device/app baseline, approved manageme
+nt policy, or expected user workflow; do not infer unobserve
+d API calls, file/process activity, or payload content from
+management state alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'AppleSystemBaseline', 'description': 'Known Apple CDN, update, and push notification server IP ranges. Derive from Apple published IP lists.'}, {'field': 'PostExploitWindow', 'description': 'Default 60s between fault and C2 connection.'}, {'field': 'MinSecureVersion', 'description': 'Latest Apple security release. Update from Apple security advisories.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:42:10.419000+00:00
description	Network traffic analysis may reveal processes communicating with malicious domains.	For iOS, detect Exploitation for Client Execution by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Host Status via Apple MDM [DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries]; Network Connection Creation via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]; Process Creation via Application Vetting / Managed Device Telemetry [com.apple.WebContent or com.apple.imagent process shows unexpected child spawn or memory fault at level=fault in Unified Log — kernel fault in message-processing subsystem is exploit execution signal]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--764ee29e-48d6-4934-8e6b-7a606aaaafc0', 'name': 'Application Vetting', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--85a533a4-5fa4-4dba-b45d-f0717bedd6e6', 'name': 'iOS:MDM', 'channel': 'DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba', 'name': 'iOS:NetworkExtension', 'channel': 'NEFilterFlow / per-app VPN / secure-web-gateway flow metadata'}
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'mobile:DynamicAnalysis', 'channel': 'com.apple.WebContent or com.apple.imagent process shows unexpected child spawn or memory fault at level=fault in Unified Log — kernel fault in message-processing subsystem is exploit execution signal'}

[AN1701] Analytic 1701

Current version: 1.1

	Old Description			New Description
t	1	Correlates (1) activation of Device Administrator privileges	t	1	For Android, detect Device Administrator Permissions from do
	>	by an application, (2) absence or mismatch of legitimate us		>	cumented management, network, or vetting evidence; treat sta
	>	er interaction during the approval flow, and (3) immediate e		>	te queries as periodic observations rather than real-time ev
	>	xecution of administrator-level control actions (e.g., passw		>	ents. Correlate Application Permission via Android Enterpris
	>	ord reset, device lock, policy enforcement, prevention of un		>	e DPC / Application Vetting [DevicePolicyManager.getPermissi
	>	install). The defender observes a causal chain where an appl		>	onGrantState(); PackageManager manifest/requested-permission
	>	ication transitions into a privileged device control role an		>	review]; OS API Execution via Application Vetting / Instrum
	>	d rapidly exercises those capabilities outside expected user		>	ented Dynamic Analysis [Dynamic API/runtime trace: App invok
	>	-driven patterns. Application vetting services can check fo		>	es DevicePolicyManager.resetPassword(), lockNow(), wipeData(
	>	r the string `BIND_DEVICE_ADMIN` in the application’s manife		>	), or setCameraDisabled() immediately after Device Admin act
	>	st.		>	ivation without MDM-initiated policy context or user interac
				>	tion]. Alert on a sequence or state change inconsistent with
				>	the device/app baseline, approved management policy, or exp
				>	ected user workflow; do not infer unobserved API calls, file
				>	/process activity, or payload content from management state
				>	alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.378000+00:00	2026-10-13 17:40:50.394000+00:00
description	Correlates (1) activation of Device Administrator privileges by an application, (2) absence or mismatch of legitimate user interaction during the approval flow, and (3) immediate execution of administrator-level control actions (e.g., password reset, device lock, policy enforcement, prevention of uninstall). The defender observes a causal chain where an application transitions into a privileged device control role and rapidly exercises those capabilities outside expected user-driven patterns. Application vetting services can check for the string `BIND_DEVICE_ADMIN` in the application’s manifest.	For Android, detect Device Administrator Permissions from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; OS API Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: App invokes DevicePolicyManager.resetPassword(), lockNow(), wipeData(), or setCameraDisabled() immediately after Device Admin activation without MDM-initiated policy context or user interaction]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': 'application invokes DevicePolicyManager APIs (e.g., resetPassword, lockNow, setCameraDisabled) immediately following admin activation'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindow', 'description': 'Defines correlation window between Device Admin activation and subsequent privileged actions'}	{'field': 'MDMAdminAllowList', 'description': 'MDM agent packages authorized for Device Admin. Any other app receiving Device Admin is anomalous. Derive from MDM enrollment documentation.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:MDMLog', 'channel': 'application granted Device Administrator privilege + abnormal activation pattern (e.g., rapid enablement after install or no recent user interaction)'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes DevicePolicyManager.resetPassword(), lockNow(), wipeData(), or setCameraDisabled() immediately after Device Admin activation without MDM-initiated policy context or user interaction'}
x_mitre_mutable_elements[1]	{'field': 'AllowedAdminApps', 'description': 'Baseline of legitimate applications expected to request Device Administrator privileges (e.g., enterprise MDM agents)'}	{'field': 'AdminActivationWindow', 'description': 'Default 10s between Device Admin activation and first admin API invocation. Legitimate Device Admin apps wait for user-initiated admin action.'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_mutable_elements	{'field': 'UserInteractionThreshold', 'description': 'Defines acceptable timing between user interaction and admin activation'}
x_mitre_mutable_elements	{'field': 'PrivilegedActionSet', 'description': 'List of high-risk DevicePolicyManager API actions monitored for abuse'}

[AN1702] Analytic 1702

Current version: 1.1

	Old Description			New Description
t	1	The defender correlates proxy-capable network setup or socke	t	1	For Android, detect Proxy Through Victim by correlating anal
	>	t-handling behavior with subsequent bidirectional traffic re		>	yst-visible device/network evidence and management state; us
	>	laying through the same device and app context, especially w		>	e streaming or batched telemetry only where the documented c
	>	hen inbound client sessions are followed by outbound connect		>	ollector is deployed. Correlate Application Permission via A
	>	ions to unrelated remote destinations or when the device sus		>	ndroid Enterprise DPC / Application Vetting [DevicePolicyMan
	>	tains multiplexed traffic patterns inconsistent with normal		>	ager.getPermissionGrantState(); PackageManager manifest/requ
	>	mobile app workflows. The analytic prioritizes Android-obser		>	ested-permission review]; Network Traffic Content via Enterp
	>	vable effects: proxy or raw-socket setup, app background exe		>	rise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or p
	>	cution, inbound-to-outbound traffic bridging, and sustained		>	roxy transaction metadata where enterprise decryption/inspec
	>	relayed flows to multiple destinations without recent user i		>	tion is deployed]; Network Traffic Flow via Android Enterpri
	>	nteraction.		>	se Network Logging / Enterprise VPN [DevicePolicyManager.ret
				>	rieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metada
				>	ta]. Alert on a sequence or state change inconsistent with t
				>	he device/app baseline, approved management policy, or expec
				>	ted user workflow; do not infer unobserved API calls, file/p
				>	rocess activity, or payload content from management state al
				>	one.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.382000+00:00	2026-10-13 17:42:38.525000+00:00
description	The defender correlates proxy-capable network setup or socket-handling behavior with subsequent bidirectional traffic relaying through the same device and app context, especially when inbound client sessions are followed by outbound connections to unrelated remote destinations or when the device sustains multiplexed traffic patterns inconsistent with normal mobile app workflows. The analytic prioritizes Android-observable effects: proxy or raw-socket setup, app background execution, inbound-to-outbound traffic bridging, and sustained relayed flows to multiple destinations without recent user interaction.	For Android, detect Proxy Through Victim by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; Network Traffic Content via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed]; Network Traffic Flow via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[1]	{'field': 'AllowedAppList', 'description': 'Apps legitimately expected to proxy or tunnel traffic, such as enterprise VPN, remote access, security testing, or managed browser apps'}	{'field': 'RelayWindow', 'description': 'Default 5s between inbound session and outbound relay connection. Proxy relay is near-synchronous. Tightening: 2s.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': 'Application initializes proxy-capable or raw-socket networking constructs, including SOCKS-capable Proxy API usage or direct socket listener/setup immediately before traffic relay phase'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}
x_mitre_log_source_references[3]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'NSM:Flow', 'channel': 'Device shows correlated inbound session establishment followed by outbound connections to separate external destinations with overlapping timing and relay-like byte symmetry'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App initializes proxy-capable or raw-socket networking constructs (ServerSocket, SOCKS proxy client, bidirectional relay) NOT IN $ApprovedProxyApps$ — proxy initialization is the technique enabler'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindow', 'description': 'Correlation window between proxy/socket setup and subsequent inbound-outbound traffic bridging'}	{'field': 'ApprovedProxyApps', 'description': 'VPN client, enterprise proxy agent, MDM agent with tunnel capability. Derive from MDM catalog. Tightening: only MDM-provisioned VPN apps.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:MDMLog', 'channel': 'Managed app without approved VPN, enterprise tunneling, browser, or remote-access role exhibits proxy-like traffic handling inconsistent with policy baseline'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'webproxy:applog', 'channel': 'DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed'}
x_mitre_mutable_elements[2]	{'field': 'AllowedDestinationList', 'description': 'Approved remote destinations or service categories for legitimate tunneling applications'}	{'field': 'FanOutThreshold', 'description': 'Default 3 distinct outbound destinations per inbound session. Single-destination relay may be VPN; multi-destination fan-out is proxy.'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'NSM:Flow', 'channel': 'App-attributed traffic exhibits multi-destination fan-out, sustained session bridging, or SOCKS-like relay behavior inconsistent with normal client-only mobile communication'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'android:EnterpriseNetworkLog', 'channel': 'DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_mutable_elements	{'field': 'ForegroundStateRequired', 'description': 'Whether proxy-capable or relayed traffic should occur only during active user-driven workflows'}
x_mitre_mutable_elements	{'field': 'RelaySessionThreshold', 'description': 'Minimum number of correlated inbound and outbound session pairs required to indicate relay behavior'}
x_mitre_mutable_elements	{'field': 'ByteSymmetryTolerance', 'description': 'Allowed variance between inbound and outbound byte volumes when identifying proxied traffic'}
x_mitre_mutable_elements	{'field': 'ConcurrentDestinationThreshold', 'description': 'Maximum expected number of simultaneous unrelated remote destinations for a legitimate app'}
x_mitre_mutable_elements	{'field': 'UplinkBytesThreshold', 'description': 'Minimum outbound volume required for relay behavior to be considered meaningful'}

[AN1706] Analytic 1706

Current version: 1.1

	Old Description			New Description
t	1	Defender observes an app (package/UID) repeatedly retrieving	t	1	For Android, detect System Network Configuration Discovery b
	>	network interface configuration attributes (local IP/MAC/in		>	y correlating analyst-visible device/network evidence and ma
	>	terface names, active network capabilities, link properties,		>	nagement state; use streaming or batched telemetry only wher
	>	proxy/DNS settings, or carrier identifiers when permitted)		>	e the documented collector is deployed. Correlate API Calls
	>	in a short time window, without corresponding user network-m		>	via Application Vetting / Instrumented Dynamic Analysis [Dyn
	>	anagement activity. The pattern is characterized by OS API e		>	amic API/runtime trace: NetworkInterface.getNetworkInterface
	>	xecution for interface/config reads combined with background		>	s()]; Application State via Android Enterprise / EMM [Manage
	>	state, permission/role context (e.g., device owner/profile		>	d package inventory/status and package metadata]; Network Co
	>	owner/carrier/default-SMS), and optional follow-on connectiv		>	nnection Creation via Android Enterprise Network Logging / E
	>	ity tests (gateway/DNS/proxy reachability). Correlate across		>	nterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): Dn
	>	API execution + app state + (optional) local probe to ident		>	sEvent / ConnectEvent; VPN flow metadata]. Alert on a sequen
	>	ify automated network configuration discovery rather than ro		>	ce or state change inconsistent with the device/app baseline
	>	utine connectivity checks.		>	, approved management policy, or expected user workflow; do
				>	not infer unobserved API calls, file/process activity, or pa
				>	yload content from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.384000+00:00	2026-10-13 17:41:16.648000+00:00
description	Defender observes an app (package/UID) repeatedly retrieving network interface configuration attributes (local IP/MAC/interface names, active network capabilities, link properties, proxy/DNS settings, or carrier identifiers when permitted) in a short time window, without corresponding user network-management activity. The pattern is characterized by OS API execution for interface/config reads combined with background state, permission/role context (e.g., device owner/profile owner/carrier/default-SMS), and optional follow-on connectivity tests (gateway/DNS/proxy reachability). Correlate across API execution + app state + (optional) local probe to identify automated network configuration discovery rather than routine connectivity checks.	For Android, detect System Network Configuration Discovery by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: NetworkInterface.getNetworkInterfaces()]; Application State via Android Enterprise / EMM [Managed package inventory/status and package metadata]; Network Connection Creation via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[3]	{'field': 'AllowlistedPackages', 'description': 'Connectivity/security/MDM apps expected to query network configuration frequently.'}	{'field': 'FollowOnWindow', 'description': 'Default 120s.'}
x_mitre_mutable_elements[1]	{'field': 'MinConfigReadEvents', 'description': 'Minimum number of network-config read signals before flagging (environment dependent; e.g., ≥10/5m).'}	{'field': 'ConfigScanWindow', 'description': 'Default 30s.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'Application Vetting', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: NetworkInterface.getNetworkInterfaces()'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindowSeconds', 'description': 'Window to correlate config reads with app state and optional connectivity tests (e.g., 30–300s).'}	{'field': 'NetworkConfigAllowList', 'description': 'Network diagnostic, MDM agent apps. Minimal.'}
x_mitre_mutable_elements[2]	{'field': 'BackgroundOnly', 'description': 'If true, require the app to be backgrounded to reduce legitimate network UI/diagnostic activity.'}	{'field': 'AppCDNList', 'description': 'Per-app CDN. Derive by measurement.'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'android:EMM', 'channel': 'Managed package inventory/status and package metadata'}
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba', 'name': 'android:EnterpriseNetworkLog', 'channel': 'DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_mutable_elements	{'field': 'PrivilegedRoleFilter', 'description': 'If true, elevate severity when an app with device-owner/profile-owner/carrier roles performs bursts.'}
x_mitre_mutable_elements	{'field': 'LocalProbePorts', 'description': "Ports considered 'connectivity tests' (e.g., 53, 80, 443, 8080, 3128) – tune per environment."}
x_mitre_mutable_elements	{'field': 'NetworkChangeSuppressionSeconds', 'description': 'Suppress alerts shortly after legitimate network transitions (Wi-Fi join, VPN connect) to reduce noise.'}

[AN1707] Analytic 1707

Current version: 1.0

	Old Description			New Description
t	1	Application vetting services could look for usage of the `RE	t	1	For iOS, detect System Network Configuration Discovery by co
	>	AD_PRIVILEGED_PHONE_STATE` Android permission. This could in		>	rrelating analyst-visible device/network evidence and manage
	>	dicate that non-system apps are attempting to access informa		>	ment state; use streaming or batched telemetry only where th
	>	tion that they do not have access to.		>	e documented collector is deployed. Correlate Application St
				>	ate via Apple MDM [InstalledApplicationList / ManagedApplica
				>	tionList]; Host Status via Apple MDM [DeviceInformation / Se
				>	curityInfo / ProfileList / restrictions and compliance queri
				>	es]; Network Traffic Flow via Apple Network Extension / Ente
				>	rprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway
				>	flow metadata]. Alert on a sequence or state change inconsis
				>	tent with the device/app baseline, approved management polic
				>	y, or expected user workflow; do not infer unobserved API ca
				>	lls, file/process activity, or payload content from manageme
				>	nt state alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'AppBaselineDomains', 'description': 'Per-device CDN baseline.'}, {'field': 'FingerprintUploadMax', 'description': 'Default 10KB — network config fingerprint is small.'}, {'field': 'DiscoveryWindow', 'description': 'Default 600s after jailbreak detection while on enterprise network.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:41:17.230000+00:00
description	Application vetting services could look for usage of the `READ_PRIVILEGED_PHONE_STATE` Android permission. This could indicate that non-system apps are attempting to access information that they do not have access to.	For iOS, detect System Network Configuration Discovery by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application State via Apple MDM [InstalledApplicationList / ManagedApplicationList]; Host Status via Apple MDM [DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries]; Network Traffic Flow via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'Application Vetting', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'iOS:MDM', 'channel': 'InstalledApplicationList / ManagedApplicationList'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--85a533a4-5fa4-4dba-b45d-f0717bedd6e6', 'name': 'iOS:MDM', 'channel': 'DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries'}
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'iOS:NetworkExtension', 'channel': 'NEFilterFlow / per-app VPN / secure-web-gateway flow metadata'}

[AN1708] Analytic 1708

Current version: 2.0

	Old Description			New Description
t	1	OLD: Monitor for API calls that are related to the AccountMa	t	1	For Android, detect Accounts by correlating analyst-visible
	>	nager API on Android and Keychain services on iOS. Applicati		>	device/network evidence and management state; use streaming
	>	on vetting services may look for `MANAGE_ACCOUNTS` in an And		>	or batched telemetry only where the documented collector is
	>	roid application’s manifest. Most applications do not need a		>	deployed. Correlate API Calls via Application Vetting / Inst
	>	ccess to accounts, so extra scrutiny may be applied to those		>	rumented Dynamic Analysis [Dynamic API/runtime trace: Accoun
	>	that request it. NEW: A defender observes an Android appli		>	tManager.getAccounts() OR getAccountsByType() called > $Acco
	>	cation invoking the AccountManager API.		>	untEnumThreshold$ times within $AccountEnumWindow$ by app NO
				>	T IN $ApprovedAuthenticatorApps$]; Network Traffic Flow via
				>	Android Enterprise Network Logging / Enterprise VPN [DeviceP
				>	olicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent;
				>	VPN flow metadata]; Permissions Request via Android Enterpr
				>	ise DPC / Application Vetting [DevicePolicyManager.getPermis
				>	sionGrantState(); PackageManager manifest/requested-permissi
				>	on review]. Alert on a sequence or state change inconsistent
				>	with the device/app baseline, approved management policy, o
				>	r expected user workflow; do not infer unobserved API calls,
				>	file/process activity, or payload content from management s
				>	tate alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ApprovedAuthenticatorApps', 'description': 'MDM agent, approved authenticator, sync adapter apps. Minimal.'}, {'field': 'AccountEnumThreshold', 'description': 'Default 5 calls — sync adapters call getAccountsByType once per type; bulk = enumeration.'}, {'field': 'AccountEnumWindow', 'description': 'Default 60s.'}, {'field': 'AccountUplinkThreshold', 'description': 'Default 5KB — account metadata is small; even small upload is significant.'}, {'field': 'AppCDNList', 'description': 'Per-app CDN. Derive by measurement.'}, {'field': 'ExfilWindow', 'description': 'Default 120s.'}]

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.378000+00:00	2026-10-13 17:41:52.670000+00:00
description	OLD: Monitor for API calls that are related to the AccountManager API on Android and Keychain services on iOS. Application vetting services may look for `MANAGE_ACCOUNTS` in an Android application’s manifest. Most applications do not need access to accounts, so extra scrutiny may be applied to those that request it. NEW: A defender observes an Android application invoking the AccountManager API.	For Android, detect Accounts by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: AccountManager.getAccounts() OR getAccountsByType() called > $AccountEnumThreshold$ times within $AccountEnumWindow$ by app NOT IN $ApprovedAuthenticatorApps$]; Network Traffic Flow via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]; Permissions Request via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'android:logcat', 'channel': 'Invocation of AccountManager.getAccounts()'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: AccountManager.getAccounts() OR getAccountsByType() called > $AccountEnumThreshold$ times within $AccountEnumWindow$ by app NOT IN $ApprovedAuthenticatorApps$'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'android:EnterpriseNetworkLog', 'channel': 'DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata'}
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--e2f72131-14d1-411f-8e8c-aa3453dd5456', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}

[AN1709] Analytic 1709

Current version: 1.0

	Old Description			New Description
t	1	Monitor for API calls that are related to the AccountManager	t	1	For iOS, detect Accounts by correlating analyst-visible devi
	>	API on Android and Keychain services on iOS. Application ve		>	ce/network evidence and management state; use streaming or b
	>	tting services may look for `MANAGE_ACCOUNTS` in an Android		>	atched telemetry only where the documented collector is depl
	>	application’s manifest. Most applications do not need access		>	oyed. Correlate API Calls via Application Vetting / Instrume
	>	to accounts, so extra scrutiny may be applied to those that		>	nted Dynamic Analysis [Dynamic API/runtime trace: SecItemCop
	>	request it.		>	yMatching() called with kSecMatchLimitAll]; Application Perm
				>	ission via Application Vetting [Code-signing entitlements an
				>	d Info.plist privacy usage-description keys]; Network Traffi
				>	c Content via Enterprise Secure Web Gateway / Proxy [DNS/HTT
				>	P(S) inspection or proxy transaction metadata where enterpri
				>	se decryption/inspection is deployed]. Alert on a sequence o
				>	r state change inconsistent with the device/app baseline, ap
				>	proved management policy, or expected user workflow; do not
				>	infer unobserved API calls, file/process activity, or payloa
				>	d content from management state alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'AccountUplinkThreshold', 'description': 'Default 5KB — credential metadata is small.'}, {'field': 'AppCDNList', 'description': 'Per-app CDN. Derive by measurement.'}, {'field': 'ExfilWindow', 'description': 'Default 120s.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:41:53.326000+00:00
description	Monitor for API calls that are related to the AccountManager API on Android and Keychain services on iOS. Application vetting services may look for `MANAGE_ACCOUNTS` in an Android application’s manifest. Most applications do not need access to accounts, so extra scrutiny may be applied to those that request it.	For iOS, detect Accounts by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: SecItemCopyMatching() called with kSecMatchLimitAll]; Application Permission via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]; Network Traffic Content via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'Process', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: SecItemCopyMatching() called with kSecMatchLimitAll'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'Application Vetting', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'mobile:ApplicationVetting', 'channel': 'Code-signing entitlements and Info.plist privacy usage-description keys'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'webproxy:applog', 'channel': 'DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed'}

[AN1710] Analytic 1710

Current version: 1.1

	Old Description			New Description
t	1	Defender observes an app (package/UID) repeatedly querying d	t	1	For Android, detect System Network Connections Discovery by
	>	evice networking context APIs (Wi-Fi scan results/current SS		>	correlating analyst-visible device/network evidence and mana
	>	ID/BSSID, Bluetooth device discovery, or cellular tower list		>	gement state; use streaming or batched telemetry only where
	>	s) at a rate or timing inconsistent with the app’s normal UX		>	the documented collector is deployed. Correlate API Calls vi
	>	, often while backgrounded. Correlate API calls with permiss		>	a Application Vetting / Instrumented Dynamic Analysis [Dynam
	>	ion usage (fine location, nearby devices/Bluetooth) and conc		>	ic API/runtime trace: WifiInfo.getBSSID()]; Network Connecti
	>	urrent connectivity probes (DNS lookups/ARP/port reachabilit		>	on Creation via Android Enterprise Network Logging / Enterpr
	>	y) to distinguish automated discovery from user-initiated se		>	ise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent
	>	ttings checks. The detection is based on observed API execut		>	/ ConnectEvent; VPN flow metadata]; Permissions Request via
	>	ion + permission use + rate/sequence, not the specific API m		>	Android Enterprise DPC / Application Vetting [DevicePolicyM
	>	ethod name.		>	anager.getPermissionGrantState(); PackageManager manifest/re
				>	quested-permission review]. Alert on a sequence or state cha
				>	nge inconsistent with the device/app baseline, approved mana
				>	gement policy, or expected user workflow; do not infer unobs
				>	erved API calls, file/process activity, or payload content f
				>	rom management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.380000+00:00	2026-10-13 17:41:16.029000+00:00
description	Defender observes an app (package/UID) repeatedly querying device networking context APIs (Wi-Fi scan results/current SSID/BSSID, Bluetooth device discovery, or cellular tower lists) at a rate or timing inconsistent with the app’s normal UX, often while backgrounded. Correlate API calls with permission usage (fine location, nearby devices/Bluetooth) and concurrent connectivity probes (DNS lookups/ARP/port reachability) to distinguish automated discovery from user-initiated settings checks. The detection is based on observed API execution + permission use + rate/sequence, not the specific API method name.	For Android, detect System Network Connections Discovery by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: WifiInfo.getBSSID()]; Network Connection Creation via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]; Permissions Request via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[3]	{'field': 'BackgroundOnly', 'description': 'Require app to be backgrounded during discovery to suppress legitimate UI-driven network selection.'}	{'field': 'FollowOnWindow', 'description': 'Default 120s.'}
x_mitre_mutable_elements[1]	{'field': 'MinScanCalls', 'description': 'Minimum number of scan/enumeration calls per window before flagging (e.g., ≥3 Wi-Fi scans / 5 min).'}	{'field': 'NetworkScanWindow', 'description': 'Default 30s — multi-radio scan is rapid.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--85a533a4-5fa4-4dba-b45d-f0717bedd6e6', 'name': 'android:appops', 'channel': 'ACCESS_FINE_LOCATION\|NEARBY_DEVICES\|BLUETOOTH_SCAN used in close proximity to network-context queries'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: WifiInfo.getBSSID()'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindowSeconds', 'description': 'Correlation window to link scan/enumeration API usage with subsequent probes (e.g., 30–300s).'}	{'field': 'LocationAllowList', 'description': 'Navigation, mapping, enterprise fleet apps. Derive from MDM catalog.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'android:logcat', 'channel': 'wifiservice startScan / scanResults retrieved repeatedly or by unexpected package'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba', 'name': 'android:EnterpriseNetworkLog', 'channel': 'DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata'}
x_mitre_mutable_elements[2]	{'field': 'MinUniqueTargets', 'description': 'For Bluetooth/cell, minimum unique devices/towers observed per window (helps avoid single-device noise).'}	{'field': 'AppCDNList', 'description': 'Per-app CDN. Derive by measurement.'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'android:logcat', 'channel': 'bluetoothmanager startDiscovery / getBondedDevices / scan callback bursts by package'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--e2f72131-14d1-411f-8e8c-aa3453dd5456', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'android:logcat', 'channel': 'telephony cell info enumeration bursts (neighboring/all cell info) by package'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'NSM:Flow', 'channel': 'burst of DNS queries/connection attempts to RFC1918 or local gateway immediately after scans'}
x_mitre_mutable_elements	{'field': 'AllowlistedPackages', 'description': 'Packages expected to scan (system settings, Wi-Fi managers, MDM, enterprise connectivity tools).'}
x_mitre_mutable_elements	{'field': 'LocationPermissionRequired', 'description': 'If true, require AppOps noteOp for fine location/nearby devices to reduce false positives.'}
x_mitre_mutable_elements	{'field': 'LocalProbeCIDRs', 'description': "CIDR ranges considered 'local discovery' targets (e.g., 192.168.0.0/16, 10.0.0.0/8)."}

[AN1711] Analytic 1711

Current version: 1.1

	Old Description			New Description
t	1	The defender correlates foreground service start or promotio	t	1	For Android, detect Foreground Persistence by correlating an
	>	n activity with persistent-notification presentation, long-l		>	alyst-visible device/network evidence and management state;
	>	ived application execution, and continued access to while-in		>	use streaming or batched telemetry only where the documented
	>	-use sensors or network activity outside expected user-drive		>	collector is deployed. Correlate Application State via Andr
	>	n context. The analytic looks for an application invoking fo		>	oid Enterprise / EMM [Managed package inventory/status and p
	>	reground service APIs, sustaining a foreground state longer		>	ackage metadata]; OS API Execution via Application Vetting /
	>	than expected for its declared role, and retaining camera, m		>	Instrumented Dynamic Analysis [Dynamic API/runtime trace: A
	>	icrophone, location, or other sensor access while the device		>	pp invokes startForegroundService() or startForeground() NOT
	>	is locked, the app lacks recent interaction, or the notific		>	IN $ApprovedForegroundServiceApps$]; System Settings via An
	>	ation identity/function does not match the application’s beh		>	droid Enterprise DPC [DevicePolicyManager policy/compliance/
	>	avior.		>	security-state queries and SecurityLog events where supporte
				>	d]. Alert on a sequence or state change inconsistent with th
				>	e device/app baseline, approved management policy, or expect
				>	ed user workflow; do not infer unobserved API calls, file/pr
				>	ocess activity, or payload content from management state alo
				>	ne.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.376000+00:00	2026-10-13 17:42:33.709000+00:00
description	The defender correlates foreground service start or promotion activity with persistent-notification presentation, long-lived application execution, and continued access to while-in-use sensors or network activity outside expected user-driven context. The analytic looks for an application invoking foreground service APIs, sustaining a foreground state longer than expected for its declared role, and retaining camera, microphone, location, or other sensor access while the device is locked, the app lacks recent interaction, or the notification identity/function does not match the application’s behavior.	For Android, detect Foreground Persistence by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application State via Android Enterprise / EMM [Managed package inventory/status and package metadata]; OS API Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: App invokes startForegroundService() or startForeground() NOT IN $ApprovedForegroundServiceApps$]; System Settings via Android Enterprise DPC [DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[1]	{'field': 'AllowedServiceTypes', 'description': 'Approved foreground service types and role-to-type mappings, especially for Android 14+ and later'}	{'field': 'ForegroundDurationThreshold', 'description': 'Default 3600s (1 hour) sustained foreground service. Legitimate foreground services (music playback, navigation) have user-aligned durations. Extended overnight foreground service is persistence abuse.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': 'Application calls startForegroundService() or startForeground() / ServiceCompat.startForeground() and transitions to persistent foreground-service execution at the start of the chain'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'android:EMM', 'channel': 'Managed package inventory/status and package metadata'}
x_mitre_mutable_elements[0]	{'field': 'AllowedAppList', 'description': 'Apps legitimately expected to run foreground services such as navigation, fitness, calling, media playback, enterprise VPN, accessibility, or device-management apps'}	{'field': 'ApprovedForegroundServiceApps', 'description': 'Media players, navigation apps, VoIP apps, approved fitness trackers — apps with legitimate foreground service need. Derive from MDM catalog. Tightening: strict list.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'MobileEDR:telemetry', 'channel': 'Persistent foreground-service notification is created, updated, or remains visible while app behavior or notification identity is inconsistent with declared function during the persistence interval'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes startForegroundService() or startForeground() NOT IN $ApprovedForegroundServiceApps$'}
x_mitre_mutable_elements[2]	{'field': 'ForegroundDurationThreshold', 'description': 'Duration a foreground service may legitimately remain active before suspicion increases'}	{'field': 'InteractionThreshold', 'description': 'Default 300s. Foreground service accessing sensors >5min after last user touch is covert.'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--56c2b384-77f8-461f-a71a-76f7888ebfb6', 'name': 'MobileEDR:telemetry', 'channel': 'Foreground service continues accessing camera, microphone, location, or other while-in-use sensors after service promotion and outside recent user interaction'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--56c2b384-77f8-461f-a71a-76f7888ebfb6', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_mutable_elements	{'field': 'SensorAfterPromotionWindow', 'description': 'Maximum expected delay between service promotion and sensor activation for legitimate workflows'}
x_mitre_mutable_elements	{'field': 'NotificationMismatchPatterns', 'description': 'Patterns indicating misleading or impersonating foreground notifications, such as benign-looking text or mismatched app function'}
x_mitre_mutable_elements	{'field': 'RecentInteractionThreshold', 'description': 'How recently the user must have interacted with the app for sensor or network activity to be considered expected'}
x_mitre_mutable_elements	{'field': 'UplinkBytesThreshold', 'description': 'Minimum sustained outbound volume or beacon frequency during persistent foreground execution'}

[AN1712] Analytic 1712

Current version: 1.1

	Old Description			New Description
t	1	Correlates (1) application access to or staging of local fil	t	1	For Android, detect File Deletion from documented management
	>	es likely to be of operational, evidentiary, or user value,		>	, network, or vetting evidence; treat state queries as perio
	>	(2) deletion of those files or wipe-like destructive actions		>	dic observations rather than real-time events. Correlate App
	>	through ordinary storage access, administrative controls, o		>	lication Permission via Android Enterprise DPC / Application
	>	r privileged/rooted paths, and (3) continued app or device a		>	Vetting [DevicePolicyManager.getPermissionGrantState(); Pac
	>	ctivity after deletion, including cleanup, concealment, or o		>	kageManager manifest/requested-permission review]; File Dele
	>	utbound transfer. The defender observes a causal chain where		>	tion via Application Vetting / Forensic Acquisition [Dynamic
	>	files are first accessed or prepared, then removed, and dev		>	filesystem trace or acquired app-container/filesystem artif
	>	ice-side behavior continues after evidence or data is gone.		>	acts: App deletes, truncates, or removes files that were rec
				>	ently written by the same app (collected data, staged exfil
				>	artifacts, operation logs) within $PostExfilCleanupWindow$ o
				>	f network upload event — post-exfil cleanup chain]; OS API E
				>	xecution via Application Vetting / Instrumented Dynamic Anal
				>	ysis [Dynamic API/runtime trace: App invokes file management
				>	, storage-clear, or wipe operations in background state foll
				>	owing network upload without user-initiated delete action].
				>	Alert on a sequence or state change inconsistent with the de
				>	vice/app baseline, approved management policy, or expected u
				>	ser workflow; do not infer unobserved API calls, file/proces
				>	s activity, or payload content from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.384000+00:00	2026-10-13 17:40:50.938000+00:00
description	Correlates (1) application access to or staging of local files likely to be of operational, evidentiary, or user value, (2) deletion of those files or wipe-like destructive actions through ordinary storage access, administrative controls, or privileged/rooted paths, and (3) continued app or device activity after deletion, including cleanup, concealment, or outbound transfer. The defender observes a causal chain where files are first accessed or prepared, then removed, and device-side behavior continues after evidence or data is gone.	For Android, detect File Deletion from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; File Deletion via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: App deletes, truncates, or removes files that were recently written by the same app (collected data, staged exfil artifacts, operation logs) within $PostExfilCleanupWindow$ of network upload event — post-exfil cleanup chain]; OS API Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: App invokes file management, storage-clear, or wipe operations in background state following network upload without user-initiated delete action]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--e905dad2-00d6-477c-97e8-800427abd0e8', 'name': 'MobileEDR:telemetry', 'channel': 'application deletes, truncates, or removes user, operational, or evidence-bearing files after prior access or staging and before later continued execution or communication'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes file management, storage-clear, or wipe operations in background state following network upload without user-initiated delete action'}
x_mitre_mutable_elements[1]	{'field': 'FileScopeSet', 'description': 'File paths, storage scopes, and data classes monitored for suspicious deletion, such as documents, databases, media, email stores, or update artifacts'}	{'field': 'EvidenceFilePatterns', 'description': 'Audio/video files in app private storage, SQLite databases, screenshot files, log files written by malware. Derive from expected malware artifact patterns.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:MDMLog', 'channel': 'application holds device administrator, device owner, or other managed authority capable of wipe or destructive device-level action before bulk file loss or wipe event'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindow', 'description': 'Correlation window between file access or staging, deletion event, and subsequent activity'}	{'field': 'PostExfilCleanupWindow', 'description': 'Default 300s after network upload event within which subsequent file deletions by the same app are causally linked to post-exfil cleanup. Tightening: 60s.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:MDMLog', 'channel': 'device posture indicates rooted, compromised, or non-compliant state before protected or atypical filesystem deletion activity'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--e905dad2-00d6-477c-97e8-800427abd0e8', 'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: App deletes, truncates, or removes files that were recently written by the same app (collected data, staged exfil artifacts, operation logs) within $PostExfilCleanupWindow$ of network upload event — post-exfil cleanup chain'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': 'application invokes file-management, package, storage, or administrative wipe operations immediately before loss of expected local files or file collections'}
x_mitre_mutable_elements	{'field': 'DeletionVolumeThreshold', 'description': 'Threshold for number, size, or concentration of deleted files required before escalation'}
x_mitre_mutable_elements	{'field': 'AllowedCleanupApps', 'description': 'Legitimate applications expected to rotate, purge, or clean up files in the environment'}
x_mitre_mutable_elements	{'field': 'ProtectedRoleSet', 'description': 'Administrative or rooted control paths that materially increase destructive file deletion capability'}
x_mitre_mutable_elements	{'field': 'UplinkBytesThreshold', 'description': 'Outbound traffic threshold used to distinguish exfiltration-linked cleanup from benign maintenance activity'}

[AN1713] Analytic 1713

Current version: 1.1

	Old Description			New Description
t	1	Defender correlates an Android-specific causal chain where d	t	1	For Android, detect Network Denial of Service by correlating
	>	evice connectivity degrades or oscillates across one or more		>	analyst-visible device/network evidence and management stat
	>	radios, applications lose or repeatedly reattempt network a		>	e; use streaming or batched telemetry only where the documen
	>	ccess, and the radio or network failure pattern is inconsist		>	ted collector is deployed. Correlate Application Permission
	>	ent with ordinary mobility, coverage transition, or user-ini		>	via Android Enterprise DPC / Application Vetting [DevicePoli
	>	tiated airplane mode behavior. The defender correlates radio		>	cyManager.getPermissionGrantState(); PackageManager manifest
	>	state, connectivity framework behavior, application state,		>	/requested-permission review]; OS API Execution via Applicat
	>	network session failures, and location/network-provider degr		>	ion Vetting / Instrumented Dynamic Analysis [Dynamic API/run
	>	adation to distinguish network denial effects from routine w		>	time trace: ConnectivityManager, TelephonyManager, or WifiMa
	>	eak-signal conditions.		>	nager framework callbacks report repeated failure, disable,
				>	or oscillation events outside expected coverage-transition p
				>	attern]; Protected Configuration via Android Enterprise DPC
				>	[DevicePolicyManager policy/compliance/security-state querie
				>	s and SecurityLog events where supported]. Alert on a sequen
				>	ce or state change inconsistent with the device/app baseline
				>	, approved management policy, or expected user workflow; do
				>	not infer unobserved API calls, file/process activity, or pa
				>	yload content from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.382000+00:00	2026-10-13 17:42:19.618000+00:00
description	Defender correlates an Android-specific causal chain where device connectivity degrades or oscillates across one or more radios, applications lose or repeatedly reattempt network access, and the radio or network failure pattern is inconsistent with ordinary mobility, coverage transition, or user-initiated airplane mode behavior. The defender correlates radio state, connectivity framework behavior, application state, network session failures, and location/network-provider degradation to distinguish network denial effects from routine weak-signal conditions.	For Android, detect Network Denial of Service by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; OS API Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: ConnectivityManager, TelephonyManager, or WifiManager framework callbacks report repeated failure, disable, or oscillation events outside expected coverage-transition pattern]; Protected Configuration via Android Enterprise DPC [DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--56c2b384-77f8-461f-a71a-76f7888ebfb6', 'name': 'android:MDMLog', 'channel': 'No user-initiated airplane mode, radio disablement, or managed network setting change occurred during repeated connectivity degradation'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}
x_mitre_log_source_references[3]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': 'Connectivity manager, telephony, Wi-Fi, network callback, or location-provider framework reports repeated unavailable, disconnected, suspended, or degraded state transitions'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--56c2b384-77f8-461f-a71a-76f7888ebfb6', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--6c62144a-cd5c-401c-ada9-58c4c74cd9d2', 'name': 'android:MDMLog', 'channel': 'Managed Wi-Fi, VPN, cellular, or location-related policy state remains unchanged while network capability degrades'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: ConnectivityManager, TelephonyManager, or WifiManager framework callbacks report repeated failure, disable, or oscillation events outside expected coverage-transition pattern'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'MobileEDR:telemetry', 'channel': 'Foreground or background applications remain active while network-dependent activity stalls, retries, or transitions into repeated failure state'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--6c62144a-cd5c-401c-ada9-58c4c74cd9d2', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'MobileEDR:telemetry', 'channel': 'App with network-, telephony-, Wi-Fi-, or location-adjacent capability is impacted by abrupt repeated service loss while permissions remain unchanged'}

[AN1714] Analytic 1714

Current version: 1.1

	Old Description			New Description
t	1	Defender correlates an iOS-specific reduced-confidence chain	t	1	For iOS, detect Network Denial of Service from documented ma
	>	where a managed or supervised device remains active but exp		>	nagement, network, or vetting evidence; treat state queries
	>	eriences abrupt loss of network-dependent functionality, rep		>	as periodic observations rather than real-time events. Corre
	>	eated session failure, or sustained communication inability		>	late Application State via Apple MDM [InstalledApplicationLi
	>	without matching configuration changes or ordinary user acti		>	st / ManagedApplicationList]; Protected Configuration via Ap
	>	on. Because direct radio-layer and RF-cause visibility is we		>	ple MDM [DeviceInformation / SecurityInfo / ProfileList / re
	>	aker on iOS, the defender emphasizes device posture, applica		>	strictions and compliance queries]; System Settings via Appl
	>	tion wake or foreground behavior during service loss, protec		>	e MDM [DeviceInformation / SecurityInfo / ProfileList / rest
	>	ted network-policy stability, and downstream failure pattern		>	rictions and compliance queries]. Alert on a sequence or sta
	>	s observed in VPN or proxy telemetry.		>	te change inconsistent with the device/app baseline, approve
				>	d management policy, or expected user workflow; do not infer
				>	unobserved API calls, file/process activity, or payload con
				>	tent from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.376000+00:00	2026-10-13 17:42:20.300000+00:00
description	Defender correlates an iOS-specific reduced-confidence chain where a managed or supervised device remains active but experiences abrupt loss of network-dependent functionality, repeated session failure, or sustained communication inability without matching configuration changes or ordinary user action. Because direct radio-layer and RF-cause visibility is weaker on iOS, the defender emphasizes device posture, application wake or foreground behavior during service loss, protected network-policy stability, and downstream failure patterns observed in VPN or proxy telemetry.	For iOS, detect Network Denial of Service from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Application State via Apple MDM [InstalledApplicationList / ManagedApplicationList]; Protected Configuration via Apple MDM [DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries]; System Settings via Apple MDM [DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--6c62144a-cd5c-401c-ada9-58c4c74cd9d2', 'name': 'iOS:MDMLog', 'channel': 'Managed Wi-Fi, VPN, cellular, or location-service policy remains unchanged while device connectivity repeatedly degrades'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'iOS:MDM', 'channel': 'InstalledApplicationList / ManagedApplicationList'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--56c2b384-77f8-461f-a71a-76f7888ebfb6', 'name': 'iOS:MDMLog', 'channel': 'No user-initiated airplane mode or radio-related setting change occurred while applications experience repeated network unavailability'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--6c62144a-cd5c-401c-ada9-58c4c74cd9d2', 'name': 'iOS:MDM', 'channel': 'DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'MobileEDR:telemetry', 'channel': 'Foreground or background applications remain active while network-dependent activity stalls, retries, or transitions into repeated failure state'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--56c2b384-77f8-461f-a71a-76f7888ebfb6', 'name': 'iOS:MDM', 'channel': 'DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': 'Observed network-path, reachability, DNS, transport, or location-provider framework reports repeated unavailable or failed state near active device use'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'MobileEDR:telemetry', 'channel': 'Network- or location-dependent app capability state remains unchanged while the app experiences sustained communication failure'}

[AN1715] Analytic 1715

Current version: 1.1

	Old Description			New Description
t	1	Correlates (1) changes to application visibility or user-fac	t	1	For Android, detect Hide Artifacts from documented managemen
	>	ing presence such as launcher component disablement, icon su		>	t, network, or vetting evidence; treat state queries as peri
	>	ppression, or reduced discoverability, (2) continued applica		>	odic observations rather than real-time events. Correlate Ap
	>	tion execution or privileged framework activity after that v		>	plication Permission via Android Enterprise DPC / Applicatio
	>	isibility reduction, and (3) follow-on behavior such as back		>	n Vetting [DevicePolicyManager.getPermissionGrantState(); Pa
	>	ground network communication, sensor access, or persistence-		>	ckageManager manifest/requested-permission review]. Alert on
	>	related state transitions. The defender observes a causal ch		>	a sequence or state change inconsistent with the device/app
	>	ain where an application becomes less visible to the user wh		>	baseline, approved management policy, or expected user work
	>	ile retaining or increasing operational activity.		>	flow; do not infer unobserved API calls, file/process activi
				>	ty, or payload content from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.380000+00:00	2026-10-13 17:42:48.238000+00:00
description	Correlates (1) changes to application visibility or user-facing presence such as launcher component disablement, icon suppression, or reduced discoverability, (2) continued application execution or privileged framework activity after that visibility reduction, and (3) follow-on behavior such as background network communication, sensor access, or persistence-related state transitions. The defender observes a causal chain where an application becomes less visible to the user while retaining or increasing operational activity.	For Android, detect Hide Artifacts from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]['name']	android:MDMLog	android:DevicePolicyManager
x_mitre_log_source_references[0]['channel']	managed app inventory or launcher-visible state changes show application remains installed but user-facing entry point or launcher component becomes disabled before later runtime activity	DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review
x_mitre_mutable_elements[0]	{'field': 'TimeWindow', 'description': 'Correlation window between visibility suppression and later hidden execution or network activity'}	{'field': 'KnownHeadlessApps', 'description': 'Apps designed to operate without launcher icons (MDM agent, enterprise background services). Derive from MDM catalog. Any non-whitelisted app that suppresses its launcher while remaining active is anomalous.'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_mutable_elements	{'field': 'AllowedAppList', 'description': 'Baseline of legitimate apps allowed to hide launcher presence or disable user-facing components'}
x_mitre_mutable_elements	{'field': 'ForegroundStateRequired', 'description': 'Whether post-hide activity is only suspicious when no foreground interaction occurs'}
x_mitre_mutable_elements	{'field': 'HiddenComponentThreshold', 'description': 'Threshold for number or type of launcher-visible components disabled before raising suspicion'}
x_mitre_mutable_elements	{'field': 'UplinkBytesThreshold', 'description': 'Minimum outbound traffic volume used to distinguish meaningful hidden operation from benign background telemetry'}
x_mitre_mutable_elements	{'field': 'SensorAfterHideThreshold', 'description': 'Threshold for sensor access frequency after visibility suppression'}

[AN1716] Analytic 1716

Current version: 1.1

	Old Description			New Description
t	1	An application performs explicit cryptographic operations (e	t	1	For Android, detect Encrypted Channel from documented manage
	>	.g., symmetric/asymmetric encryption routines) on locally co		>	ment, network, or vetting evidence; treat state queries as p
	>	llected or generated data, followed by structured outbound n		>	eriodic observations rather than real-time events. Correlate
	>	etwork communication that does not align with expected appli		>	Application Permission via Android Enterprise DPC / Applica
	>	cation behavior, particularly when occurring in the backgrou		>	tion Vetting [DevicePolicyManager.getPermissionGrantState();
	>	nd or without user interaction. Detection correlates crypto		>	PackageManager manifest/requested-permission review]; Appli
	>	API usage + data staging + application state + network trans		>	cation State via Android Enterprise / EMM [Managed package i
	>	mission patterns.		>	nventory/status and package metadata]; File Creation via App
				>	lication Vetting / Forensic Acquisition [Dynamic filesystem
				>	trace or acquired app-container/filesystem artifacts: App wr
				>	ites high-entropy blob (Shannon entropy > $EntropyThreshold$
				>	) to local staging path immediately before outbound transmis
				>	sion — encrypted staging artifact confirms app-layer encrypt
				>	ion occurred]. Alert on a sequence or state change inconsist
				>	ent with the device/app baseline, approved management policy
				>	, or expected user workflow; do not infer unobserved API cal
				>	ls, file/process activity, or payload content from managemen
				>	t state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.383000+00:00	2026-10-13 17:42:31.641000+00:00
description	An application performs explicit cryptographic operations (e.g., symmetric/asymmetric encryption routines) on locally collected or generated data, followed by structured outbound network communication that does not align with expected application behavior, particularly when occurring in the background or without user interaction. Detection correlates crypto API usage + data staging + application state + network transmission patterns.	For Android, detect Encrypted Channel from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; Application State via Android Enterprise / EMM [Managed package inventory/status and package metadata]; File Creation via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: App writes high-entropy blob (Shannon entropy > $EntropyThreshold$) to local staging path immediately before outbound transmission — encrypted staging artifact confirms app-layer encryption occurred]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[3]	{'field': 'ForegroundStateRequired', 'description': 'Whether encryption + transmission should only occur during user interaction'}	{'field': 'InteractionThreshold', 'description': 'Default 300s.'}
x_mitre_mutable_elements[1]	{'field': 'EntropyThreshold', 'description': 'Threshold for detecting encoded/encrypted payloads based on entropy scoring'}	{'field': 'EntropyThreshold', 'description': 'Default 7.0 bits Shannon entropy for staged file. Calibrate from legitimate app file baseline. Files above threshold are likely encrypted or compressed.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': 'App invokes cryptographic functions (e.g., AES/RSA/KeyStore usage) on buffer data followed by encode/transform operations not tied to normal app workflows'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}
x_mitre_log_source_references[3]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:MDMLog', 'channel': 'App not in enterprise-approved list performing network + crypto behavior inconsistent with declared functionality'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes cryptographic functions (javax.crypto.Cipher, Android KeyStore, AES/RSA/ECC operations) on data buffer followed by encode-then-transmit sequence NOT matching app declared network function — app-layer crypto on data before transm'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindow', 'description': 'Time correlation between crypto operation and outbound network transmission'}	{'field': 'ApprovedCryptoApps', 'description': 'VPN clients, enterprise secure messaging (Signal, approved messaging), MDM agent, encryption-declared apps. Derive from MDM catalog.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'MobileEDR:telemetry', 'channel': 'App writes encoded/encrypted blobs (high entropy data) to local storage or memory buffers prior to transmission'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'android:EMM', 'channel': 'Managed package inventory/status and package metadata'}
x_mitre_mutable_elements[2]	{'field': 'AllowedCryptoApps', 'description': 'Apps expected to perform encryption (e.g., VPNs, messaging apps)'}	{'field': 'AppCDNList', 'description': '30-day per-app network destination baseline.'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'MobileEDR:telemetry', 'channel': 'Crypto + data staging occurs while app_state=background OR device_locked=true OR no recent user interaction'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: App writes high-entropy blob (Shannon entropy > $EntropyThreshold$) to local staging path immediately before outbound transmission — encrypted staging artifact confirms app-layer encryption occurred'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_mutable_elements	{'field': 'BeaconIntervalVariance', 'description': 'Expected jitter/interval for legitimate app traffic vs beaconing patterns'}

[AN1718] Analytic 1718

Current version: 1.1

	Old Description			New Description
t	1	Correlates (1) application interaction with elevation contro	t	1	For Android, detect Abuse Elevation Control Mechanism from d
	>	l mechanisms (e.g., Accessibility Service, Device Admin, ove		>	ocumented management, network, or vetting evidence; treat st
	>	rlay permissions, package installer flows), (2) rapid transi		>	ate queries as periodic observations rather than real-time e
	>	tion to elevated capability state without expected user inte		>	vents. Correlate Application Permission via Android Enterpri
	>	raction patterns, and (3) immediate privileged actions such		>	se DPC / Application Vetting [DevicePolicyManager.getPermiss
	>	as sensor access, UI manipulation, or background persistence		>	ionGrantState(); PackageManager manifest/requested-permissio
	>	. The defender observes a causal chain where an application		>	n review]; OS API Execution via Application Vetting / Instru
	>	gains elevated privileges through abuse of system-controlled		>	mented Dynamic Analysis [Dynamic API/runtime trace: App invo
	>	consent flows and subsequently performs actions inconsisten		>	kes privileged framework APIs (accessibility performAction,
	>	t with normal user-driven authorization.		>	WindowManager.addView TYPE_APPLICATION_OVERLAY, PackageInsta
				>	ller) immediately after acquiring elevation control mechanis
				>	m without expected user settings navigation time]. Alert on
				>	a sequence or state change inconsistent with the device/app
				>	baseline, approved management policy, or expected user workf
				>	low; do not infer unobserved API calls, file/process activit
				>	y, or payload content from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.376000+00:00	2026-10-13 17:42:46.170000+00:00
description	Correlates (1) application interaction with elevation control mechanisms (e.g., Accessibility Service, Device Admin, overlay permissions, package installer flows), (2) rapid transition to elevated capability state without expected user interaction patterns, and (3) immediate privileged actions such as sensor access, UI manipulation, or background persistence. The defender observes a causal chain where an application gains elevated privileges through abuse of system-controlled consent flows and subsequently performs actions inconsistent with normal user-driven authorization.	For Android, detect Abuse Elevation Control Mechanism from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; OS API Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: App invokes privileged framework APIs (accessibility performAction, WindowManager.addView TYPE_APPLICATION_OVERLAY, PackageInstaller) immediately after acquiring elevation control mechanism without expected user settings navigation time]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[1]	{'field': 'HighRiskPermissionSet', 'description': 'List of permissions or access types considered high-risk (Accessibility, Device Admin, overlay)'}	{'field': 'ElevationActionWindow', 'description': 'Default 30s between permission acquisition and privileged action invocation. Legitimate use requires user to navigate settings before granting; immediate action post-acquisition is suspicious.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:MDMLog', 'channel': 'application granted high-risk permission or special access (AccessibilityService, SYSTEM_ALERT_WINDOW, DeviceAdmin) with abnormal grant pattern (e.g., no recent user interaction or rapid sequence of grants)'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindow', 'description': 'Defines correlation window between permission grant and privileged behavior'}	{'field': 'ElevationAllowList', 'description': 'Approved apps for each elevation mechanism: accessibility (approved screen readers), SYSTEM_ALERT_WINDOW (approved chat bubbles), INSTALL_PACKAGES (MDM agent, approved enterprise installer). Derive from MDM catalog.'}
x_mitre_mutable_elements[2]	{'field': 'UserInteractionThreshold', 'description': 'Defines acceptable proximity of user interaction to permission grant'}	{'field': 'TargetAppList', 'description': 'Banking, auth, enterprise apps. Elevation control abuse against these is high-confidence malicious.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': 'application invokes privileged framework APIs (Accessibility events, UI automation, package install flows) immediately following permission grant'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes privileged framework APIs (accessibility performAction, WindowManager.addView TYPE_APPLICATION_OVERLAY, PackageInstaller) immediately after acquiring elevation control mechanism without expected user settings navigation time'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_mutable_elements	{'field': 'AllowedAppList', 'description': 'Baseline of legitimate apps expected to use high-risk permissions'}

[AN1719] Analytic 1719

Current version: 1.1

	Old Description			New Description
t	1	From the defender view: an app registers a clipboard listene	t	1	For Android, detect Clipboard Data by correlating analyst-vi
	>	r or calls ClipboardManager getters; the app is (a) foregrou		>	sible device/network evidence and management state; use stre
	>	nd, (b) the default IME, or (c) abusing legacy paths. Shortl		>	aming or batched telemetry only where the documented collect
	>	y after each clipboard change, the app reads the primary cli		>	or is deployed. Correlate API Calls via Application Vetting
	>	p repeatedly, optionally persists content (local file/DB) an		>	/ Instrumented Dynamic Analysis [Dynamic API/runtime trace:
	>	d/or exfiltrates it. We correlate: listener/clip-access → pr		>	ClipboardManager.addOnPrimaryClipChangedListener()]; Applica
	>	ivilege/foreground confirmation → bursty reads → local write		>	tion State via Android Enterprise / EMM [Managed package inv
	>	and/or network egress within a tight window.		>	entory/status and package metadata]; Network Connection Crea
				>	tion via Android Enterprise Network Logging / Enterprise VPN
				>	[DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / Conn
				>	ectEvent; VPN flow metadata]. Alert on a sequence or state c
				>	hange inconsistent with the device/app baseline, approved ma
				>	nagement policy, or expected user workflow; do not infer uno
				>	bserved API calls, file/process activity, or payload content
				>	from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.377000+00:00	2026-10-13 17:41:06.660000+00:00
description	From the defender view: an app registers a clipboard listener or calls ClipboardManager getters; the app is (a) foreground, (b) the default IME, or (c) abusing legacy paths. Shortly after each clipboard change, the app reads the primary clip repeatedly, optionally persists content (local file/DB) and/or exfiltrates it. We correlate: listener/clip-access → privilege/foreground confirmation → bursty reads → local write and/or network egress within a tight window.	For Android, detect Clipboard Data by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: ClipboardManager.addOnPrimaryClipChangedListener()]; Application State via Android Enterprise / EMM [Managed package inventory/status and package metadata]; Network Connection Creation via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[3]	{'field': 'ExfilDomainAllowlist', 'description': 'Allowlisted domains to suppress false positives for analytics SDKs.'}	{'field': 'AppCDNList', 'description': 'Per-app CDN. Derive by measurement.'}
x_mitre_mutable_elements[1]	{'field': 'MinReadBurst', 'description': 'Minimum reads per clipboard change to flag harvesting (e.g., ≥2).'}	{'field': 'SensitiveClipPattern', 'description': 'Bitcoin/Ethereum wallet regex, IBAN format, password-manager copy markers. Tunable to org-specific patterns.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'android:logcat', 'channel': 'ClipboardManager (addOnPrimaryClipChangedListener\|getPrimaryClip\|getPrimaryClipDescription) invoked by '}	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: ClipboardManager.addOnPrimaryClipChangedListener()'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindowSeconds', 'description': 'Max time between clip access → persist/exfil (e.g., 5–45s).'}	{'field': 'ClipboardAllowList', 'description': 'Approved IME apps, approved password managers. Derive from MDM catalog.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--1887a270-576a-4049-84de-ef746b2572d6', 'name': 'android:logcat', 'channel': 'Activity/Process state change (mFocusedApp, onResume/onPause) identifying as foreground'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'android:EMM', 'channel': 'Managed package inventory/status and package metadata'}
x_mitre_mutable_elements[2]	{'field': 'PersistPathRegex', 'description': 'Regex for files/DBs used to stash clipboard content in app container.'}	{'field': 'ClipExfilWindow', 'description': 'Default 10s — clipboard replacement is synchronous.'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'android:logcat', 'channel': 'Default IME active or bound to (InputMethodManager reports imeId=)'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba', 'name': 'android:EnterpriseNetworkLog', 'channel': 'DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'android:logcat', 'channel': 'CREATE/WRITE to app-writable DB/file path indicating clipboard dump (e.g., clipboard.db, clip_*.txt)'}
x_mitre_mutable_elements	{'field': 'ForegroundRequired', 'description': 'Require foreground unless app is the default IME (true/false).'}
x_mitre_mutable_elements	{'field': 'UserContext', 'description': 'Work Profile/Developer Mode/Doze to scope alerts.'}

[AN1720] Analytic 1720

Current version: 1.1

	Old Description			New Description
t	1	From the defender view: an app accesses UIPasteboard content	t	1	For iOS, detect Clipboard Data by correlating analyst-visibl
	>	s, sometimes repeatedly, including in background or immediat		>	e device/network evidence and management state; use streamin
	>	ely after another app copies sensitive text. iOS 14+ shows u		>	g or batched telemetry only where the documented collector i
	>	ser notifications when pasting cross-app; unified logs refle		>	s deployed. Correlate API Calls via Application Vetting / In
	>	ct pasteboard access, notification, and optional subsequent		>	strumented Dynamic Analysis [Dynamic API/runtime trace: UIPa
	>	persistence/exfil. We correlate: pasteboard access → optiona		>	steboard.general.string property accessed by app]; Network C
	>	l cross-app notification → local write (cache/DB) and/or net		>	onnection Creation via Apple Network Extension / Enterprise
	>	work egress within a short window.		>	VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow me
				>	tadata]; System Notifications via Managed App Telemetry / Ap
				>	ple MDM [ManagedApplicationFeedback or application-generated
				>	telemetry]. Alert on a sequence or state change inconsisten
				>	t with the device/app baseline, approved management policy,
				>	or expected user workflow; do not infer unobserved API calls
				>	, file/process activity, or payload content from management
				>	state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.376000+00:00	2026-10-13 17:41:07.295000+00:00
description	From the defender view: an app accesses UIPasteboard contents, sometimes repeatedly, including in background or immediately after another app copies sensitive text. iOS 14+ shows user notifications when pasting cross-app; unified logs reflect pasteboard access, notification, and optional subsequent persistence/exfil. We correlate: pasteboard access → optional cross-app notification → local write (cache/DB) and/or network egress within a short window.	For iOS, detect Clipboard Data by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: UIPasteboard.general.string property accessed by app]; Network Connection Creation via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]; System Notifications via Managed App Telemetry / Apple MDM [ManagedApplicationFeedback or application-generated telemetry]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[3]	{'field': 'ExfilDomainAllowlist', 'description': 'Allowlisted analytics/CDN endpoints.'}	{'field': 'AppCDNList', 'description': 'Per-app CDN. Derive by measurement.'}
x_mitre_mutable_elements[1]	{'field': 'MinReadBurst', 'description': 'Minimum reads within window to flag harvesting (e.g., ≥2).'}	{'field': 'PasteNotifWindow', 'description': 'Default 5s — iOS generates notification synchronously.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'iOS:unifiedlog', 'channel': 'UIPasteboard read (general/string/data) by ; repeated reads or background access'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: UIPasteboard.general.string property accessed by app'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindowSeconds', 'description': 'Max time between pasteboard access → persist/exfil (e.g., 5–60s).'}	{'field': 'SensitiveClipPattern', 'description': 'Wallet/IBAN/credential regex. Tunable to org context.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--bf0ff551-a5a7-40e5-bff9-f9405011b1f4', 'name': 'iOS:unifiedlog', 'channel': '\\"has pasted from\\" cross-app paste notification text containing source app name'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba', 'name': 'iOS:NetworkExtension', 'channel': 'NEFilterFlow / per-app VPN / secure-web-gateway flow metadata'}
x_mitre_mutable_elements[2]	{'field': 'PersistPathRegex', 'description': 'Regex for paste dumps in app container.'}	{'field': 'ClipExfilWindow', 'description': 'Default 10s.'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'iOS:unifiedlog', 'channel': 'CREATE/WRITE of clipboard dump artifacts in container (clipboard.db, clip_*.txt, caches)'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--bf0ff551-a5a7-40e5-bff9-f9405011b1f4', 'name': 'iOS:ManagedAppLog', 'channel': 'ManagedApplicationFeedback or application-generated telemetry'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--1887a270-576a-4049-84de-ef746b2572d6', 'name': 'iOS:unifiedlog', 'channel': 'Foreground/background transition for to contextualize access timing'}
x_mitre_mutable_elements	{'field': 'ForegroundRequired', 'description': 'Require foreground state for benign use; flag background reads.'}
x_mitre_mutable_elements	{'field': 'UserContext', 'description': 'Work profile/MDM policy state to scope alerts.'}

[AN1721] Analytic 1721

Current version: 1.1

	Old Description			New Description
t	1	From the defender view: a sandboxed process receives/creates	t	1	For iOS, detect Software Packing by correlating analyst-visi
	>	a high-entropy Mach-O/bundle or encrypted segment, performs		>	ble device/network evidence and management state; use stream
	>	in-memory decrypt/unpack (mmap/mprotect RW→RX or RWX), opti		>	ing or batched telemetry only where the documented collector
	>	onally drops a transient image in app-writable dirs, then lo		>	is deployed. Correlate Application Permission via Applicati
	>	ads it through dyld/dlopen or spawns it. We correlate: (1) o		>	on Vetting [Code-signing entitlements and Info.plist privacy
	>	paque blob write/arrival → (2) kernel memory protection chan		>	usage-description keys]; Network Traffic Flow via Apple Net
	>	ges → (3) dyld/dlopen from app-writable path or posix_spawn		>	work Extension / Enterprise VPN [NEFilterFlow / per-app VPN
	>	of a recently created image → (4) (optional) code-sign evalu		>	/ secure-web-gateway flow metadata]; Protected Configuration
	>	ation anomalies for the new image.		>	via Apple MDM [DeviceInformation / SecurityInfo / ProfileLi
				>	st / restrictions and compliance queries]. Alert on a sequen
				>	ce or state change inconsistent with the device/app baseline
				>	, approved management policy, or expected user workflow; do
				>	not infer unobserved API calls, file/process activity, or pa
				>	yload content from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.378000+00:00	2026-10-13 17:41:03.637000+00:00
description	From the defender view: a sandboxed process receives/creates a high-entropy Mach-O/bundle or encrypted segment, performs in-memory decrypt/unpack (mmap/mprotect RW→RX or RWX), optionally drops a transient image in app-writable dirs, then loads it through dyld/dlopen or spawns it. We correlate: (1) opaque blob write/arrival → (2) kernel memory protection changes → (3) dyld/dlopen from app-writable path or posix_spawn of a recently created image → (4) (optional) code-sign evaluation anomalies for the new image.	For iOS, detect Software Packing by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]; Network Traffic Flow via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]; Protected Configuration via Apple MDM [DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[3]	{'field': 'KnownJITAllowlist', 'description': 'Bundle IDs legitimately using JIT to avoid RWX false positives.'}	{'field': 'PostLaunchWindow', 'description': 'Default 300s after first app launch.'}
x_mitre_mutable_elements[1]	{'field': 'PayloadEntropyThreshold', 'description': 'Entropy to flag packed blobs (e.g., ≥ 7.3).'}	{'field': 'AppCDNList', 'description': 'Per-app declared CDN from app documentation or 30-day baseline.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'iOS:unifiedlog', 'channel': 'Create/write of high-entropy Mach-O/bundle or generic blob in /var/mobile/Containers/Data/Application//(tmp\|Library/Caches)/'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'mobile:ApplicationVetting', 'channel': 'Code-signing entitlements and Info.plist privacy usage-description keys'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindowSeconds', 'description': 'Correlation window from write→rwx→load/exec (e.g., 5–45s).'}	{'field': 'MDMApprovedCatalog', 'description': 'MDM-managed app list. All enterprise-cert-signed apps should be in this catalog.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'iOS:unifiedlog', 'channel': 'mmap/mprotect transitions to PROT_EXEC for pages associated with recently written files'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'iOS:NetworkExtension', 'channel': 'NEFilterFlow / per-app VPN / secure-web-gateway flow metadata'}
x_mitre_mutable_elements[2]	{'field': 'RWXPageMinKB', 'description': 'Minimum RWX allocation size (e.g., ≥ 32KB).'}	{'field': 'CertInstallWindow', 'description': 'Default 3600s between cert profile and app install.'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--c0a4a086-cc20-4e1e-b7cb-29d99dfa3fb1', 'name': 'iOS:unifiedlog', 'channel': 'dlopen/image load from app-writable path (tmp, Caches) outside bundled resources'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--6c62144a-cd5c-401c-ada9-58c4c74cd9d2', 'name': 'iOS:MDM', 'channel': 'DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_mutable_elements	{'field': 'WritableLoadPathRegex', 'description': 'Regex for app-writable load paths (tmp, Caches) outside app bundle.'}
x_mitre_mutable_elements	{'field': 'UnsignedExecPolicy', 'description': 'Tuning if enterprise/dev provisioning allows non-App Store binaries.'}

[AN1722] Analytic 1722

Current version: 1.1

	Old Description			New Description
t	1	From the defender view: a sandboxed app handles a high-entro	t	1	For Android, detect Software Packing by correlating analyst-
	>	py executable blob, performs rapid decode/decrypt in memory		>	visible device/network evidence and management state; use st
	>	(often with RW→RX or execmem friction), optionally emits a t		>	reaming or batched telemetry only where the documented colle
	>	ransient .dex/.so into app-writable paths, then immediately		>	ctor is deployed. Correlate File Metadata via Application Ve
	>	loads/executes it (DexClassLoader/dlopen) or spawns a helper		>	tting / Forensic Acquisition [Dynamic filesystem trace or ac
	>	. We correlate: (1) opaque blob write/arrival → (2) decode/u		>	quired app-container/filesystem artifacts: DEX file entropy
	>	npack or memory protection change → (3) new code artifact or		>	> $PackerEntropyThreshold$ at install time for app NOT IN $M
	>	byte[] class definition → (4) dynamic load/exec within a ti		>	DMApprovedCatalog$]; Module Load via Application Vetting / I
	>	ght window.		>	nstrumented Dynamic Analysis [Dynamic API/runtime trace: Dex
				>	ClassLoader() called at runtime with path NOT matching any f
				>	ile in original APK manifest within $PackerExecWindow$ of ap
				>	p launch]; Network Connection Creation via Android Enterpris
				>	e Network Logging / Enterprise VPN [DevicePolicyManager.retr
				>	ieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadat
				>	a]. Alert on a sequence or state change inconsistent with th
				>	e device/app baseline, approved management policy, or expect
				>	ed user workflow; do not infer unobserved API calls, file/pr
				>	ocess activity, or payload content from management state alo
				>	ne.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.382000+00:00	2026-10-13 17:41:03.044000+00:00
description	From the defender view: a sandboxed app handles a high-entropy executable blob, performs rapid decode/decrypt in memory (often with RW→RX or execmem friction), optionally emits a transient .dex/.so into app-writable paths, then immediately loads/executes it (DexClassLoader/dlopen) or spawns a helper. We correlate: (1) opaque blob write/arrival → (2) decode/unpack or memory protection change → (3) new code artifact or byte[] class definition → (4) dynamic load/exec within a tight window.	For Android, detect Software Packing by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate File Metadata via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: DEX file entropy > $PackerEntropyThreshold$ at install time for app NOT IN $MDMApprovedCatalog$]; Module Load via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: DexClassLoader() called at runtime with path NOT matching any file in original APK manifest within $PackerExecWindow$ of app launch]; Network Connection Creation via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[3]	{'field': 'ExecPathRegex', 'description': 'Regex for suspicious .dex/.so/.jar/temp paths under app container.'}	{'field': 'AppCDNList', 'description': 'Per-app CDN baseline. Derive by measurement.'}
x_mitre_mutable_elements[1]	{'field': 'PayloadEntropyThreshold', 'description': 'Entropy to flag packed blobs (e.g., ≥ 7.2).'}	{'field': 'MDMApprovedCatalog', 'description': 'MDM-managed app list. Apps in catalog are pre-vetted. Derive from MDM platform.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'android:logcat', 'channel': 'Create/write of high-entropy files in /data/data//(files\|cache)/ or /storage/emulated/0/<...> with .dex/.so/.jar/.tmp/.bin'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--639e87f3-acb6-448a-9645-258f20da4bc5', 'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: DEX file entropy > $PackerEntropyThreshold$ at install time for app NOT IN $MDMApprovedCatalog$'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindowSeconds', 'description': 'Correlation window from write→unpack→load (e.g., 5–45s; device-dependent).'}	{'field': 'PackerEntropyThreshold', 'description': 'Default 7.5 bits Shannon entropy. Legitimate DEX: ~6.5 bits. Calibrate from fleet clean-app baseline. Tightening: 7.8 — fewer FP on obfuscated legitimate apps.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--c0a4a086-cc20-4e1e-b7cb-29d99dfa3fb1', 'name': 'android:logcat', 'channel': 'DexClassLoader/PathClassLoader loading from app-writable path OR reflective defineClass on byte[] payload'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--c0a4a086-cc20-4e1e-b7cb-29d99dfa3fb1', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: DexClassLoader() called at runtime with path NOT matching any file in original APK manifest within $PackerExecWindow$ of app launch'}
x_mitre_mutable_elements[2]	{'field': 'RWXPageMinKB', 'description': 'Minimum RWX allocation size to reduce noise (e.g., ≥ 32KB).'}	{'field': 'PackerExecWindow', 'description': 'Default 300s after app launch. Tightening: 60s — catches immediate unpack.'}
x_mitre_mutable_elements[4]	{'field': 'KnownGoodLoadersAllowlist', 'description': 'Legit libraries/bundles expected to load from writable paths (test/dev builds).'}	{'field': 'PostLoadWindow', 'description': 'Default 120s.'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'android:logcat', 'channel': 'SELinux AVC for execmem/execute_no_trans/mprotect following recent writes by same UID'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba', 'name': 'android:EnterpriseNetworkLog', 'channel': 'DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'android:logcat', 'channel': 'dlopen of a recently created .so OR short-lived child (/system/bin/sh,toybox,linker) spawned by app_process'}
x_mitre_mutable_elements	{'field': 'UserContext', 'description': 'Foreground/background, Work Profile, developer mode to scope alerts.'}

[AN1723] Analytic 1723

Current version: 1.1

	Old Description			New Description
t	1	A lock-state transition telemetry, special access or privile	t	1	For Android, detect Lockscreen Bypass by correlating analyst
	>	ged interaction capability, security-sensitive framework use		>	-visible device/network evidence and management state; use s
	>	, and immediate downstream activity while the user-interacti		>	treaming or batched telemetry only where the documented coll
	>	on context is weak or inconsistent. This yields stronger cov		>	ector is deployed. Correlate Application Permission via Andr
	>	erage on Android than iOS.		>	oid Enterprise DPC / Application Vetting [DevicePolicyManage
				>	r.getPermissionGrantState(); PackageManager manifest/request
				>	ed-permission review]; Application State via Android Enterpr
				>	ise / EMM [Managed package inventory/status and package meta
				>	data]; Protected Configuration via Android Enterprise DPC [D
				>	evicePolicyManager policy/compliance/security-state queries
				>	and SecurityLog events where supported]. Alert on a sequence
				>	or state change inconsistent with the device/app baseline,
				>	approved management policy, or expected user workflow; do no
				>	t infer unobserved API calls, file/process activity, or payl
				>	oad content from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.377000+00:00	2026-10-13 17:40:51.508000+00:00
description	A lock-state transition telemetry, special access or privileged interaction capability, security-sensitive framework use, and immediate downstream activity while the user-interaction context is weak or inconsistent. This yields stronger coverage on Android than iOS.	For Android, detect Lockscreen Bypass by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; Application State via Android Enterprise / EMM [Managed package inventory/status and package metadata]; Protected Configuration via Android Enterprise DPC [DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[1]	{'field': 'AllowedAppList', 'description': 'Approved apps permitted to hold accessibility, overlay, device-admin, or other authentication-adjacent special access.'}	{'field': 'ElevationAllowList', 'description': 'Approved accessibility and Device Admin apps that may interact with lockscreen for legitimate purposes (enterprise kiosk). Derive from MDM catalog.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--6c62144a-cd5c-401c-ada9-58c4c74cd9d2', 'name': 'android:MDMLog', 'channel': 'Biometric, credential, lockscreen, trust-agent, Smart Lock, or device-admin-related protected device configuration changed'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindow', 'description': 'Maximum allowed time between locked-state boundary, suspicious app/framework activity, and unlock transition.'}	{'field': 'AuthPolicyAllowList', 'description': 'MDM-managed authentication policy changes only. Any lock policy weakening outside MDM-authorized change is anomalous. Derive from MDM policy management logs.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:MDMLog', 'channel': 'Application gains or is observed with elevated interaction capability such as accessibility, overlay, device admin, notification access, or other authentication-adjacent special access'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'android:EMM', 'channel': 'Managed package inventory/status and package metadata'}
x_mitre_mutable_elements[2]	{'field': 'ForegroundStateRequired', 'description': 'Whether a benign authentication-adjacent app is expected to be visible in the foreground during unlock-related operations.'}	{'field': 'LockBypassWindow', 'description': 'Default 10s between lock state and anomalous app activity. Lock-bypass is near-instantaneous.'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'MobileEDR:telemetry', 'channel': 'pplication or service remains active, foregrounds, or overlays during device locked state or immediately at unlock transition with weak recent user interaction context'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--6c62144a-cd5c-401c-ada9-58c4c74cd9d2', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_mutable_elements	{'field': 'RecentUserInteractionWindow', 'description': 'Time threshold for treating the unlock as user-driven based on touch, motion, or interaction context.'}
x_mitre_mutable_elements	{'field': 'ExpectedUnlockPopulation', 'description': 'User or device groups expected to use alternative lockscreen workflows, enterprise trust agents, or kiosk-like modes.'}
x_mitre_mutable_elements	{'field': 'TrustedDestinationAllowList', 'description': 'Expected destinations contacted immediately after legitimate unlock by enterprise apps.'}
x_mitre_mutable_elements	{'field': 'UplinkBytesThreshold', 'description': 'Threshold for suspicious immediate post-unlock outbound traffic.'}
x_mitre_mutable_elements	{'field': 'SensorUseAllowList', 'description': 'Apps expected to access camera or other sensors near the authentication boundary.'}

[AN1724] Analytic 1724

Current version: 1.1

	Old Description			New Description
t	1	Defender correlates an iOS-specific reduced-confidence chain	t	1	For iOS, detect Lockscreen Bypass from documented management
	>	where a supervised or managed device transitions from locke		>	, network, or vetting evidence; treat state queries as perio
	>	d or inactive state to interactive or application-active sta		>	dic observations rather than real-time events. Correlate App
	>	te with weak evidence of expected user authentication, often		>	lication State via Apple MDM [InstalledApplicationList / Man
	>	accompanied by abnormal protected posture change, trust-sta		>	agedApplicationList]; Protected Configuration via Apple MDM
	>	te change, unexpected app wake, sensor use, or immediate dow		>	[DeviceInformation / SecurityInfo / ProfileList / restrictio
	>	nstream communication. Because direct visibility into locksc		>	ns and compliance queries]. Alert on a sequence or state cha
	>	reen bypass mechanics on iOS is limited, the analytic priori		>	nge inconsistent with the device/app baseline, approved mana
	>	tizes strong device-state effects and post-unlock behavior r		>	gement policy, or expected user workflow; do not infer unobs
	>	ather than pretending to observe the exact bypass method.		>	erved API calls, file/process activity, or payload content f
				>	rom management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.379000+00:00	2026-10-13 17:40:52.102000+00:00
description	Defender correlates an iOS-specific reduced-confidence chain where a supervised or managed device transitions from locked or inactive state to interactive or application-active state with weak evidence of expected user authentication, often accompanied by abnormal protected posture change, trust-state change, unexpected app wake, sensor use, or immediate downstream communication. Because direct visibility into lockscreen bypass mechanics on iOS is limited, the analytic prioritizes strong device-state effects and post-unlock behavior rather than pretending to observe the exact bypass method.	For iOS, detect Lockscreen Bypass from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Application State via Apple MDM [InstalledApplicationList / ManagedApplicationList]; Protected Configuration via Apple MDM [DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[1]	{'field': 'AllowedAppList', 'description': 'Apps allowed to wake, foreground, or access protected resources near legitimate authentication events.'}	{'field': 'ElevationAllowList', 'description': 'Approved accessibility and Device Admin apps that may interact with lockscreen for legitimate purposes (enterprise kiosk). Derive from MDM catalog.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--6c62144a-cd5c-401c-ada9-58c4c74cd9d2', 'name': 'iOS:MDMLog', 'channel': 'Passcode, biometrics, attention-aware authentication, or supervised-device lock policy changed in a way that weakens or alters the authentication boundary'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'iOS:MDM', 'channel': 'InstalledApplicationList / ManagedApplicationList'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindow', 'description': 'Maximum allowed span between locked or inactive device state, suspicious app/service activity, and interactive transition.'}	{'field': 'AuthPolicyAllowList', 'description': 'MDM-managed authentication policy changes only. Any lock policy weakening outside MDM-authorized change is anomalous. Derive from MDM policy management logs.'}
x_mitre_mutable_elements[2]	{'field': 'SupervisedOnly', 'description': 'Whether the analytic should only apply to supervised devices with high-confidence MDM policy telemetry.'}	{'field': 'LockBypassWindow', 'description': 'Default 10s between lock state and anomalous app activity. Lock-bypass is near-instantaneous.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'MobileEDR:telemetry', 'channel': 'Application wakes, becomes active, refreshes, or foregrounds immediately after locked or inactive state transition with weak recent user interaction'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--6c62144a-cd5c-401c-ada9-58c4c74cd9d2', 'name': 'iOS:MDM', 'channel': 'DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_mutable_elements	{'field': 'RecentUserInteractionWindow', 'description': 'Time threshold for treating the transition as expected and user-driven.'}
x_mitre_mutable_elements	{'field': 'ExpectedUnlockPopulation', 'description': 'User or device groups expected to use atypical enterprise lockscreen workflows, kiosk-like modes, or accessibility accommodations.'}
x_mitre_mutable_elements	{'field': 'SensorUseAllowList', 'description': 'Apps expected to access camera or biometric-adjacent resources near the authentication boundary.'}
x_mitre_mutable_elements	{'field': 'TrustedDestinationAllowList', 'description': 'Expected destinations contacted immediately after legitimate app activation post-authentication.'}
x_mitre_mutable_elements	{'field': 'UplinkBytesThreshold', 'description': 'Threshold for suspicious immediate outbound traffic after suspicious unlock-adjacent activity.'}

[AN1725] Analytic 1725

Current version: 1.1

	Old Description			New Description
t	1	The defender correlates application TLS trust customization	t	1	For Android, detect SSL Pinning by correlating analyst-visib
	>	activity with subsequent outbound encrypted sessions that by		>	le device/network evidence and management state; use streami
	>	pass enterprise interception visibility or fail only under e		>	ng or batched telemetry only where the documented collector
	>	nterprise inspection conditions. The analytic looks for an a		>	is deployed. Correlate Application Permission via Android En
	>	pp establishing its own certificate or public-key trust logi		>	terprise DPC / Application Vetting [DevicePolicyManager.getP
	>	c, then initiating HTTPS sessions to destinations not aligne		>	ermissionGrantState(); PackageManager manifest/requested-per
	>	d with approved app behavior, especially from background sta		>	mission review]; Application State via Android Enterprise /
	>	te or without recent user interaction. Higher-confidence obs		>	EMM [Managed package inventory/status and package metadata];
	>	ervations come from Android runtime/framework telemetry show		>	Network Traffic Content via Enterprise Secure Web Gateway /
	>	ing custom trust manager, certificate validation override, o		>	Proxy [DNS/HTTP(S) inspection or proxy transaction metadata
	>	r pin validation logic immediately preceding network connect		>	where enterprise decryption/inspection is deployed]. Alert
	>	ion attempts, combined with network evidence of failed-inspe		>	on a sequence or state change inconsistent with the device/a
	>	ction patterns or opaque direct TLS sessions.		>	pp baseline, approved management policy, or expected user wo
				>	rkflow; do not infer unobserved API calls, file/process acti
				>	vity, or payload content from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.375000+00:00	2026-10-13 17:40:52.654000+00:00
description	The defender correlates application TLS trust customization activity with subsequent outbound encrypted sessions that bypass enterprise interception visibility or fail only under enterprise inspection conditions. The analytic looks for an app establishing its own certificate or public-key trust logic, then initiating HTTPS sessions to destinations not aligned with approved app behavior, especially from background state or without recent user interaction. Higher-confidence observations come from Android runtime/framework telemetry showing custom trust manager, certificate validation override, or pin validation logic immediately preceding network connection attempts, combined with network evidence of failed-inspection patterns or opaque direct TLS sessions.	For Android, detect SSL Pinning by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; Application State via Android Enterprise / EMM [Managed package inventory/status and package metadata]; Network Traffic Content via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[1]	{'field': 'AllowedAppList', 'description': 'Apps legitimately expected to implement SSL pinning such as banking, enterprise auth, or secure messaging apps'}	{'field': 'PinningFailureThreshold', 'description': 'Default 3 consecutive inspection failures from same app to same destination. Single failure may be transient.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': 'Application invokes custom TLS trust evaluation logic or pin validation routines (e.g., custom TrustManager, HostnameVerifier override, certificate/public key comparison) immediately before outbound TLS session establishment'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}
x_mitre_log_source_references[3]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'NSM:Flow', 'channel': 'Application initiates HTTPS connection with repeated certificate validation failure under enterprise proxy followed by direct network retry or stable opaque TLS communication to same endpoint within correlation window'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes custom TLS trust evaluation, OkHttp CertificatePinner, or custom-anchor TrustManager NOT IN $ApprovedPinningApps$ — custom pin validation is the evasion mechanism'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindow', 'description': 'Correlation window between trust customization activity and outbound TLS connection'}	{'field': 'ApprovedPinningApps', 'description': 'Banking, financial, healthcare apps with documented legitimate SSL pinning AND IT security review approval. Include with business justification. Tightening: empty — all custom TLS trust flagged for review.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'MobileEDR:telemetry', 'channel': 'TLS trust customization and outbound HTTPS session occur while app_state=background or device_locked=true or recent_user_interaction=false'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'android:EMM', 'channel': 'Managed package inventory/status and package metadata'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:MDMLog', 'channel': 'Managed app with undeclared secure transport behavior or app category mismatch initiates opaque TLS communications inconsistent with enterprise policy baseline'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'webproxy:applog', 'channel': 'DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'NSM:Inspection', 'channel': 'TLS session from mobile app fails, resets, or refuses enterprise interception while same destination/app pair repeatedly establishes direct encrypted communication pattern consistent with pinned certificate/public-key validation'}
x_mitre_mutable_elements	{'field': 'AllowedDestinationList', 'description': 'Approved domains, IPs, and service endpoints for managed applications'}
x_mitre_mutable_elements	{'field': 'ForegroundStateRequired', 'description': 'Whether the application is expected to establish pinned sessions only during active user-driven workflows'}
x_mitre_mutable_elements	{'field': 'InspectionFailureThreshold', 'description': 'Number of repeated inspection failures or certificate mismatch events before escalating'}
x_mitre_mutable_elements	{'field': 'RetryPatternWindow', 'description': 'Time tolerance for inspection failure followed by retry/direct connection pattern'}

[AN1726] Analytic 1726

Current version: 1.1

	Old Description			New Description
t	1	The defender correlates supervised-device application postur	t	1	For iOS, detect SSL Pinning by correlating analyst-visible d
	>	e and background execution context with network-side evidenc		>	evice/network evidence and management state; use streaming o
	>	e that an app rejects enterprise inspection or performs cert		>	r batched telemetry only where the documented collector is d
	>	ificate/public-key-bound trust behavior during TLS establish		>	eployed. Correlate Application Permission via Application Ve
	>	ment. Because direct app-level pin-validation observability		>	tting [Code-signing entitlements and Info.plist privacy usag
	>	is weaker on iOS, the analytic is anchored primarily to netw		>	e-description keys]; Application State via Apple MDM [Instal
	>	ork control-plane effects: repeated TLS handshake rejection		>	ledApplicationList / ManagedApplicationList]; Network Traffi
	>	under enterprise inspection, destination-specific inspection		>	c Content via Enterprise Secure Web Gateway / Proxy [DNS/HTT
	>	bypass patterns, or persistent opaque app-to-endpoint encry		>	P(S) inspection or proxy transaction metadata where enterpri
	>	pted sessions inconsistent with baseline app behavior. Addit		>	se decryption/inspection is deployed]. Alert on a sequence o
	>	ional confidence comes from managed app identity, background		>	r state change inconsistent with the device/app baseline, ap
	>	execution context, and supervised device policy state.		>	proved management policy, or expected user workflow; do not
				>	infer unobserved API calls, file/process activity, or payloa
				>	d content from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.380000+00:00	2026-10-13 17:40:53.259000+00:00
description	The defender correlates supervised-device application posture and background execution context with network-side evidence that an app rejects enterprise inspection or performs certificate/public-key-bound trust behavior during TLS establishment. Because direct app-level pin-validation observability is weaker on iOS, the analytic is anchored primarily to network control-plane effects: repeated TLS handshake rejection under enterprise inspection, destination-specific inspection bypass patterns, or persistent opaque app-to-endpoint encrypted sessions inconsistent with baseline app behavior. Additional confidence comes from managed app identity, background execution context, and supervised device policy state.	For iOS, detect SSL Pinning by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]; Application State via Apple MDM [InstalledApplicationList / ManagedApplicationList]; Network Traffic Content via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'NSM:Flow', 'channel': 'App-destination pair shows consistent inspection bypass/refusal pattern followed by direct encrypted communication or repeated short-lived TLS sessions to same endpoint within correlation window'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'webproxy:applog', 'channel': 'DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed'}
x_mitre_mutable_elements[1]	{'field': 'AllowedAppList', 'description': 'Managed apps expected to use certificate or public-key pinning for legitimate purposes'}	{'field': 'PinningFailureThreshold', 'description': 'Default 3 consecutive inspection failures from same app to same destination. Single failure may be transient.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'iOS:MDMLog', 'channel': 'Supervised managed app with undeclared secure transport behavior or unexpected network role communicates with non-baselined destination over opaque TLS'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'mobile:ApplicationVetting', 'channel': 'Code-signing entitlements and Info.plist privacy usage-description keys'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindow', 'description': 'Correlation window between app lifecycle event and network-side inspection failure or opaque TLS session'}	{'field': 'ApprovedPinningApps', 'description': 'Banking, financial, healthcare apps with documented legitimate SSL pinning AND IT security review approval. Include with business justification. Tightening: empty — all custom TLS trust flagged for review.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'MobileEDR:telemetry', 'channel': 'Managed app initiates or resumes network-capable execution while app_state=background or device_locked=true before opaque TLS session attempt'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'iOS:MDM', 'channel': 'InstalledApplicationList / ManagedApplicationList'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'NSM:Inspection', 'channel': 'TLS handshake from iOS app repeatedly fails or is rejected only when enterprise SSL inspection certificate is presented, indicating certificate or public-key pin validation effect'}
x_mitre_mutable_elements	{'field': 'AllowedDestinationList', 'description': 'Approved endpoints expected for legitimate pinned sessions'}
x_mitre_mutable_elements	{'field': 'ForegroundStateRequired', 'description': 'Whether the app is expected to perform network establishment only during user-driven workflows'}
x_mitre_mutable_elements	{'field': 'InspectionFailureThreshold', 'description': 'Number of repeated TLS-inspection failures needed before escalating confidence'}

[AN1727] Analytic 1727

Current version: 1.1

	Old Description			New Description
t	1	The defender correlates application registration for system	t	1	For Android, detect Event Triggered Execution from documente
	>	event triggers (e.g., broadcast receivers, WorkManager, JobS		>	d management, network, or vetting evidence; treat state quer
	>	cheduler, SMS/BOOT events) with subsequent execution of appl		>	ies as periodic observations rather than real-time events. C
	>	ication code immediately following the triggering event, wit		>	orrelate Application State via Android Enterprise / EMM [Man
	>	hout direct user interaction. Confidence increases when exec		>	aged package inventory/status and package metadata]; OS API
	>	ution occurs in background or locked state, is tied to sensi		>	Execution via Application Vetting / Instrumented Dynamic Ana
	>	tive triggers (SMS received, boot completed, connectivity ch		>	lysis [Dynamic API/runtime trace: App registers BroadcastRec
	>	ange), and produces follow-on file or network activity incon		>	eiver or schedules job for system events (BOOT_COMPLETED, SM
	>	sistent with the application’s expected role.		>	S_RECEIVED, ACTION_PACKAGE_REPLACED, CONNECTIVITY_CHANGE, AC
				>	TION_USER_PRESENT) NOT IN $ApprovedEventTriggerApps$ — sensi
				>	tive system event registration is ]. Alert on a sequence or
				>	state change inconsistent with the device/app baseline, appr
				>	oved management policy, or expected user workflow; do not in
				>	fer unobserved API calls, file/process activity, or payload
				>	content from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.375000+00:00	2026-10-13 17:42:44.655000+00:00
description	The defender correlates application registration for system event triggers (e.g., broadcast receivers, WorkManager, JobScheduler, SMS/BOOT events) with subsequent execution of application code immediately following the triggering event, without direct user interaction. Confidence increases when execution occurs in background or locked state, is tied to sensitive triggers (SMS received, boot completed, connectivity change), and produces follow-on file or network activity inconsistent with the application’s expected role.	For Android, detect Event Triggered Execution from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Application State via Android Enterprise / EMM [Managed package inventory/status and package metadata]; OS API Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: App registers BroadcastReceiver or schedules job for system events (BOOT_COMPLETED, SMS_RECEIVED, ACTION_PACKAGE_REPLACED, CONNECTIVITY_CHANGE, ACTION_USER_PRESENT) NOT IN $ApprovedEventTriggerApps$ — sensitive system event registration is ]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': 'Application registers broadcast receiver, WorkManager job, JobScheduler task, or intent filter tied to system event such as BOOT_COMPLETED, SMS_RECEIVED, CONNECTIVITY_CHANGE during persistence setup phase'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'android:EMM', 'channel': 'Managed package inventory/status and package metadata'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindow', 'description': 'Correlation window between event trigger occurrence and execution behavior'}	{'field': 'ApprovedEventTriggerApps', 'description': 'MDM agent (BOOT_COMPLETED for policy enforcement), approved enterprise apps with documented event trigger need. Derive from MDM catalog. Tightening: MDM agent and system apps only.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'MobileEDR:telemetry', 'channel': 'System event occurs (e.g., SMS received, device boot completed, network state changed) acting as trigger event for execution phase'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App registers BroadcastReceiver or schedules job for system events (BOOT_COMPLETED, SMS_RECEIVED, ACTION_PACKAGE_REPLACED, CONNECTIVITY_CHANGE, ACTION_USER_PRESENT) NOT IN $ApprovedEventTriggerApps$ — sensitive system event registration is'}
x_mitre_mutable_elements[1]	{'field': 'SensitiveEventList', 'description': 'List of high-risk trigger events such as BOOT_COMPLETED, SMS_RECEIVED, CONNECTIVITY_CHANGE, PACKAGE_ADDED'}	{'field': 'EventInteractionThreshold', 'description': 'Default 60s. App execution within 60s of system event with no user touch is event-triggered. After 60s, user may have interacted.'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_mutable_elements	{'field': 'AllowedAppList', 'description': 'Applications legitimately expected to use background scheduling or event-driven execution (e.g., messaging, system services)'}
x_mitre_mutable_elements	{'field': 'ForegroundStateRequired', 'description': 'Whether execution should only occur during active user interaction for specific app categories'}
x_mitre_mutable_elements	{'field': 'ExecutionDelayThreshold', 'description': 'Maximum allowed delay between event trigger and execution to still be considered causal'}
x_mitre_mutable_elements	{'field': 'UplinkBytesThreshold', 'description': 'Minimum outbound data volume after event-triggered execution to indicate meaningful activity'}

[AN1730] Analytic 1730

Current version: 1.1

	Old Description			New Description
t	1	The defender correlates anomalous application package replac	t	1	For Android, detect Compromise Application Executable from d
	>	ement, update, or executable-content drift with subsequent e		>	ocumented management, network, or vetting evidence; treat st
	>	xecution under the trusted application's identity, especiall		>	ate queries as periodic observations rather than real-time e
	>	y when package metadata, signing lineage, install source, fi		>	vents. Correlate Application Permission via Android Enterpri
	>	le integrity, or native/DEX component characteristics change		>	se DPC / Application Vetting [DevicePolicyManager.getPermiss
	>	without a corresponding trusted distribution path. The anal		>	ionGrantState(); PackageManager manifest/requested-permissio
	>	ytic prioritizes Android-observable control-plane effects: p		>	n review]; Application State via Android Enterprise / EMM [M
	>	ackage install/update events, package hash or code-section d		>	anaged package inventory/status and package metadata]; File
	>	rift, signer mismatch or lineage break, unexpected app proce		>	Creation via Application Vetting / Forensic Acquisition [Dyn
	>	ss behavior after replacement, and optional near-term networ		>	amic filesystem trace or acquired app-container/filesystem a
	>	k or sensor activity inconsistent with the legitimate applic		>	rtifacts: APK, DEX, or native library written to app install
	>	ation's baseline.		>	ation path outside MDM-authorized update mechanism — binary
				>	replacement is the persistence artifact]. Alert on a sequenc
				>	e or state change inconsistent with the device/app baseline,
				>	approved management policy, or expected user workflow; do n
				>	ot infer unobserved API calls, file/process activity, or pay
				>	load content from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.379000+00:00	2026-10-13 17:42:36.478000+00:00
description	The defender correlates anomalous application package replacement, update, or executable-content drift with subsequent execution under the trusted application's identity, especially when package metadata, signing lineage, install source, file integrity, or native/DEX component characteristics change without a corresponding trusted distribution path. The analytic prioritizes Android-observable control-plane effects: package install/update events, package hash or code-section drift, signer mismatch or lineage break, unexpected app process behavior after replacement, and optional near-term network or sensor activity inconsistent with the legitimate application's baseline.	For Android, detect Compromise Application Executable from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; Application State via Android Enterprise / EMM [Managed package inventory/status and package metadata]; File Creation via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: APK, DEX, or native library written to app installation path outside MDM-authorized update mechanism — binary replacement is the persistence artifact]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[1]	{'field': 'AllowedAppList', 'description': 'Applications legitimately expected to update frequently or use staged package delivery'}	{'field': 'ApkHashBaseline', 'description': 'Per-version APK hash (SHA-256 of base APK) from trusted distribution. Derive from MDM app deployment artifacts or Google Play API. FORENSIC: compare extracted /data/app//base.apk hash against baseline.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:MDMLog', 'channel': 'Managed application package version, signer lineage, installer source, or app identity changes outside approved enterprise or store-mediated update workflow'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}
x_mitre_log_source_references[3]	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'MobileEDR:telemetry', 'channel': 'Modified or newly replaced application begins execution or persists while recent_user_interaction=false or device_locked=true or launch context is inconsistent with expected user-driven update flow'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App is replaced or reinstalled'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindow', 'description': 'Correlation window between package replacement, code drift, first launch, and follow-on behavior'}	{'field': 'TrustedSignerBaseline', 'description': 'Per-app expected signing certificate and signer lineage. Derive from MDM app deployment records and Play Store signing identity. Any signer change = compromise indicator.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': 'Existing application is replaced, updated, or reinstalled and the resulting package metadata, code sections, or executable-supporting artifacts diverge from known-good baseline during the persistence-establishment phase'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'android:EMM', 'channel': 'Managed package inventory/status and package metadata'}
x_mitre_mutable_elements[2]	{'field': 'ApprovedInstallerSources', 'description': 'Expected install or update sources such as managed store, Google Play, or enterprise MDM'}	{'field': 'PostModificationWindow', 'description': 'Default 86400s behavioral observation window post-modification.'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'MobileEDR:telemetry', 'channel': 'APK, DEX, native library, or package-associated executable content is written, expanded, or swapped in app package paths, staging paths, or installer cache immediately before or during application replacement'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: APK, DEX, or native library written to app installation path outside MDM-authorized update mechanism — binary replacement is the persistence artifact'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_mutable_elements	{'field': 'AllowedSignerLineage', 'description': 'Approved signing certificates, rotation chains, and version lineage for managed apps'}
x_mitre_mutable_elements	{'field': 'AllowedPackagePaths', 'description': 'Expected package cache, installer, and app storage locations involved in legitimate updates'}
x_mitre_mutable_elements	{'field': 'IntegrityDriftThreshold', 'description': 'Degree of executable-content or metadata change tolerated before alerting'}
x_mitre_mutable_elements	{'field': 'ForegroundStateRequired', 'description': 'Whether package replacement and first launch should occur only during active user-driven workflows'}
x_mitre_mutable_elements	{'field': 'UplinkBytesThreshold', 'description': 'Minimum outbound volume after first execution of replaced app to treat post-compromise communication as meaningful'}

[AN1733] Analytic 1733

Current version: 1.1

	Old Description			New Description
t	1	Detects indirect evidence of host-side indicator removal by	t	1	For iOS, detect Indicator Removal on Host from documented ma
	>	correlating (1) local artifact creation or compromise-state-		>	nagement, network, or vetting evidence; treat state queries
	>	relevant activity, (2) later disappearance, alteration, or r		>	as periodic observations rather than real-time events. Corre
	>	eporting loss for those artifacts or state indicators, and (		>	late Application Permission via Application Vetting [Code-si
	>	3) continued application or device activity under reduced vi		>	gning entitlements and Info.plist privacy usage-description
	>	sibility. Because iOS provides weaker direct visibility into		>	keys]; OS API Execution via Application Vetting / Instrument
	>	some Android-style artifact and jailbreak-indicator manipul		>	ed Dynamic Analysis [Dynamic API/runtime trace: App invokes
	>	ation patterns, the defender relies more on app-private arti		>	file deletion, container-local database truncation, or cache
	>	fact lifecycle changes, managed posture shifts, and continue		>	-clear operations on supervised device within $CleanupWindow
	>	d runtime or network activity after expected evidence disapp		>	$ of prior data access or upload event]; System Settings via
	>	ears.		>	Apple MDM [DeviceInformation / SecurityInfo / ProfileList /
				>	restrictions and compliance queries]. Alert on a sequence o
				>	r state change inconsistent with the device/app baseline, ap
				>	proved management policy, or expected user workflow; do not
				>	infer unobserved API calls, file/process activity, or payloa
				>	d content from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.377000+00:00	2026-10-13 17:42:51.647000+00:00
description	Detects indirect evidence of host-side indicator removal by correlating (1) local artifact creation or compromise-state-relevant activity, (2) later disappearance, alteration, or reporting loss for those artifacts or state indicators, and (3) continued application or device activity under reduced visibility. Because iOS provides weaker direct visibility into some Android-style artifact and jailbreak-indicator manipulation patterns, the defender relies more on app-private artifact lifecycle changes, managed posture shifts, and continued runtime or network activity after expected evidence disappears.	For iOS, detect Indicator Removal on Host from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Application Permission via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]; OS API Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: App invokes file deletion, container-local database truncation, or cache-clear operations on supervised device within $CleanupWindow$ of prior data access or upload event]; System Settings via Apple MDM [DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'Application Vetting', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'mobile:ApplicationVetting', 'channel': 'Code-signing entitlements and Info.plist privacy usage-description keys'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindow', 'description': 'Correlation window between artifact disappearance, posture change, and continued activity'}	{'field': 'ApprovedCleanupApps', 'description': 'Privacy cleaner apps approved by IT, MDM agent for managed wipe. Derive from MDM catalog. Tightening: MDM agent only — all other post-exfil cleanup is anomalous.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--56c2b384-77f8-461f-a71a-76f7888ebfb6', 'name': 'User Interface', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes file deletion, container-local database truncation, or cache-clear operations on supervised device within $CleanupWindow$ of prior data access or upload event'}
x_mitre_mutable_elements[1]	{'field': 'ArtifactTypeSet', 'description': 'Host artifacts and state indicators monitored for suspicious removal, alteration, or disappearance'}	{'field': 'CleanupWindow', 'description': 'Default 300s after exfiltration event (network upload) within which subsequent cleanup is causally linked. Tightening: 60s — immediate post-exfil cleanup.'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--56c2b384-77f8-461f-a71a-76f7888ebfb6', 'name': 'iOS:MDM', 'channel': 'DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_mutable_elements	{'field': 'ExpectedTelemetrySources', 'description': 'Baseline sources expected to continue exposing artifact presence or compromise-relevant state'}
x_mitre_mutable_elements	{'field': 'TelemetryGapThreshold', 'description': 'Threshold defining abnormal loss of artifact visibility or managed-state continuity'}
x_mitre_mutable_elements	{'field': 'ExpectedManagementChanges', 'description': 'Known legitimate posture or inventory changes that may remove or update artifacts'}
x_mitre_mutable_elements	{'field': 'UplinkBytesThreshold', 'description': 'Outbound traffic threshold used to confirm meaningful continued activity after indicator removal'}

[AN1734] Analytic 1734

Current version: 1.1

	Old Description			New Description
t	1	Correlates (1) application activity that creates, modifies,	t	1	For Android, detect Indicator Removal on Host by correlating
	>	or accesses local artifacts relevant to detection or device		>	analyst-visible device/network evidence and management stat
	>	compromise state, (2) subsequent deletion, alteration, renam		>	e; use streaming or batched telemetry only where the documen
	>	ing, relocation, or visibility suppression of those artifact		>	ted collector is deployed. Correlate Application Permission
	>	s, including files, application presence, media, or root-com		>	via Android Enterprise DPC / Application Vetting [DevicePoli
	>	promise indicators, and (3) continued application execution,		>	cyManager.getPermissionGrantState(); PackageManager manifest
	>	reduced telemetry quality, or outbound activity after the a		>	/requested-permission review]; OS API Execution via Applicat
	>	rtifact state changes. The defender observes a causal chain		>	ion Vetting / Instrumented Dynamic Analysis [Dynamic API/run
	>	where host-side evidence is first manipulated and expected v		>	time trace: App invokes file deletion, database truncation,
	>	isibility or reporting degrades while the initiating applica		>	log clearing, or app-data-clear operations within $CleanupWi
	>	tion remains active.		>	ndow$ of prior data access or network exfiltration event — p
				>	ost-exfil cleanup chain]; System Settings via Android Enterp
				>	rise DPC [DevicePolicyManager policy/compliance/security-sta
				>	te queries and SecurityLog events where supported]. Alert on
				>	a sequence or state change inconsistent with the device/app
				>	baseline, approved management policy, or expected user work
				>	flow; do not infer unobserved API calls, file/process activi
				>	ty, or payload content from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.377000+00:00	2026-10-13 17:42:50.947000+00:00
description	Correlates (1) application activity that creates, modifies, or accesses local artifacts relevant to detection or device compromise state, (2) subsequent deletion, alteration, renaming, relocation, or visibility suppression of those artifacts, including files, application presence, media, or root-compromise indicators, and (3) continued application execution, reduced telemetry quality, or outbound activity after the artifact state changes. The defender observes a causal chain where host-side evidence is first manipulated and expected visibility or reporting degrades while the initiating application remains active.	For Android, detect Indicator Removal on Host by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; OS API Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: App invokes file deletion, database truncation, log clearing, or app-data-clear operations within $CleanupWindow$ of prior data access or network exfiltration event — post-exfil cleanup chain]; System Settings via Android Enterprise DPC [DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': 'application invokes package, settings, or privileged framework operations capable of disabling security software, altering security enforcement, or interfering with reporting before telemetry loss'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--56c2b384-77f8-461f-a71a-76f7888ebfb6', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported'}
x_mitre_mutable_elements[1]	{'field': 'ArtifactTypeSet', 'description': 'Types of host artifacts monitored for suspicious removal or alteration, such as files, installed-app presence, hidden media, or compromise markers'}	{'field': 'CleanupWindow', 'description': 'Default 300s after exfiltration event (network upload) within which subsequent cleanup is causally linked. Tightening: 60s — immediate post-exfil cleanup.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:MDMLog', 'channel': 'device posture or compromise-state indicators change unexpectedly, including rooted or non-compliant status disappearance, after prior app or system activity suggesting persistence on device'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindow', 'description': 'Correlation window between artifact change, visibility degradation, and continued execution or network activity'}	{'field': 'ApprovedCleanupApps', 'description': 'Privacy cleaner apps approved by IT, MDM agent for managed wipe. Derive from MDM catalog. Tightening: MDM agent only — all other post-exfil cleanup is anomalous.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:MDMLog', 'channel': 'managed application state changes unexpectedly through uninstall, disappearance from expected inventory, or install-state mismatch after prior suspicious activity'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes file deletion, database truncation, log clearing, or app-data-clear operations within $CleanupWindow$ of prior data access or network exfiltration event — post-exfil cleanup chain'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_mutable_elements	{'field': 'ExpectedTelemetrySources', 'description': 'Baseline sources expected to continue reflecting artifacts or compromise state'}
x_mitre_mutable_elements	{'field': 'TelemetryGapThreshold', 'description': 'Threshold defining abnormal loss of artifact visibility or reporting continuity'}
x_mitre_mutable_elements	{'field': 'AllowedAppList', 'description': 'Legitimate apps expected to delete or alter artifacts as part of normal lifecycle or cleanup behavior'}
x_mitre_mutable_elements	{'field': 'UplinkBytesThreshold', 'description': 'Outbound traffic threshold used to confirm meaningful activity after indicator removal'}

[AN1735] Analytic 1735

Current version: 1.0

	Old Description			New Description
t	1	Application vetting services may detect when an application	t	1	For Android, detect Application Versioning by correlating an
	>	requests permissions after an application update. Applicatio		>	alyst-visible device/network evidence and management state;
	>	n vetting services may look for indications that the applica		>	use streaming or batched telemetry only where the documented
	>	tion’s update includes malicious code at runtime. Applicati		>	collector is deployed. Correlate File Modification via Appl
	>	on vetting services may be able to list domains and/or IP ad		>	ication Vetting / Forensic Acquisition [Dynamic filesystem t
	>	dresses that applications communicate with.		>	race or acquired app-container/filesystem artifacts: app ver
				>	sion change detected in MDM inventory for app_package — upda
				>	te is the binary modification event]; Network Connection Cre
				>	ation via Android Enterprise Network Logging / Enterprise VP
				>	N [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / Con
				>	nectEvent; VPN flow metadata]; Permissions Request via Andro
				>	id Enterprise DPC / Application Vetting [DevicePolicyManager
				>	.getPermissionGrantState(); PackageManager manifest/requeste
				>	d-permission review]. Alert on a sequence or state change in
				>	consistent with the device/app baseline, approved management
				>	policy, or expected user workflow; do not infer unobserved
				>	API calls, file/process activity, or payload content from ma
				>	nagement state alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'PermissionDeltaAllowList', 'description': 'Expected permission additions per app per planned update. Derived from app developer changelog and IT review.'}, {'field': 'AppBaselineDomains', 'description': 'Pre-update network domain baseline per app. Anchor to prior version. Derive by measurement.'}, {'field': 'PostUpdateWindow', 'description': 'Default 86400s (24hr) post-update behavioral window. Tightening: 3600s.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:42:12.433000+00:00
description	Application vetting services may detect when an application requests permissions after an application update. Application vetting services may look for indications that the application’s update includes malicious code at runtime. Application vetting services may be able to list domains and/or IP addresses that applications communicate with.	For Android, detect Application Versioning by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate File Modification via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: app version change detected in MDM inventory for app_package — update is the binary modification event]; Network Connection Creation via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]; Permissions Request via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'Application Vetting', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--84572de3-9583-4c73-aabd-06ea88123dd8', 'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: app version change detected in MDM inventory for app_package — update is the binary modification event'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'Application Vetting', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba', 'name': 'android:EnterpriseNetworkLog', 'channel': 'DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--764ee29e-48d6-4934-8e6b-7a606aaaafc0', 'name': 'Application Vetting', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--e2f72131-14d1-411f-8e8c-aa3453dd5456', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}

[AN1736] Analytic 1736

Current version: 1.0

	Old Description			New Description
t	1	Application vetting services may detect when an application	t	1	For iOS, detect Application Versioning by correlating analys
	>	requests permissions after an application update. Applicatio		>	t-visible device/network evidence and management state; use
	>	n vetting services may look for indications that the applica		>	streaming or batched telemetry only where the documented col
	>	tion’s update includes malicious code at runtime. Applicati		>	lector is deployed. Correlate File Modification via Applicat
	>	on vetting services may be able to list domains and/or IP ad		>	ion Vetting / Forensic Acquisition [Dynamic filesystem trace
	>	dresses that applications communicate with.		>	or acquired app-container/filesystem artifacts: app version
				>	change in MDM inventory for bundle_id]; Network Connection
				>	Creation via Apple Network Extension / Enterprise VPN [NEFil
				>	terFlow / per-app VPN / secure-web-gateway flow metadata]; P
				>	ermissions Request via Application Vetting [Code-signing ent
				>	itlements and Info.plist privacy usage-description keys]. Al
				>	ert on a sequence or state change inconsistent with the devi
				>	ce/app baseline, approved management policy, or expected use
				>	r workflow; do not infer unobserved API calls, file/process
				>	activity, or payload content from management state alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'PermissionDeltaAllowList', 'description': 'Expected privacy permission additions per planned update. Derived from IT app review.'}, {'field': 'AppBaselineDomains', 'description': 'Pre-update domain baseline anchored to prior version.'}, {'field': 'PostUpdateWindow', 'description': 'Default 86400s. Tightening: 3600s.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:42:13.149000+00:00
description	Application vetting services may detect when an application requests permissions after an application update. Application vetting services may look for indications that the application’s update includes malicious code at runtime. Application vetting services may be able to list domains and/or IP addresses that applications communicate with.	For iOS, detect Application Versioning by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate File Modification via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: app version change in MDM inventory for bundle_id]; Network Connection Creation via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]; Permissions Request via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'Application Vetting', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--84572de3-9583-4c73-aabd-06ea88123dd8', 'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: app version change in MDM inventory for bundle_id'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'Application Vetting', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba', 'name': 'iOS:NetworkExtension', 'channel': 'NEFilterFlow / per-app VPN / secure-web-gateway flow metadata'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--764ee29e-48d6-4934-8e6b-7a606aaaafc0', 'name': 'Application Vetting', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--e2f72131-14d1-411f-8e8c-aa3453dd5456', 'name': 'mobile:ApplicationVetting', 'channel': 'Code-signing entitlements and Info.plist privacy usage-description keys'}

[AN1737] Analytic 1737

Current version: 1.1

	Old Description			New Description
t	1	Correlates (1) application access to device- or environment-	t	1	For Android, detect Execution Guardrails from documented man
	>	specific attributes used to validate target conditions, (2)		>	agement, network, or vetting evidence; treat state queries a
	>	suppression of sensitive behavior until those attributes mat		>	s periodic observations rather than real-time events. Correl
	>	ch an expected value, and (3) immediate transition into prot		>	ate Application Permission via Android Enterprise DPC / Appl
	>	ected actions such as sensor use, file access, or network co		>	ication Vetting [DevicePolicyManager.getPermissionGrantState
	>	mmunication only after the condition is satisfied. The defen		>	(); PackageManager manifest/requested-permission review]; Ap
	>	der observes a causal chain where an app repeatedly evaluate		>	plication State via Android Enterprise / EMM [Managed packag
	>	s device state or environment context and withholds executio		>	e inventory/status and package metadata]; OS API Execution v
	>	n until a target-specific match occurs.		>	ia Application Vetting / Instrumented Dynamic Analysis [Dyna
				>	mic API/runtime trace: App performs burst of environmental c
				>	heck APIs (Build properties, TelephonyManager IMSI, PackageM
				>	anager security-tool query) at cold launch before user inter
				>	action — multi-category environment fingerprint is the guard
				>	rail setup]. Alert on a sequence or state change inconsisten
				>	t with the device/app baseline, approved management policy,
				>	or expected user workflow; do not infer unobserved API calls
				>	, file/process activity, or payload content from management
				>	state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.376000+00:00	2026-10-13 17:42:46.862000+00:00
description	Correlates (1) application access to device- or environment-specific attributes used to validate target conditions, (2) suppression of sensitive behavior until those attributes match an expected value, and (3) immediate transition into protected actions such as sensor use, file access, or network communication only after the condition is satisfied. The defender observes a causal chain where an app repeatedly evaluates device state or environment context and withholds execution until a target-specific match occurs.	For Android, detect Execution Guardrails from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; Application State via Android Enterprise / EMM [Managed package inventory/status and package metadata]; OS API Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: App performs burst of environmental check APIs (Build properties, TelephonyManager IMSI, PackageManager security-tool query) at cold launch before user interaction — multi-category environment fingerprint is the guardrail setup]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:MDMLog', 'channel': 'application holds permissions enabling environment validation (e.g., location, phone state, nearby device/network context) and subsequently delays protected activity until qualifying values are present'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindow', 'description': 'Correlation window between environment checks and subsequent guarded execution'}	{'field': 'GuardrailCheckWindow', 'description': 'Default 30s at cold launch. Environmental checks at launch before user interaction are guardrail setup. Post-interaction checks may be feature-driven.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': 'application queries target-selection attributes (e.g., location, SIM/operator, locale, device state, network identity) and then conditionally invokes sensitive framework APIs only after expected value is observed'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'android:EMM', 'channel': 'Managed package inventory/status and package metadata'}
x_mitre_mutable_elements[1]	{'field': 'TargetAttributeSet', 'description': 'Environment attributes treated as likely guardrail inputs, such as locale, geolocation, carrier, Wi-Fi identity, device model, or lock state'}	{'field': 'PopulationComparisonRequired', 'description': 'Behavioral fork detection requires telemetry across multiple device populations (enrolled vs unenrolled). Without population comparison, single-device detection is Low confidence.'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App performs burst of environmental check APIs (Build properties, TelephonyManager IMSI, PackageManager security-tool query) at cold launch before user interaction — multi-category environment fingerprint is the guardrail setup'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_mutable_elements	{'field': 'DormancyThreshold', 'description': 'Amount of suppressed or low-activity runtime before sensitive behavior begins'}
x_mitre_mutable_elements	{'field': 'AllowedAppList', 'description': 'Baseline of legitimate apps expected to evaluate environment attributes before conditional feature activation'}
x_mitre_mutable_elements	{'field': 'ForegroundStateRequired', 'description': 'Whether guarded execution is only suspicious when activated from background or without recent user interaction'}
x_mitre_mutable_elements	{'field': 'UplinkBytesThreshold', 'description': 'Minimum outbound traffic volume used to distinguish meaningful guarded execution from benign telemetry'}

[AN1738] Analytic 1738

Current version: 1.1

	Old Description			New Description
t	1	Detects conditional execution by correlating (1) application	t	1	For iOS, detect Execution Guardrails from documented managem
	>	access to constrained environment signals such as location,		>	ent, network, or vetting evidence; treat state queries as pe
	>	locale, network context, device state, or user interaction		>	riodic observations rather than real-time events. Correlate
	>	timing, (2) prolonged inactivity or feature suppression desp		>	Application Permission via Application Vetting [Code-signing
	>	ite available permissions, and (3) abrupt initiation of high		>	entitlements and Info.plist privacy usage-description keys]
	>	er-risk behavior only when the expected target context is pr		>	; Application State via Apple MDM [InstalledApplicationList
	>	esent. Because direct observation of some runtime decision l		>	/ ManagedApplicationList]; OS API Execution via Application
	>	ogic is weaker on iOS, the defender relies more heavily on l		>	Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime
	>	ifecycle, sensor, and downstream network effects following t		>	trace: App performs UIDevice model + iOS version + enrollme
	>	arget-condition alignment.		>	nt state checks at cold launch before user interaction — dev
				>	ice fingerprinting guardrail setup]. Alert on a sequence or
				>	state change inconsistent with the device/app baseline, appr
				>	oved management policy, or expected user workflow; do not in
				>	fer unobserved API calls, file/process activity, or payload
				>	content from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.376000+00:00	2026-10-13 17:42:47.550000+00:00
description	Detects conditional execution by correlating (1) application access to constrained environment signals such as location, locale, network context, device state, or user interaction timing, (2) prolonged inactivity or feature suppression despite available permissions, and (3) abrupt initiation of higher-risk behavior only when the expected target context is present. Because direct observation of some runtime decision logic is weaker on iOS, the defender relies more heavily on lifecycle, sensor, and downstream network effects following target-condition alignment.	For iOS, detect Execution Guardrails from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Application Permission via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]; Application State via Apple MDM [InstalledApplicationList / ManagedApplicationList]; OS API Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: App performs UIDevice model + iOS version + enrollment state checks at cold launch before user interaction — device fingerprinting guardrail setup]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': 'application exhibits repeated environment-context evaluation followed by delayed privileged framework use only after target-specific match'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App performs UIDevice model + iOS version + enrollment state checks at cold launch before user interaction — device fingerprinting guardrail setup'}
x_mitre_mutable_elements[1]	{'field': 'TargetContextSet', 'description': 'Expected environment properties used for gating, such as location region, locale, SSID/network context, device lock state, or user activity timing'}	{'field': 'PopulationComparisonRequired', 'description': 'Behavioral fork detection requires telemetry across multiple device populations (enrolled vs unenrolled). Without population comparison, single-device detection is Low confidence.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'MobileEDR:telemetry', 'channel': 'application remains inactive across normal execution windows and transitions into background or foreground activity burst only when qualifying device context, lock state, locale, or network condition exists'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'mobile:ApplicationVetting', 'channel': 'Code-signing entitlements and Info.plist privacy usage-description keys'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindow', 'description': 'Correlation window between context checks and guarded execution'}	{'field': 'GuardrailCheckWindow', 'description': 'Default 30s at cold launch. Environmental checks at launch before user interaction are guardrail setup. Post-interaction checks may be feature-driven.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'iOS:MDMLog', 'channel': 'application has approved capabilities required for conditional execution (e.g., location/background modes) but observed behavior is deferred until target-specific state is present'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'iOS:MDM', 'channel': 'InstalledApplicationList / ManagedApplicationList'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_mutable_elements	{'field': 'DormancyThreshold', 'description': 'Duration of inactivity before guarded behavior begins'}
x_mitre_mutable_elements	{'field': 'ExpectedBackgroundModes', 'description': 'Baseline of legitimate apps whose feature activation is context-dependent in background execution'}
x_mitre_mutable_elements	{'field': 'AllowedDestinationList', 'description': 'Expected destinations for apps whose network activity legitimately begins only in certain contexts'}
x_mitre_mutable_elements	{'field': 'UserInteractionThreshold', 'description': 'Acceptable recency of user interaction before guarded execution is considered suspicious'}

[AN1739] Analytic 1739

Current version: 1.1

	Old Description			New Description
t	1	Correlates anomalous modifications to boot-time or logon-tim	t	1	For Android, detect Boot or Logon Initialization Scripts by
	>	e initialization artifacts (for example, init.rc, vendor ini		>	correlating analyst-visible device/network evidence and mana
	>	t scripts, app_process or shell hijacks, and malicious BOOT_		>	gement state; use streaming or batched telemetry only where
	>	COMPLETED BroadcastReceivers) with subsequent unauthorized s		>	the documented collector is deployed. Correlate Application
	>	cript execution after boot. From the defender’s perspective		>	Permission via Android Enterprise DPC / Application Vetting
	>	this appears as integrity or attestation failures on the sys		>	[DevicePolicyManager.getPermissionGrantState(); PackageManag
	>	tem partition, unexpected writes to protected init paths, ne		>	er manifest/requested-permission review]; Host Status via An
	>	w apps registering for boot events, and privileged processes		>	droid Enterprise DPC [DevicePolicyManager policy/compliance/
	>	invoking scripts or binaries from non-standard locations sh		>	security-state queries and SecurityLog events where supporte
	>	ortly after the device boots.		>	d]; Network Traffic Flow via Android Enterprise Network Logg
				>	ing / Enterprise VPN [DevicePolicyManager.retrieveNetworkLog
				>	s(): DnsEvent / ConnectEvent; VPN flow metadata]. Alert on a
				>	sequence or state change inconsistent with the device/app b
				>	aseline, approved management policy, or expected user workfl
				>	ow; do not infer unobserved API calls, file/process activity
				>	, or payload content from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.383000+00:00	2026-10-13 17:40:58.815000+00:00
description	Correlates anomalous modifications to boot-time or logon-time initialization artifacts (for example, init.rc, vendor init scripts, app_process or shell hijacks, and malicious BOOT_COMPLETED BroadcastReceivers) with subsequent unauthorized script execution after boot. From the defender’s perspective this appears as integrity or attestation failures on the system partition, unexpected writes to protected init paths, new apps registering for boot events, and privileged processes invoking scripts or binaries from non-standard locations shortly after the device boots.	For Android, detect Boot or Logon Initialization Scripts by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; Host Status via Android Enterprise DPC [DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported]; Network Traffic Flow via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[1]	{'field': 'AuthorizedBootReceivers', 'description': 'Enterprise-specific allow list of packages expected to register BOOT_COMPLETED receivers.'}	{'field': 'AppBaselineDomains', 'description': 'Per-device CDN baseline from 30-day measurement.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--85a533a4-5fa4-4dba-b45d-f0717bedd6e6', 'name': 'AndroidAttestation:VerifiedBoot', 'channel': 'Verified Boot or dm-verity reports partition hash mismatch, non-green boot state, or integrity failure'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindow', 'description': 'Correlation window between boot/attestation event and suspicious script execution (for example, 0–10 minutes after BOOT_COMPLETED).'}	{'field': 'KnownInitPaths', 'description': 'Known legitimate init paths: /data/adb/modules//. Derive from device baseline inventory. Tightening: any new /data/adb/modules entry is anomalous on production fleet devices.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--84572de3-9583-4c73-aabd-06ea88123dd8', 'name': 'AndroidLogs:FileSystem', 'channel': 'Modification to /system/etc/init/ or /vendor/etc/init/ boot-time scripts'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--85a533a4-5fa4-4dba-b45d-f0717bedd6e6', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported'}
x_mitre_mutable_elements[2]	{'field': 'ProtectedPaths', 'description': 'OEM- and ROM-specific list of system and vendor init script locations that should be immutable in production devices.'}	{'field': 'PostRebootWindow', 'description': 'Default 300s after MDM-recorded reboot event.'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--639e87f3-acb6-448a-9645-258f20da4bc5', 'name': 'AndroidLogs:Framework', 'channel': 'BroadcastReceiver registration for android.intent.action.BOOT_COMPLETED by previously unseen or recently installed apps'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'android:EnterpriseNetworkLog', 'channel': 'DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'AndroidLogs:Kernel', 'channel': 'init or zygote process executing scripts or binaries from non-standard data or sdcard locations during early boot'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--85a533a4-5fa4-4dba-b45d-f0717bedd6e6', 'name': 'AndroidAttestation:SafetyNet', 'channel': 'SafetyNet attestation with CTSProfileMatch=false or BasicIntegrity=false'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--85a533a4-5fa4-4dba-b45d-f0717bedd6e6', 'name': 'OEMAttestation:Knox', 'channel': 'Samsung Knox attestation shows attestation_state=COMPROMISED or warranty bit set'}
x_mitre_mutable_elements	{'field': 'ExpectedAttestationState', 'description': 'Expected Verified Boot, SafetyNet, and OEM attestation states for enrolled devices. Custom ROM or dev devices may need relaxed thresholds.'}
x_mitre_mutable_elements	{'field': 'IntegrityFailureThreshold', 'description': 'Number or rate of attestation failures before escalating to a high-severity incident.'}

[AN1740] Analytic 1740

Current version: 1.1

	Old Description			New Description
t	1	Correlates unauthorized alterations to launchd configuration	t	1	For iOS, detect Boot or Logon Initialization Scripts by corr
	>	(LaunchDaemons/LaunchAgents plists), background execution e		>	elating analyst-visible device/network evidence and manageme
	>	ntitlements, or sideloaded app containers with suspicious au		>	nt state; use streaming or batched telemetry only where the
	>	to-start behavior during device boot or user unlock. From th		>	documented collector is deployed. Correlate Application Perm
	>	e defender’s view this shows up as new or modified plist fil		>	ission via Application Vetting [Code-signing entitlements an
	>	es in launchd directories, launchd starting binaries from no		>	d Info.plist privacy usage-description keys]; Host Status vi
	>	n-Apple or non-AppStore locations, and apps with unexpected		>	a Apple MDM [DeviceInformation / SecurityInfo / ProfileList
	>	background modes that remain active immediately after boot/u		>	/ restrictions and compliance queries]; Network Traffic Flow
	>	nlock.		>	via Apple Network Extension / Enterprise VPN [NEFilterFlow
				>	/ per-app VPN / secure-web-gateway flow metadata]. Alert on
				>	a sequence or state change inconsistent with the device/app
				>	baseline, approved management policy, or expected user workf
				>	low; do not infer unobserved API calls, file/process activit
				>	y, or payload content from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.375000+00:00	2026-10-13 17:40:59.409000+00:00
description	Correlates unauthorized alterations to launchd configuration (LaunchDaemons/LaunchAgents plists), background execution entitlements, or sideloaded app containers with suspicious auto-start behavior during device boot or user unlock. From the defender’s view this shows up as new or modified plist files in launchd directories, launchd starting binaries from non-Apple or non-AppStore locations, and apps with unexpected background modes that remain active immediately after boot/unlock.	For iOS, detect Boot or Logon Initialization Scripts by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]; Host Status via Apple MDM [DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries]; Network Traffic Flow via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--613788f2-ad72-43f5-b5f7-a93e2adc70fa', 'name': 'iOS:unifiedlog', 'channel': 'Application gaining or using unexpected background execution entitlements or modes'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'iOS:NetworkExtension', 'channel': 'NEFilterFlow / per-app VPN / secure-web-gateway flow metadata'}
x_mitre_mutable_elements[1]	{'field': 'LaunchdWhitelist', 'description': 'Organization-specific list of allowed launchd job labels and binary paths.'}	{'field': 'PostRebootWindow', 'description': 'Default 300s after MDM-recorded reboot.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--84572de3-9583-4c73-aabd-06ea88123dd8', 'name': 'iOS:unifiedlog', 'channel': 'Creation or modification of LaunchDaemon or LaunchAgent plist in /System/Library/LaunchDaemons, /Library/LaunchDaemons, or /Library/LaunchAgents'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'mobile:ApplicationVetting', 'channel': 'Code-signing entitlements and Info.plist privacy usage-description keys'}
x_mitre_mutable_elements[0]	{'field': 'JailbreakIndicators', 'description': 'List of filesystem paths or process names that identify intentionally jailbroken lab devices and should be handled differently.'}	{'field': 'KnownAppDestinations', 'description': 'Per-device CDN baseline from 30-day measurement.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'iOS:unifiedlog', 'channel': 'launchd invocation of binary from non-Apple, non-AppStore, or sideloaded location during boot or shortly after unlock'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--85a533a4-5fa4-4dba-b45d-f0717bedd6e6', 'name': 'iOS:MDM', 'channel': 'DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_mutable_elements	{'field': 'AllowedBackgroundModes', 'description': 'Per-app allow list for background execution modes (for example, VOIP, location) to reduce noise.'}
x_mitre_mutable_elements	{'field': 'BootUnlockWindow', 'description': 'Time window after boot or unlock within which unexpected launchd auto-starts are considered high risk.'}

[AN1741] Analytic 1741

Current version: 1.1

	Old Description			New Description
t	1	The defender correlates app-driven shell or command executio	t	1	For Android, detect Command and Scripting Interpreter from d
	>	n setup with subsequent process creation, command invocation		>	ocumented management, network, or vetting evidence; treat st
	>	, or script-driven follow-on behavior under the same app con		>	ate queries as periodic observations rather than real-time e
	>	text, especially when command execution occurs from backgrou		>	vents. Correlate Command Execution via Application Vetting /
	>	nd state, without recent user interaction, or immediately af		>	Instrumented Dynamic Analysis [Dynamic API/runtime trace: A
	>	ter payload retrieval or local staging. The analytic priorit		>	pp spawns sh, bash, toybox, toolbox, or su child process wit
	>	izes Android-observable control-plane effects: Java Runtime		>	h command arguments within $ShellActivityWindow$ of shell la
	>	or similar command-execution method use, shell or sh-like pr		>	unch — child shell process with arguments is the script exec
	>	ocess creation, command parameter visibility where available		>	ution signal]; Process Creation via Application Vetting / Ma
	>	, and immediate file or network effects produced by the inte		>	naged Device Telemetry [App invokes Runtime.exec(), ProcessB
	>	rpreter.		>	uilder.start(), or JNI-backed command execution framework to
				>	spawn shell or command interpreter process NOT IN $Approved
				>	ShellApps$ — programmatic shell spawn is the interpreter inv
				>	ocation]. Alert on a sequence or state change inconsistent w
				>	ith the device/app baseline, approved management policy, or
				>	expected user workflow; do not infer unobserved API calls, f
				>	ile/process activity, or payload content from management sta
				>	te alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.381000+00:00	2026-10-13 17:42:43.130000+00:00
description	The defender correlates app-driven shell or command execution setup with subsequent process creation, command invocation, or script-driven follow-on behavior under the same app context, especially when command execution occurs from background state, without recent user interaction, or immediately after payload retrieval or local staging. The analytic prioritizes Android-observable control-plane effects: Java Runtime or similar command-execution method use, shell or sh-like process creation, command parameter visibility where available, and immediate file or network effects produced by the interpreter.	For Android, detect Command and Scripting Interpreter from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Command Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: App spawns sh, bash, toybox, toolbox, or su child process with command arguments within $ShellActivityWindow$ of shell launch — child shell process with arguments is the script execution signal]; Process Creation via Application Vetting / Managed Device Telemetry [App invokes Runtime.exec(), ProcessBuilder.start(), or JNI-backed command execution framework to spawn shell or command interpreter process NOT IN $ApprovedShellApps$ — programmatic shell spawn is the interpreter invocation]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'MobileEDR:telemetry', 'channel': 'Application invokes Runtime.exec, ProcessBuilder, JNI-backed command launcher, or equivalent command-execution bridge immediately before shell or command process creation'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--685f917a-e95e-4ba0-ade1-c7d354dae6e0', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App spawns sh, bash, toybox, toolbox, or su child process with command arguments within $ShellActivityWindow$ of shell launch — child shell process with arguments is the script execution signal'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindow', 'description': 'Correlation window between command-launch method use, process creation, and follow-on file or network effects'}	{'field': 'ApprovedShellApps', 'description': 'Terminal emulator apps (on non-production developer devices only), ADB-connected sessions. Production fleet: empty — no app should spawn shells. Derive from IT device classification.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--685f917a-e95e-4ba0-ade1-c7d354dae6e0', 'name': 'MobileEDR:telemetry', 'channel': 'Application spawns shell, command interpreter, or command-executing child process with arguments during command-execution phase'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'mobile:DynamicAnalysis', 'channel': 'App invokes Runtime.exec(), ProcessBuilder.start(), or JNI-backed command execution framework to spawn shell or command interpreter process NOT IN $ApprovedShellApps$ — programmatic shell spawn is the interpreter invocation'}
x_mitre_mutable_elements[1]	{'field': 'AllowedAppList', 'description': 'Apps legitimately expected to run shell-like or administrative commands, such as enterprise support tools, terminal apps, approved EMM agents, or developer tooling'}	{'field': 'ShellActivityWindow', 'description': 'Default 30s between shell spawn and follow-on file/network activity. Shell execution and follow-on activity are near-synchronous.'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_mutable_elements	{'field': 'AllowedProcessPatterns', 'description': 'Expected command interpreters, process names, or parent-child execution chains for approved apps'}
x_mitre_mutable_elements	{'field': 'ForegroundStateRequired', 'description': 'Whether command execution should occur only during active user-driven workflows'}
x_mitre_mutable_elements	{'field': 'CommandArgumentRiskPatterns', 'description': 'Environment-specific list of suspicious command arguments, redirection usage, chaining operators, or shell-control syntax'}
x_mitre_mutable_elements	{'field': 'PostExecutionWriteThreshold', 'description': 'Minimum number or size of file artifacts created after interpreter execution to increase confidence'}
x_mitre_mutable_elements	{'field': 'UplinkBytesThreshold', 'description': 'Minimum outbound volume after command execution to treat network behavior as meaningful'}

[AN1742] Analytic 1742

Current version: 1.1

	Old Description			New Description
t	1	The defender correlates managed-app runtime behavior indicat	t	1	For iOS, detect Command and Scripting Interpreter from docum
	>	ive of command or shell invocation with subsequent spawned p		>	ented management, network, or vetting evidence; treat state
	>	rocess or shell-like execution effects, then raises confiden		>	queries as periodic observations rather than real-time event
	>	ce when the resulting activity produces local artifacts or n		>	s. Correlate Command Execution via Application Vetting / Ins
	>	etwork communication outside expected user context. Because		>	trumented Dynamic Analysis [Dynamic API/runtime trace: Shell
	>	direct shell-process visibility can be weaker on iOS in many		>	process (sh, bash) or command-executing child process spawn
	>	enterprise deployments, the analytic anchors first on proce		>	ed under app context on supervised iOS device — any shell sp
	>	ss-creation or lower-level OS API effects where mobile telem		>	awn on stock iOS indicates jailbreak or kernel exploit]; Pro
	>	etry can observe them, then on lifecycle context and post-ex		>	cess Creation via Application Vetting / Managed Device Telem
	>	ecution network or file behavior. Confidence is strongest wh		>	etry [Managed iOS app invokes lower-level process-launch beh
	>	en the same app shows command invocation followed by process		>	avior or command-execution-equivalent activity outside sandb
	>	execution and immediate follow-on effects.		>	ox-permitted APIs on supervised device]. Alert on a sequence
				>	or state change inconsistent with the device/app baseline,
				>	approved management policy, or expected user workflow; do no
				>	t infer unobserved API calls, file/process activity, or payl
				>	oad content from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.379000+00:00	2026-10-13 17:42:43.951000+00:00
description	The defender correlates managed-app runtime behavior indicative of command or shell invocation with subsequent spawned process or shell-like execution effects, then raises confidence when the resulting activity produces local artifacts or network communication outside expected user context. Because direct shell-process visibility can be weaker on iOS in many enterprise deployments, the analytic anchors first on process-creation or lower-level OS API effects where mobile telemetry can observe them, then on lifecycle context and post-execution network or file behavior. Confidence is strongest when the same app shows command invocation followed by process execution and immediate follow-on effects.	For iOS, detect Command and Scripting Interpreter from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Command Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: Shell process (sh, bash) or command-executing child process spawned under app context on supervised iOS device — any shell spawn on stock iOS indicates jailbreak or kernel exploit]; Process Creation via Application Vetting / Managed Device Telemetry [Managed iOS app invokes lower-level process-launch behavior or command-execution-equivalent activity outside sandbox-permitted APIs on supervised device]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'MobileEDR:telemetry', 'channel': 'Managed app invokes lower-level OS process-launch or command-execution behavior before file or network effects, including interpreter-like execution flow where visible to sensor'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--685f917a-e95e-4ba0-ade1-c7d354dae6e0', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Shell process (sh, bash) or command-executing child process spawned under app context on supervised iOS device — any shell spawn on stock iOS indicates jailbreak or kernel exploit'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindow', 'description': 'Correlation window between command-execution indication, process effects, and follow-on file or network behavior'}	{'field': 'ApprovedShellApps', 'description': 'Terminal emulator apps (on non-production developer devices only), ADB-connected sessions. Production fleet: empty — no app should spawn shells. Derive from IT device classification.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--685f917a-e95e-4ba0-ade1-c7d354dae6e0', 'name': 'MobileEDR:telemetry', 'channel': 'Application spawns shell, command interpreter, or command-executing child process with arguments during command-execution phase'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'mobile:DynamicAnalysis', 'channel': 'Managed iOS app invokes lower-level process-launch behavior or command-execution-equivalent activity outside sandbox-permitted APIs on supervised device'}
x_mitre_mutable_elements[1]	{'field': 'AllowedAppList', 'description': 'Managed apps legitimately expected to perform debugging, remote support, or enterprise automation tasks'}	{'field': 'ShellActivityWindow', 'description': 'Default 30s between shell spawn and follow-on file/network activity. Shell execution and follow-on activity are near-synchronous.'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_mutable_elements	{'field': 'AllowedProcessPatterns', 'description': 'Expected process-launch or helper-execution patterns for approved managed apps'}
x_mitre_mutable_elements	{'field': 'ForegroundStateRequired', 'description': 'Whether command-execution behavior should occur only during active user-driven workflows'}
x_mitre_mutable_elements	{'field': 'ArtifactPathPatterns', 'description': 'Expected temporary or output file locations for approved app behavior'}
x_mitre_mutable_elements	{'field': 'UplinkBytesThreshold', 'description': 'Minimum outbound volume after command execution to treat network behavior as meaningful'}

[AN1743] Analytic 1743

Current version: 1.1

	Old Description			New Description
t	1	Defender observes an OAuth/OIDC redirect (ACTION_VIEW) resol	t	1	For Android, detect Steal Application Access Token by correl
	>	ved to a non-allowlisted handler package (logcat:IntentResol		>	ating analyst-visible device/network evidence and management
	>	ver), followed within a short window by that same package ac		>	state; use streaming or batched telemetry only where the do
	>	cessing token material via AccountManager/Keystore or readin		>	cumented collector is deployed. Correlate API Calls via Appl
	>	g application token caches under /data/data/<pkg>/(shared_pr		>	ication Vetting / Instrumented Dynamic Analysis [Dynamic API
	>	efs\|databases) (logcat:AccountManager, logcat:Keystore, logc		>	/runtime trace: PackageManager.queryIntentActivities() retur
	>	at:FileIO). Correlate on package/UID/profile and time proxim		>	ns handler_count > 1 for custom URI scheme]; Application Per
	>	ity to indicate token acquisition.		>	mission via Android Enterprise DPC / Application Vetting [De
				>	vicePolicyManager.getPermissionGrantState(); PackageManager
				>	manifest/requested-permission review]; Network Traffic Conte
				>	nt via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) in
				>	spection or proxy transaction metadata where enterprise decr
				>	yption/inspection is deployed]. Alert on a sequence or state
				>	change inconsistent with the device/app baseline, approved
				>	management policy, or expected user workflow; do not infer u
				>	nobserved API calls, file/process activity, or payload conte
				>	nt from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.380000+00:00	2026-10-13 17:41:43.164000+00:00
description	Defender observes an OAuth/OIDC redirect (ACTION_VIEW) resolved to a non-allowlisted handler package (logcat:IntentResolver), followed within a short window by that same package accessing token material via AccountManager/Keystore or reading application token caches under /data/data//(shared_prefs\|databases) (logcat:AccountManager, logcat:Keystore, logcat:FileIO). Correlate on package/UID/profile and time proximity to indicate token acquisition.	For Android, detect Steal Application Access Token by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: PackageManager.queryIntentActivities() returns handler_count > 1 for custom URI scheme]; Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; Network Traffic Content via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[3]	{'field': 'TokenFileRegex', 'description': 'Environment-specific token cache filenames/paths.'}	{'field': 'OAuthFlowWindow', 'description': 'Default 30s between handler resolution and code delivery.'}
x_mitre_mutable_elements[1]	{'field': 'RedirectUriAllowlist', 'description': 'Approved redirect URI patterns per app (HTTPS/app-scheme).'}	{'field': 'MDMApprovedCatalog', 'description': 'MDM-managed app list.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'android:logcat', 'channel': 'ACTION_VIEW redirect_uri handled by unexpected package'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: PackageManager.queryIntentActivities() returns handler_count > 1 for custom URI scheme'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindowSeconds', 'description': 'Max seconds between redirect handling and token access (e.g., 30–180).'}	{'field': 'ApprovedURIOwners', 'description': 'URI scheme to package owner mapping from MDM app catalog.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'android:logcat', 'channel': 'Task switch from browser/custom tab to handler immediately after OAuth return'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}
x_mitre_mutable_elements[2]	{'field': 'TrustedHandlerPackages', 'description': 'Expected package names allowed to handle the redirect.'}	{'field': 'OAuthClientAllowList', 'description': 'Enterprise OAuth client_id to package mapping. Derive from enterprise IdP.'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--235b7491-2d2b-4617-9a52-3c0783680f71', 'name': 'android:logcat', 'channel': 'KeyChain/AndroidKeyStore read of token alias'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'webproxy:applog', 'channel': 'DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_mutable_elements	{'field': 'WorkProfileScope', 'description': 'Restrict to enterprise work profile to reduce personal-app noise.'}

[AN1744] Analytic 1744

Current version: 1.0

	Old Description			New Description
t	1	When vetting applications for potential security weaknesses,	t	1	For iOS, detect Steal Application Access Token by correlatin
	>	the vetting process could look for insecure use of Intents.		>	g analyst-visible device/network evidence and management sta
	>	Developers should be encouraged to use techniques to ensure		>	te; use streaming or batched telemetry only where the docume
	>	that the intent can only be sent to an appropriate destinat		>	nted collector is deployed. Correlate Application Permission
	>	ion (e.g., use explicit rather than implicit intents, permis		>	via Application Vetting [Code-signing entitlements and Info
	>	sion checking, checking of the destination app's signing cer		>	.plist privacy usage-description keys]; Network Connection C
	>	tificate, or utilizing the App Links feature). For mobile ap		>	reation via Apple Network Extension / Enterprise VPN [NEFilt
	>	plications using OAuth, encourage use of best practice.(Cita		>	erFlow / per-app VPN / secure-web-gateway flow metadata]; Ne
	>	tion: IETF-OAuthNativeApps)(Citation: Android-AppLinks) On A		>	twork Traffic Content via Enterprise Secure Web Gateway / Pr
	>	ndroid, users may be presented with a popup to select the ap		>	oxy [DNS/HTTP(S) inspection or proxy transaction metadata wh
	>	propriate application to open a URI in. If the user sees an		>	ere enterprise decryption/inspection is deployed]. Alert on
	>	application they do not recognize, they can remove it.		>	a sequence or state change inconsistent with the device/app
				>	baseline, approved management policy, or expected user workf
				>	low; do not infer unobserved API calls, file/process activit
				>	y, or payload content from management state alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ApprovedURIOwners', 'description': 'URI scheme to authorized bundle ID mapping from enterprise IdP OAuth registration.'}, {'field': 'OAuthClientAllowList', 'description': 'Enterprise OAuth client_id to bundle ID mapping.'}, {'field': 'OAuthFlowWindow', 'description': 'Default 30s between code redirect and token exchange.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:41:43.817000+00:00
description	When vetting applications for potential security weaknesses, the vetting process could look for insecure use of Intents. Developers should be encouraged to use techniques to ensure that the intent can only be sent to an appropriate destination (e.g., use explicit rather than implicit intents, permission checking, checking of the destination app's signing certificate, or utilizing the App Links feature). For mobile applications using OAuth, encourage use of best practice.(Citation: IETF-OAuthNativeApps)(Citation: Android-AppLinks) On Android, users may be presented with a popup to select the appropriate application to open a URI in. If the user sees an application they do not recognize, they can remove it.	For iOS, detect Steal Application Access Token by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]; Network Connection Creation via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]; Network Traffic Content via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'Application Vetting', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'mobile:ApplicationVetting', 'channel': 'Code-signing entitlements and Info.plist privacy usage-description keys'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--bf0ff551-a5a7-40e5-bff9-f9405011b1f4', 'name': 'User Interface', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba', 'name': 'iOS:NetworkExtension', 'channel': 'NEFilterFlow / per-app VPN / secure-web-gateway flow metadata'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'webproxy:applog', 'channel': 'DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed'}

[AN1747] Analytic 1747

Current version: 1.1

	Old Description			New Description
t	1	A defender correlates a sudden carrier identity/service stat	t	1	For Android, detect SIM Card Swap by correlating analyst-vis
	>	e change (SIM/line identifier change or unexpected loss of c		>	ible device/network evidence and management state; use strea
	>	ellular service) with near-term device messaging/telephony d		>	ming or batched telemetry only where the documented collecto
	>	isruption and a concurrent shift in authentication traffic p		>	r is deployed. Correlate Host Status via Android Enterprise
	>	atterns—such as a spike in SMS-based verification flows or a		>	DPC [DevicePolicyManager policy/compliance/security-state qu
	>	ccount recovery activity from the same user’s identities—ind		>	eries and SecurityLog events where supported]; System Settin
	>	icating the user’s number may have been transferred to a dif		>	gs via Android Enterprise DPC [DevicePolicyManager policy/co
	>	ferent SIM/device (SIM swap impact).		>	mpliance/security-state queries and SecurityLog events where
				>	supported]; User Account Authentication via Application Vet
				>	ting / Identity Provider Telemetry [App authentication flow
				>	instrumentation or IdP sign-in/audit events]. Alert on a seq
				>	uence or state change inconsistent with the device/app basel
				>	ine, approved management policy, or expected user workflow;
				>	do not infer unobserved API calls, file/process activity, or
				>	payload content from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.375000+00:00	2026-10-13 17:41:30.678000+00:00
description	A defender correlates a sudden carrier identity/service state change (SIM/line identifier change or unexpected loss of cellular service) with near-term device messaging/telephony disruption and a concurrent shift in authentication traffic patterns—such as a spike in SMS-based verification flows or account recovery activity from the same user’s identities—indicating the user’s number may have been transferred to a different SIM/device (SIM swap impact).	For Android, detect SIM Card Swap by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Host Status via Android Enterprise DPC [DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported]; System Settings via Android Enterprise DPC [DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported]; User Account Authentication via Application Vetting / Identity Provider Telemetry [App authentication flow instrumentation or IdP sign-in/audit events]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:MDMLog', 'channel': 'Device inventory changes involving phone number/line identifier fields (when available), eSIM profile presence, or compliance signal indicating SIM profile change'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--a953ca55-921a-44f7-9b8d-3d40141aa17e', 'name': 'idp:AuditLog', 'channel': 'App authentication flow instrumentation or IdP sign-in/audit events'}
x_mitre_mutable_elements[1]	{'field': 'SimStateChangeTypes', 'description': 'Which SIM-related state changes to alert on (SIM removed, SIM refresh, operator changed, eSIM profile changed).'}	{'field': 'SIMSwapWindow', 'description': 'Default 3600s correlation window.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--56c2b384-77f8-461f-a71a-76f7888ebfb6', 'name': 'MobileEDR:telemetry', 'channel': 'Cellular service state transitions (in-service→no-service), SIM state change, carrier/operator identifier change, or baseband/telephony stack state change observed by agent telemetry'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--85a533a4-5fa4-4dba-b45d-f0717bedd6e6', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported'}
x_mitre_mutable_elements[0]	{'field': 'ServiceLossDurationThreshold', 'description': 'Minimum duration of unexpected cellular service loss before considering it suspicious (reduces noise from transient coverage issues).'}	{'field': 'CellularLossThreshold', 'description': 'Default 300s service loss. Brief outages are normal; sustained loss + ICCID change is anomalous.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': "Agent-observable telephony subscription/state API signals indicating SIM/eSIM subscription change (vendor-agnostic: 'telephony subscription changed')"}	{'x_mitre_data_component_ref': 'x-mitre-data-component--56c2b384-77f8-461f-a71a-76f7888ebfb6', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'NSM:Flow', 'channel': 'Near-term increase in traffic to identity endpoints associated with SMS MFA, account recovery, or OTP verification (IdP, banking, crypto), correlated to SIM/service loss'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'NSM:Flow', 'channel': 'Abrupt shift from cellular egress to Wi-Fi-only egress, or new VPN/proxy session establishment following cellular service loss'}
x_mitre_mutable_elements	{'field': 'SwapCorrelationWindow', 'description': 'Time window to correlate SIM/service state change with downstream identity traffic anomalies (e.g., 30m–6h).'}
x_mitre_mutable_elements	{'field': 'IdentityEndpointAllowList', 'description': 'Baseline of expected IdP/banking/crypto identity endpoints for the org; used to reduce false positives.'}
x_mitre_mutable_elements	{'field': 'AuthTrafficSpikeThreshold', 'description': 'Threshold for increase in OTP/MFA/account recovery traffic volume relative to user baseline.'}
x_mitre_mutable_elements	{'field': 'UserTravelContext', 'description': 'Optional enrichment—treat carrier changes as lower risk during known travel/roaming windows.'}

[AN1748] Analytic 1748

Current version: 1.1

	Old Description			New Description
t	1	A defender correlates an unexpected change in cellular subsc	t	1	For iOS, detect SIM Card Swap by correlating analyst-visible
	>	ription state (eSIM/SIM profile change, carrier/operator cha		>	device/network evidence and management state; use streaming
	>	nge, or sudden persistent loss of cellular service) with nea		>	or batched telemetry only where the documented collector is
	>	r-term disruption signals and a rapid increase in authentica		>	deployed. Correlate Host Status via Apple MDM [DeviceInform
	>	tion-related network activity consistent with SMS verificati		>	ation / SecurityInfo / ProfileList / restrictions and compli
	>	on or account recovery flows, suggesting the user’s number h		>	ance queries]; System Settings via Apple MDM [DeviceInformat
	>	as been ported to an adversary-controlled SIM/device (SIM sw		>	ion / SecurityInfo / ProfileList / restrictions and complian
	>	ap impact).		>	ce queries]; User Account Authentication via Application Vet
				>	ting / Identity Provider Telemetry [App authentication flow
				>	instrumentation or IdP sign-in/audit events]. Alert on a seq
				>	uence or state change inconsistent with the device/app basel
				>	ine, approved management policy, or expected user workflow;
				>	do not infer unobserved API calls, file/process activity, or
				>	payload content from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.377000+00:00	2026-10-13 17:41:31.359000+00:00
description	A defender correlates an unexpected change in cellular subscription state (eSIM/SIM profile change, carrier/operator change, or sudden persistent loss of cellular service) with near-term disruption signals and a rapid increase in authentication-related network activity consistent with SMS verification or account recovery flows, suggesting the user’s number has been ported to an adversary-controlled SIM/device (SIM swap impact).	For iOS, detect SIM Card Swap by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Host Status via Apple MDM [DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries]; System Settings via Apple MDM [DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries]; User Account Authentication via Application Vetting / Identity Provider Telemetry [App authentication flow instrumentation or IdP sign-in/audit events]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': "Agent-observable telephony subscription/state API signals indicating SIM/eSIM subscription change (vendor-agnostic: 'telephony subscription changed')"}	{'x_mitre_data_component_ref': 'x-mitre-data-component--a953ca55-921a-44f7-9b8d-3d40141aa17e', 'name': 'idp:AuditLog', 'channel': 'App authentication flow instrumentation or IdP sign-in/audit events'}
x_mitre_mutable_elements[1]	{'field': 'ServiceLossDurationThreshold', 'description': 'Minimum persistent no-service duration required to reduce false positives from normal carrier fluctuations.'}	{'field': 'SIMSwapWindow', 'description': 'Default 3600s.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--56c2b384-77f8-461f-a71a-76f7888ebfb6', 'name': 'MobileEDR:telemetry', 'channel': 'Cellular service state transitions (in-service→no-service), SIM state change, carrier/operator identifier change, or baseband/telephony stack state change observed by agent telemetry'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--85a533a4-5fa4-4dba-b45d-f0717bedd6e6', 'name': 'iOS:MDM', 'channel': 'DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries'}
x_mitre_mutable_elements[0]	{'field': 'SupervisedInventoryAvailability', 'description': 'Tuning based on whether supervised iOS + MDM provides sufficient subscription/eSIM visibility; otherwise rely on agent + network signals.'}	{'field': 'CellularLossThreshold', 'description': 'Default 300s.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'iOS:MDMLog', 'channel': 'Managed device inventory change indicating cellular plan/eSIM profile updates (where available via supervised iOS + MDM reporting)'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--56c2b384-77f8-461f-a71a-76f7888ebfb6', 'name': 'iOS:MDM', 'channel': 'DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'NSM:Flow', 'channel': 'Near-term increase in traffic to identity endpoints associated with SMS MFA, account recovery, or OTP verification (IdP, banking, crypto), correlated to SIM/service loss'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'NSM:Flow', 'channel': 'Abrupt shift from cellular egress to Wi-Fi-only egress, or new VPN/proxy session establishment following cellular service loss'}
x_mitre_mutable_elements	{'field': 'SwapCorrelationWindow', 'description': 'Time window to link subscription disruption with identity/auth network anomalies.'}
x_mitre_mutable_elements	{'field': 'AuthTrafficSpikeThreshold', 'description': 'Threshold for suspicious increase in OTP/MFA/account recovery traffic relative to device/user baseline.'}
x_mitre_mutable_elements	{'field': 'RoamingExpectedRegions', 'description': 'Tuning to reduce false positives when the user is traveling or roaming across carrier networks.'}
x_mitre_mutable_elements	{'field': 'IdentityEndpointAllowList', 'description': 'Baseline list of expected identity endpoints (IdP, banking, crypto) for the device/user population'}

[AN1750] Analytic 1750

Current version: 1.0

+For Android, detect Data Manipulation from documented manage
->
+ment, network, or vetting evidence; treat state queries as p
->
+eriodic observations rather than real-time events. Correlate
+ API Calls via Application Vetting / Instrumented Dynamic An
+alysis [Dynamic API/runtime trace: ContentResolver.update()
+called by writer_app NOT IN $LegitimateIPCPartners$ for targ
+et_app's content provider URI]; Application State via Androi
+d Enterprise / EMM [Managed package inventory/status and pac
+kage metadata]; File Modification via Application Vetting /
+Forensic Acquisition [Dynamic filesystem trace or acquired a
+pp-container/filesystem artifacts: ContentResolver.update()
+or write() to path owned by target_app IN $HighValueAppList$
+ by writer_app != target_app — cross-app data modification].
+ Alert on a sequence or state change inconsistent with the d
+evice/app baseline, approved management policy, or expected
+user workflow; do not infer unobserved API calls, file/proce
+ss activity, or payload content from management state alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'HighValueAppList', 'description': 'Banking, payment, enterprise auth, HR apps. Derive from MDM catalog by data tier.'}, {'field': 'LegitimateIPCPartners', 'description': 'Apps with declared content provider client relationships to target. Derive from app IPC graph.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:41:59.851000+00:00
description	Application vetting services could look for use of standard APIs (e.g. the clipboard API) that could indicate data manipulation is occurring.	For Android, detect Data Manipulation from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: ContentResolver.update() called by writer_app NOT IN $LegitimateIPCPartners$ for target_app's content provider URI]; Application State via Android Enterprise / EMM [Managed package inventory/status and package metadata]; File Modification via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: ContentResolver.update() or write() to path owned by target_app IN $HighValueAppList$ by writer_app != target_app — cross-app data modification]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'Application Vetting', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'mobile:DynamicAnalysis', 'channel': "Dynamic API/runtime trace: ContentResolver.update() called by writer_app NOT IN $LegitimateIPCPartners$ for target_app's content provider URI"}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'android:EMM', 'channel': 'Managed package inventory/status and package metadata'}
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--84572de3-9583-4c73-aabd-06ea88123dd8', 'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: ContentResolver.update() or write() to path owned by target_app IN $HighValueAppList$ by writer_app != target_app — cross-app data modification'}

[AN1751] Analytic 1751

Current version: 1.1

	Old Description			New Description
t	1	Defender correlates an app acquiring input-capture capabilit	t	1	For Android, detect Keylogging by correlating analyst-visibl
	>	y (AccessibilityService enablement or default IME set) with		>	e device/network evidence and management state; use streamin
	>	high-frequency text-change/IME commit callbacks sourced from		>	g or batched telemetry only where the documented collector i
	>	other packages, followed by local keylog persistence and/or		>	s deployed. Correlate API Calls via Application Vetting / In
	>	small, immediate network egress. Chain: capability/permissi		>	strumented Dynamic Analysis [Dynamic API/runtime trace: Acce
	>	on → intercept (accessibility ‘TYPE_VIEW_TEXT_CHANGED’ or IM		>	ssibilityEvent.TYPE_VIEW_TEXT_CHANGED received by listener N
	>	E commitText/onStartInput bursts) → persist to container → n		>	OT IN $AccessibilityAllowList$ at rate > $KeystrokeEventThre
	>	ear-term egress.		>	shold$ per minute with source_apps spanning > $AppMonitorCou
				>	ntThreshold$ distinct apps]; Network Traffic Content via Ent
				>	erprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection o
				>	r proxy transaction metadata where enterprise decryption/ins
				>	pection is deployed]; Permissions Request via Android Enterp
				>	rise DPC / Application Vetting [DevicePolicyManager.getPermi
				>	ssionGrantState(); PackageManager manifest/requested-permiss
				>	ion review]. Alert on a sequence or state change inconsisten
				>	t with the device/app baseline, approved management policy,
				>	or expected user workflow; do not infer unobserved API calls
				>	, file/process activity, or payload content from management
				>	state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.380000+00:00	2026-10-13 17:41:09.524000+00:00
description	Defender correlates an app acquiring input-capture capability (AccessibilityService enablement or default IME set) with high-frequency text-change/IME commit callbacks sourced from other packages, followed by local keylog persistence and/or small, immediate network egress. Chain: capability/permission → intercept (accessibility ‘TYPE_VIEW_TEXT_CHANGED’ or IME commitText/onStartInput bursts) → persist to container → near-term egress.	For Android, detect Keylogging by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: AccessibilityEvent.TYPE_VIEW_TEXT_CHANGED received by listener NOT IN $AccessibilityAllowList$ at rate > $KeystrokeEventThreshold$ per minute with source_apps spanning > $AppMonitorCountThreshold$ distinct apps]; Network Traffic Content via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed]; Permissions Request via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[3]	{'field': 'PersistPathRegex', 'description': 'Regex for keylog artifacts in app container.'}	{'field': 'TargetAppList', 'description': 'Banking, auth, enterprise app packages.'}
x_mitre_mutable_elements[1]	{'field': 'MinKeyEventBurst', 'description': 'Minimum input events in window to flag (e.g., ≥10).'}	{'field': 'KeystrokeEventThreshold', 'description': 'Default 50 events/min — human typing baseline. Derive by measurement.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--1887a270-576a-4049-84de-ef746b2572d6', 'name': 'android:logcat', 'channel': 'Grant/enablement for BIND_ACCESSIBILITY_SERVICE or BIND_INPUT_METHOD for '}	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: AccessibilityEvent.TYPE_VIEW_TEXT_CHANGED received by listener NOT IN $AccessibilityAllowList$ at rate > $KeystrokeEventThreshold$ per minute with source_apps spanning > $AppMonitorCountThreshold$ distinct apps'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindowSeconds', 'description': 'Max time between intercept → persist/exfil (e.g., 5–45s).'}	{'field': 'AccessibilityAllowList', 'description': 'Approved assistive tech only. Minimal list.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'android:logcat', 'channel': 'AccessibilityService connected\|TYPE_VIEW_TEXT_CHANGED\|TYPE_VIEW_FOCUSED events for other packages'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'webproxy:applog', 'channel': 'DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed'}
x_mitre_mutable_elements[2]	{'field': 'RequireA11yOrIME', 'description': 'Only alert when capability is via Accessibility or IME (true/false).'}	{'field': 'AppMonitorCountThreshold', 'description': 'Default 3 distinct source apps — keylogger monitors broadly; assistive tech monitors narrowly.'}
x_mitre_mutable_elements[4]	{'field': 'ExfilDomainAllowlist', 'description': 'Enterprise/analytics endpoints to suppress FPs.'}	{'field': 'KeylogPayloadThreshold', 'description': 'Default 1KB — keystroke logs are small and dense.'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'android:logcat', 'channel': 'Default IME active imeId=; frequent onStartInput/commitText calls'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--e2f72131-14d1-411f-8e8c-aa3453dd5456', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}
x_mitre_mutable_elements[5]	{'field': 'UserContext', 'description': 'Foreground/Work Profile/Kiosk to scope alerts.'}	{'field': 'KeylogExfilWindow', 'description': 'Default 300s.'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		{'field': 'AppCDNList', 'description': 'Per-app CDN. Derive by measurement.'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'android:logcat', 'channel': 'CREATE/WRITE to /data/data//(files\|databases)/(keys\|inputs\|clipboard).*\\\\.(db\|sqlite\|txt\|log)'}

[AN1752] Analytic 1752

Current version: 1.1

	Old Description			New Description
t	1	Defender correlates a custom keyboard extension activation (	t	1	For iOS, detect Keylogging by correlating analyst-visible de
	>	optionally with TCC ‘Full Access’) or abnormal UI text-entry		>	vice/network evidence and management state; use streaming or
	>	interception with local keylog persistence and/or small egr		>	batched telemetry only where the documented collector is de
	>	ess. Chain: capability/consent (keyboard Full Access/TCC) →		>	ployed. Correlate Application State via Apple MDM [Installed
	>	intercept (keyboard commit events or repeated secure text en		>	ApplicationList / ManagedApplicationList]; Network Traffic F
	>	try edits) → persist to container → near-term egress.		>	low via Apple Network Extension / Enterprise VPN [NEFilterFl
				>	ow / per-app VPN / secure-web-gateway flow metadata]; Permis
				>	sions Request via Application Vetting [Code-signing entitlem
				>	ents and Info.plist privacy usage-description keys]. Alert o
				>	n a sequence or state change inconsistent with the device/ap
				>	p baseline, approved management policy, or expected user wor
				>	kflow; do not infer unobserved API calls, file/process activ
				>	ity, or payload content from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.379000+00:00	2026-10-13 17:41:10.169000+00:00
description	Defender correlates a custom keyboard extension activation (optionally with TCC ‘Full Access’) or abnormal UI text-entry interception with local keylog persistence and/or small egress. Chain: capability/consent (keyboard Full Access/TCC) → intercept (keyboard commit events or repeated secure text entry edits) → persist to container → near-term egress.	For iOS, detect Keylogging by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application State via Apple MDM [InstalledApplicationList / ManagedApplicationList]; Network Traffic Flow via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]; Permissions Request via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[3]	{'field': 'PersistPathRegex', 'description': 'Regex for keylog artifacts under container paths.'}	{'field': 'KeylogVolumeThreshold', 'description': 'Default 10KB per session — keystroke logs are small but dense.'}
x_mitre_mutable_elements[1]	{'field': 'MinKeyEventBurst', 'description': 'Minimum keyboard commit or editingChanged events (e.g., ≥10).'}	{'field': 'KeyboardVendorEndpoints', 'description': 'Known vendor cloud endpoints per approved keyboard.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--1887a270-576a-4049-84de-ef746b2572d6', 'name': 'iOS:unifiedlog', 'channel': 'Keyboard extension Full Access change or related privacy grant for '}	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'iOS:MDM', 'channel': 'InstalledApplicationList / ManagedApplicationList'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindowSeconds', 'description': 'Max time from intercept → persist/exfil (e.g., 5–60s).'}	{'field': 'KeyboardAllowList', 'description': 'IT-approved keyboard bundles.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'iOS:unifiedlog', 'channel': 'Secure text entry focus and editingChanged bursts not typical for the app'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'iOS:NetworkExtension', 'channel': 'NEFilterFlow / per-app VPN / secure-web-gateway flow metadata'}
x_mitre_mutable_elements[2]	{'field': 'KeyboardFullAccessRequired', 'description': 'Require Full Access to elevate severity (true/false).'}	{'field': 'KeystrokeFrequencyThreshold', 'description': 'Default 2 packets/sec.'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'iOS:unifiedlog', 'channel': 'CREATE/WRITE of keylog artifacts (keys_*.txt, inputs.db) within app/keyboard container'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--e2f72131-14d1-411f-8e8c-aa3453dd5456', 'name': 'mobile:ApplicationVetting', 'channel': 'Code-signing entitlements and Info.plist privacy usage-description keys'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_mutable_elements	{'field': 'ExfilDomainAllowlist', 'description': 'Allowlisted enterprise/analytics endpoints.'}
x_mitre_mutable_elements	{'field': 'UserContext', 'description': 'Foreground state, Focus modes, MDM policy.'}

[AN1753] Analytic 1753

Current version: 1.1

	Old Description			New Description
t	1	Defender observes anomalous signaling network queries target	t	1	For Android, detect Impersonate SS7 Nodes by correlating ana
	>	ing subscriber information associated with a device, includi		>	lyst-visible device/network evidence and management state; u
	>	ng unexpected routing requests, location information exchang		>	se streaming or batched telemetry only where the documented
	>	es, or node-origin inconsistencies indicative of SS7 signali		>	collector is deployed. Correlate Network Communication via A
	>	ng abuse. (Citation: CSRIC5-WG10-FinalReport) The CSRIC also		>	ndroid Enterprise Network Logging / Enterprise VPN [DevicePo
	>	suggests threat information sharing between telecommunicati		>	licyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent;
	>	ons industry members.		>	VPN flow metadata]; Network Traffic Content via Enterprise S
				>	ecure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy t
				>	ransaction metadata where enterprise decryption/inspection i
				>	s deployed]; Network Traffic Flow via Android Enterprise Net
				>	work Logging / Enterprise VPN [DevicePolicyManager.retrieveN
				>	etworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]. A
				>	lert on a sequence or state change inconsistent with the dev
				>	ice/app baseline, approved management policy, or expected us
				>	er workflow; do not infer unobserved API calls, file/process
				>	activity, or payload content from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.381000+00:00	2026-10-13 17:41:28.140000+00:00
description	Defender observes anomalous signaling network queries targeting subscriber information associated with a device, including unexpected routing requests, location information exchanges, or node-origin inconsistencies indicative of SS7 signaling abuse. (Citation: CSRIC5-WG10-FinalReport) The CSRIC also suggests threat information sharing between telecommunications industry members.	For Android, detect Impersonate SS7 Nodes by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Network Communication via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]; Network Traffic Content via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed]; Network Traffic Flow via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[1]	{'field': 'SubscriberQueryFrequencyThreshold', 'description': 'Baseline-dependent threshold for excessive subscriber queries'}	{'field': 'MonitoredMSISDNList', 'description': 'Enterprise employee MSISDN list for targeted monitoring. Derive from HR.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'TelecomLogs:SS7Signaling', 'channel': 'Subscriber information queries, routing requests, or location update messages with anomalous node identifiers or unexpected origin patterns'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--764ee29e-48d6-4934-8e6b-7a606aaaafc0', 'name': 'android:EnterpriseNetworkLog', 'channel': 'DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata'}
x_mitre_mutable_elements[0]	{'field': 'NodeIdentityDeviationThreshold', 'description': 'Defines acceptable variance for signaling node identifiers'}	{'field': 'LegitimateRoamingPartners', 'description': 'Carrier-maintained verified roaming partner GT/PC list.'}
x_mitre_mutable_elements[2]	{'field': 'GeographicRoutingDeviation', 'description': 'Expected signaling path vs observed routing anomalies'}	{'field': 'SS7QueryThreshold', 'description': 'Default 3 queries for same MSISDN within window.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'TelecomLogs:MobilityEvents', 'channel': 'Unexpected location resolution events or abnormal subscriber tracking requests'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'webproxy:applog', 'channel': 'DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'android:EnterpriseNetworkLog', 'channel': 'DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata'}
x_mitre_mutable_elements		{'field': 'SS7QueryWindow', 'description': 'Default 3600s.'}

[AN1754] Analytic 1754

Current version: 1.1

	Old Description			New Description
t	1	Defender observes anomalous signaling interactions involving	t	1	For iOS, detect Impersonate SS7 Nodes by correlating analyst
	>	subscriber identity or location resolution events associate		>	-visible device/network evidence and management state; use s
	>	d with a device, including abnormal routing requests, unexpe		>	treaming or batched telemetry only where the documented coll
	>	cted location information exchanges, or signaling node incon		>	ector is deployed. Correlate Network Communication via Apple
	>	sistencies indicative of SS7 abuse. (Citation: CSRIC5-WG10-F		>	Network Extension / Enterprise VPN [NEFilterFlow / per-app
	>	inalReport) The CSRIC also suggests threat information shari		>	VPN / secure-web-gateway flow metadata]; Network Traffic Con
	>	ng between telecommunications industry members.		>	tent via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S)
				>	inspection or proxy transaction metadata where enterprise de
				>	cryption/inspection is deployed]; Network Traffic Flow via A
				>	pple Network Extension / Enterprise VPN [NEFilterFlow / per-
				>	app VPN / secure-web-gateway flow metadata]. Alert on a sequ
				>	ence or state change inconsistent with the device/app baseli
				>	ne, approved management policy, or expected user workflow; d
				>	o not infer unobserved API calls, file/process activity, or
				>	payload content from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.380000+00:00	2026-10-13 17:41:28.755000+00:00
description	Defender observes anomalous signaling interactions involving subscriber identity or location resolution events associated with a device, including abnormal routing requests, unexpected location information exchanges, or signaling node inconsistencies indicative of SS7 abuse. (Citation: CSRIC5-WG10-FinalReport) The CSRIC also suggests threat information sharing between telecommunications industry members.	For iOS, detect Impersonate SS7 Nodes by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Network Communication via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]; Network Traffic Content via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed]; Network Traffic Flow via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[1]	{'field': 'SignalingPathDeviationThreshold', 'description': 'Expected vs observed signaling routing paths'}	{'field': 'SS7QueryThreshold', 'description': 'Default 3 queries.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'TelecomLogs:SS7Signaling', 'channel': 'Location resolution, routing, or subscriber information exchanges with anomalous signaling paths or node identities'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--764ee29e-48d6-4934-8e6b-7a606aaaafc0', 'name': 'iOS:NetworkExtension', 'channel': 'NEFilterFlow / per-app VPN / secure-web-gateway flow metadata'}
x_mitre_mutable_elements[0]	{'field': 'LocationQueryAnomalyThreshold', 'description': 'Baseline deviation tolerance for location resolution events'}	{'field': 'LegitimateRoamingPartners', 'description': 'Same carrier roaming partner list.'}
x_mitre_mutable_elements[2]	{'field': 'SubscriberResolutionFrequency', 'description': 'Threshold for abnormal resolution or lookup behavior'}	{'field': 'SS7QueryWindow', 'description': 'Default 3600s.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'TelecomLogs:MobilityEvents', 'channel': 'Unexpected subscriber tracking or abnormal mobility/location resolution activity'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'webproxy:applog', 'channel': 'DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'iOS:NetworkExtension', 'channel': 'NEFilterFlow / per-app VPN / secure-web-gateway flow metadata'}

[AN1755] Analytic 1755

Current version: 1.1

	Old Description			New Description
t	1	Defender observes a mobile device initiating abnormal or exp	t	1	For Android, detect Exploitation of Remote Services by corre
	>	loit-like network interactions with internal or remote servi		>	lating analyst-visible device/network evidence and managemen
	>	ces, followed by process-level instability, privilege bounda		>	t state; use streaming or batched telemetry only where the d
	>	ry shifts, or unexpected execution behaviors indicative of s		>	ocumented collector is deployed. Correlate Application Permi
	>	ervice exploitation outcomes.		>	ssion via Android Enterprise DPC / Application Vetting [Devi
				>	cePolicyManager.getPermissionGrantState(); PackageManager ma
				>	nifest/requested-permission review]; Application State via A
				>	ndroid Enterprise / EMM [Managed package inventory/status an
				>	d package metadata]; Network Connection Creation via Android
				>	Enterprise Network Logging / Enterprise VPN [DevicePolicyMa
				>	nager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN fl
				>	ow metadata]. Alert on a sequence or state change inconsiste
				>	nt with the device/app baseline, approved management policy,
				>	or expected user workflow; do not infer unobserved API call
				>	s, file/process activity, or payload content from management
				>	state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.383000+00:00	2026-10-13 17:41:23.750000+00:00
description	Defender observes a mobile device initiating abnormal or exploit-like network interactions with internal or remote services, followed by process-level instability, privilege boundary shifts, or unexpected execution behaviors indicative of service exploitation outcomes.	For Android, detect Exploitation of Remote Services by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; Application State via Android Enterprise / EMM [Managed package inventory/status and package metadata]; Network Connection Creation via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[1]	{'field': 'CrashCorrelationWindow', 'description': 'Temporal linkage between suspicious network activity and process instability'}	{'field': 'EnterpriseSubnetRange', 'description': 'RFC1918 + VPN subnets.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'NSM:Connections', 'channel': 'Outbound connections to internal enterprise services exhibiting anomalous protocol behavior, malformed sessions, or exploit-consistent traffic patterns'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}
x_mitre_mutable_elements[0]	{'field': 'ProtocolAnomalyThreshold', 'description': 'Defines deviation tolerance for malformed or exploit-like protocol behavior'}	{'field': 'ExploitRelevantPorts', 'description': '22, 80, 443, 445, 3389, 8080. Derive from internal service map.'}
x_mitre_mutable_elements[2]	{'field': 'EnterpriseServiceBaseline', 'description': 'Environment-specific baseline of expected internal service communications'}	{'field': 'PreExploitWindow', 'description': 'Default 300s — scan must precede exploit on same device.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--85a533a4-5fa4-4dba-b45d-f0717bedd6e6', 'name': 'AndroidLogs:Crash', 'channel': 'Application or system process crash/restart patterns temporally associated with remote service communications'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'android:EMM', 'channel': 'Managed package inventory/status and package metadata'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba', 'name': 'android:EnterpriseNetworkLog', 'channel': 'DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata'}
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'webproxy:applog', 'channel': 'DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed'}
x_mitre_mutable_elements		{'field': 'LateralMovementWindow', 'description': 'Default 600s from scan start to exploit attempt.'}

[AN1756] Analytic 1756

Current version: 1.1

	Old Description			New Description
t	1	Defender observes a mobile device engaging remote or interna	t	1	For iOS, detect Network Service Scanning by correlating anal
	>	l services with traffic characteristics inconsistent with no		>	yst-visible device/network evidence and management state; us
	>	rmal application behavior, followed by execution anomalies,		>	e streaming or batched telemetry only where the documented c
	>	application instability, or security context deviations cons		>	ollector is deployed. Correlate Application Permission via A
	>	istent with exploitation effects.		>	pplication Vetting [Code-signing entitlements and Info.plist
				>	privacy usage-description keys]; Network Connection Creatio
				>	n via Apple Network Extension / Enterprise VPN [NEFilterFlow
				>	/ per-app VPN / secure-web-gateway flow metadata]; Network
				>	Traffic Content via Enterprise Secure Web Gateway / Proxy [D
				>	NS/HTTP(S) inspection or proxy transaction metadata where en
				>	terprise decryption/inspection is deployed]. Alert on a sequ
				>	ence or state change inconsistent with the device/app baseli
				>	ne, approved management policy, or expected user workflow; d
				>	o not infer unobserved API calls, file/process activity, or
				>	payload content from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.378000+00:00	2026-10-13 17:41:20.243000+00:00
description	Defender observes a mobile device engaging remote or internal services with traffic characteristics inconsistent with normal application behavior, followed by execution anomalies, application instability, or security context deviations consistent with exploitation effects.	For iOS, detect Network Service Scanning by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]; Network Connection Creation via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]; Network Traffic Content via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'NSM:Connections', 'channel': 'Outbound connections to internal enterprise services exhibiting anomalous protocol behavior, malformed sessions, or exploit-consistent traffic patterns'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'mobile:ApplicationVetting', 'channel': 'Code-signing entitlements and Info.plist privacy usage-description keys'}
x_mitre_mutable_elements[0]	{'field': 'TrafficDeviationThreshold', 'description': 'Defines acceptable protocol and payload variation'}	{'field': 'PortScanThreshold', 'description': 'Default 20 distinct ports within window.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--85a533a4-5fa4-4dba-b45d-f0717bedd6e6', 'name': 'iOS:unifiedlog', 'channel': 'Application crash logs, watchdog terminations, or abnormal execution events associated with service communication'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba', 'name': 'iOS:NetworkExtension', 'channel': 'NEFilterFlow / per-app VPN / secure-web-gateway flow metadata'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'webproxy:applog', 'channel': 'DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed'}
x_mitre_mutable_elements		{'field': 'PreExploitWindow', 'description': 'Default 300s.'}
x_mitre_mutable_elements		{'field': 'LateralMovementWindow', 'description': 'Default 600s.'}

[AN1758] Analytic 1758

Current version: 1.1

	Old Description			New Description
t	1	From the defender’s perspective, this strategy correlates si	t	1	For Android, detect Exploitation for Privilege Escalation by
	>	gnals that a previously unprivileged Android app or process		>	correlating analyst-visible device/network evidence and man
	>	has gained higher privileges through exploitation rather tha		>	agement state; use streaming or batched telemetry only where
	>	n normal OS or MDM flows. Observable behaviors include: (1		>	the documented collector is deployed. Correlate Application
	>	) unprivileged app processes issuing sensitive syscalls or a		>	Permission via Android Enterprise DPC / Application Vetting
	>	ccessing privileged device interfaces, (2) bursts of SELinu		>	[DevicePolicyManager.getPermissionGrantState(); PackageMana
	>	x denials followed by an unexpected domain or permission cha		>	ger manifest/requested-permission review]; Host Status via A
	>	nge, (3) creation of new processes running with system or r		>	ndroid Enterprise DPC [DevicePolicyManager policy/compliance
	>	oot UID whose lineage traces back to an app sandbox path, an		>	/security-state queries and SecurityLog events where support
	>	d (4) crashes or abnormal restarts of privileged system ser		>	ed]; Network Traffic Flow via Android Enterprise Network Log
	>	vices followed shortly by a new connection or binder interac		>	ging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLo
	>	tion from the same low-privileged app. The focus is on unusu		>	gs(): DnsEvent / ConnectEvent; VPN flow metadata]. Alert on
	>	al privilege transitions, anomalous process ancestry, and OS		>	a sequence or state change inconsistent with the device/app
	>	security policy violations, not on specific exploit binarie		>	baseline, approved management policy, or expected user workf
	>	s or CVE signatures.		>	low; do not infer unobserved API calls, file/process activit
				>	y, or payload content from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.384000+00:00	2026-10-13 17:40:59.991000+00:00
description	From the defender’s perspective, this strategy correlates signals that a previously unprivileged Android app or process has gained higher privileges through exploitation rather than normal OS or MDM flows. Observable behaviors include: (1) unprivileged app processes issuing sensitive syscalls or accessing privileged device interfaces, (2) bursts of SELinux denials followed by an unexpected domain or permission change, (3) creation of new processes running with system or root UID whose lineage traces back to an app sandbox path, and (4) crashes or abnormal restarts of privileged system services followed shortly by a new connection or binder interaction from the same low-privileged app. The focus is on unusual privilege transitions, anomalous process ancestry, and OS security policy violations, not on specific exploit binaries or CVE signatures.	For Android, detect Exploitation for Privilege Escalation by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; Host Status via Android Enterprise DPC [DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported]; Network Traffic Flow via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[3]	{'field': 'PrivilegedServices', 'description': 'Set of high-value Android system services where crashes or restarts are particularly suspicious (for example, system_server, mediaserver).'}	{'field': 'AppBaselineDomains', 'description': 'Per-device CDN baseline, 30-day measurement.'}
x_mitre_mutable_elements[1]	{'field': 'AppUidRange', 'description': 'UID ranges that represent unprivileged application accounts in a specific Android OEM or enterprise deployment.'}	{'field': 'PrivilegedAppList', 'description': 'MDM agent, OTA update service, approved Device Admin apps.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--85a533a4-5fa4-4dba-b45d-f0717bedd6e6', 'name': 'AndroidLogs:Crash', 'channel': 'Crash or abnormal restart of privileged system services (for example, system_server, mediaserver, installd) followed shortly by new privileged process activity or binder connections from a single app UID'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindow', 'description': 'Correlation window (for example, 60–300 seconds) between SELinux events, crashes, and privilege changes to reduce noise while still capturing exploit chains.'}	{'field': 'PatchLagThreshold', 'description': 'Default 30 days. Align to org patch SLA.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'AndroidLogs:Kernel', 'channel': 'Unprivileged app process (app UID, non-system) invoking sensitive syscalls or device interfaces associated with privilege escalation (setuid, ptrace, perf_event_open, vulnerable drivers)'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--85a533a4-5fa4-4dba-b45d-f0717bedd6e6', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported'}
x_mitre_mutable_elements[2]	{'field': 'SensitiveSyscalls', 'description': 'List of syscalls considered indicative of privilege escalation attempts; may vary by kernel version, OEM drivers, and threat model.'}	{'field': 'EscalationWindow', 'description': 'Default 600s after root detection. Adjust to MDM check-in interval.'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'AndroidLogs:Framework', 'channel': 'Creation of a new process running as system or root UID whose executable path resides under an app container path (for example, /data/app or /data/user/0/), or whose parent process originates from an app sandbox'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'android:EnterpriseNetworkLog', 'channel': 'DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_mutable_elements	{'field': 'PrivilegedUids', 'description': 'Enterprise-defined mapping of UIDs considered elevated (for example, root, system, radio) for alert scoping.'}

[AN1759] Analytic 1759

Current version: 1.1

	Old Description			New Description
t	1	Correlates app sandbox escape attempts via unsigned binary e	t	1	For iOS, detect Exploitation for Privilege Escalation by cor
	>	xecution, mmap memory permission changes (RWX), and sandbox		>	relating analyst-visible device/network evidence and managem
	>	profile violations. Detection chain includes app leveraging		>	ent state; use streaming or batched telemetry only where the
	>	JIT/JSC to execute shellcode or triggering kernel exploit vi		>	documented collector is deployed. Correlate Host Status via
	>	a crafted IOKit or Mach port abuse.		>	Apple MDM [DeviceInformation / SecurityInfo / ProfileList /
				>	restrictions and compliance queries]; Network Traffic Flow
				>	via Apple Network Extension / Enterprise VPN [NEFilterFlow /
				>	per-app VPN / secure-web-gateway flow metadata]; OS API Exe
				>	cution via Application Vetting / Instrumented Dynamic Analys
				>	is [Dynamic API/runtime trace: Unified Log entry at level=fa
				>	ult in subsystem com.apple.kernel or com.apple.sandbox withi
				>	n $KernelFaultWindow$ of integrity_check failure — kernel-le
				>	vel fault coincident with integrity failure is the exploit-e
				>	xecution signal; requires super]. Alert on a sequence or sta
				>	te change inconsistent with the device/app baseline, approve
				>	d management policy, or expected user workflow; do not infer
				>	unobserved API calls, file/process activity, or payload con
				>	tent from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.376000+00:00	2026-10-13 17:41:00.657000+00:00
description	Correlates app sandbox escape attempts via unsigned binary execution, mmap memory permission changes (RWX), and sandbox profile violations. Detection chain includes app leveraging JIT/JSC to execute shellcode or triggering kernel exploit via crafted IOKit or Mach port abuse.	For iOS, detect Exploitation for Privilege Escalation by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Host Status via Apple MDM [DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries]; Network Traffic Flow via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]; OS API Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: Unified Log entry at level=fault in subsystem com.apple.kernel or com.apple.sandbox within $KernelFaultWindow$ of integrity_check failure — kernel-level fault coincident with integrity failure is the exploit-execution signal; requires super]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[1]	{'field': 'RWXThreshold', 'description': 'Adjustable threshold for RWX page allocation frequency or size.'}	{'field': 'AppBaselineDomains', 'description': 'Per-device CDN baseline, 30-day.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--85a533a4-5fa4-4dba-b45d-f0717bedd6e6', 'name': 'iOS:unifiedlog', 'channel': 'code signature validation failure / exec of invalidly-signed payload from sandboxed app'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--85a533a4-5fa4-4dba-b45d-f0717bedd6e6', 'name': 'iOS:MDM', 'channel': 'DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries'}
x_mitre_mutable_elements[0]	{'field': 'ExecutableHashAllowList', 'description': 'Allowlist known benign unsigned binaries for reducing FP.'}	{'field': 'KernelFaultWindow', 'description': 'Default 60s between integrity failure and kernel fault.'}
x_mitre_mutable_elements[2]	{'field': 'JITContextDetection', 'description': 'May require tuning based on OS version and legitimate app usage (e.g., Safari JIT).'}	{'field': 'PostExploitWindow', 'description': 'Default 300s after integrity failure.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'iOS:unifiedlog', 'channel': 'mmap with PROT_EXEC and PROT_WRITE by sandboxed app'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'iOS:NetworkExtension', 'channel': 'NEFilterFlow / per-app VPN / secure-web-gateway flow metadata'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Unified Log entry at level=fault in subsystem com.apple.kernel or com.apple.sandbox within $KernelFaultWindow$ of integrity_check failure — kernel-level fault coincident with integrity failure is the exploit-execution signal; requires super'}

[AN1760] Analytic 1760

Current version: 1.0

+For Android, detect Exploitation for Initial Access by corre
->
+lating analyst-visible device/network evidence and managemen
+t state; use streaming or batched telemetry only where the d
+ocumented collector is deployed. Correlate Host Status via A
+ndroid Enterprise DPC [DevicePolicyManager policy/compliance
+/security-state queries and SecurityLog events where support
+ed]; Network Connection Creation via Android Enterprise Netw
+ork Logging / Enterprise VPN [DevicePolicyManager.retrieveNe
+tworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]; Pr
+ocess Creation via Application Vetting / Managed Device Tele
+metry [execve()]. Alert on a sequence or state change incons
+istent with the device/app baseline, approved management pol
+icy, or expected user workflow; do not infer unobserved API
+calls, file/process activity, or payload content from manage
+ment state alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'SystemServiceList', 'description': 'mediaserver, bluetooth, nfc, android.process.media, com.android.phone.'}, {'field': 'KnownServiceChildren', 'description': 'Known legitimate child processes per system service. Derive from clean-device baseline.'}, {'field': 'PostExploitWindow', 'description': 'Default 30s.'}, {'field': 'AppBaselineDomains', 'description': 'Per-app CDN baseline.'}, {'field': 'CriticalPatchLagDays', 'description': 'Default 30 days. Align with org patch SLA.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:42:16.293000+00:00
description	Mobile security products can often alert the user if their device is vulnerable to known exploits.	For Android, detect Exploitation for Initial Access by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Host Status via Android Enterprise DPC [DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported]; Network Connection Creation via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]; Process Creation via Application Vetting / Managed Device Telemetry [execve()]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--85a533a4-5fa4-4dba-b45d-f0717bedd6e6', 'name': 'Sensor Health', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--85a533a4-5fa4-4dba-b45d-f0717bedd6e6', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba', 'name': 'android:EnterpriseNetworkLog', 'channel': 'DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata'}
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'mobile:DynamicAnalysis', 'channel': 'execve()'}

[AN1761] Analytic 1761

Current version: 1.0

+For iOS, detect Exploitation for Initial Access by correlati
->
+ng analyst-visible device/network evidence and management st
+ate; use streaming or batched telemetry only where the docum
+ented collector is deployed. Correlate Host Status via Apple
+ MDM [DeviceInformation / SecurityInfo / ProfileList / restr
+ictions and compliance queries]; Network Connection Creation
+ via Apple Network Extension / Enterprise VPN [NEFilterFlow
+/ per-app VPN / secure-web-gateway flow metadata]; Process C
+reation via Application Vetting / Managed Device Telemetry [
+kernel fault or unexpected child spawn in subsystem IN (com.
+apple.WebKit, com.apple.imtransferagent, com.apple.imagent)
+at level=fault in Unified Log]. Alert on a sequence or state
+ change inconsistent with the device/app baseline, approved
+management policy, or expected user workflow; do not infer u
+nobserved API calls, file/process activity, or payload conte
+nt from management state alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'AppleSystemBaseline', 'description': 'Apple CDN, update server, push server IP ranges.'}, {'field': 'PostExploitProcessList', 'description': 'imagent, IMTransferAgent, WebContent, com.apple.WebKit.Networking.'}, {'field': 'PostExploitWindow', 'description': 'Default 60s between fault and C2 connection.'}, {'field': 'MinSecureVersion', 'description': 'Latest Apple security patch release. Update from Apple advisories.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:42:16.956000+00:00
description	Mobile security products can often alert the user if their device is vulnerable to known exploits.	For iOS, detect Exploitation for Initial Access by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Host Status via Apple MDM [DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries]; Network Connection Creation via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]; Process Creation via Application Vetting / Managed Device Telemetry [kernel fault or unexpected child spawn in subsystem IN (com.apple.WebKit, com.apple.imtransferagent, com.apple.imagent) at level=fault in Unified Log]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--85a533a4-5fa4-4dba-b45d-f0717bedd6e6', 'name': 'Sensor Health', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--85a533a4-5fa4-4dba-b45d-f0717bedd6e6', 'name': 'iOS:MDM', 'channel': 'DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba', 'name': 'iOS:NetworkExtension', 'channel': 'NEFilterFlow / per-app VPN / secure-web-gateway flow metadata'}
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'mobile:DynamicAnalysis', 'channel': 'kernel fault or unexpected child spawn in subsystem IN (com.apple.WebKit, com.apple.imtransferagent, com.apple.imagent) at level=fault in Unified Log'}

[AN1762] Analytic 1762

Current version: 1.1

	Old Description			New Description
t	1	An application generates, imports, or accesses asymmetric ke	t	1	For Android, detect Asymmetric Cryptography from documented
	>	ypairs (e.g., RSA/ECC), uses a public key to encrypt outboun		>	management, network, or vetting evidence; treat state querie
	>	d data or establish encrypted sessions, and transmits result		>	s as periodic observations rather than real-time events. Cor
	>	ing ciphertext in structured communication patterns. Detecti		>	relate Application Permission via Android Enterprise DPC / A
	>	on correlates keypair lifecycle activity + asymmetric crypto		>	pplication Vetting [DevicePolicyManager.getPermissionGrantSt
	>	API usage + data transformation + background execution cont		>	ate(); PackageManager manifest/requested-permission review];
	>	ext + network transmission, especially when inconsistent wit		>	Application State via Android Enterprise / EMM [Managed pac
	>	h expected application functionality.		>	kage inventory/status and package metadata]; File Creation v
				>	ia Application Vetting / Forensic Acquisition [Dynamic files
				>	ystem trace or acquired app-container/filesystem artifacts:
				>	App writes asymmetric-encrypted blob or encoded ciphertext t
				>	o local staging path before network transmission — encrypted
				>	staging artifact]. Alert on a sequence or state change inco
				>	nsistent with the device/app baseline, approved management p
				>	olicy, or expected user workflow; do not infer unobserved AP
				>	I calls, file/process activity, or payload content from mana
				>	gement state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.376000+00:00	2026-10-13 17:40:53.836000+00:00
description	An application generates, imports, or accesses asymmetric keypairs (e.g., RSA/ECC), uses a public key to encrypt outbound data or establish encrypted sessions, and transmits resulting ciphertext in structured communication patterns. Detection correlates keypair lifecycle activity + asymmetric crypto API usage + data transformation + background execution context + network transmission, especially when inconsistent with expected application functionality.	For Android, detect Asymmetric Cryptography from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; Application State via Android Enterprise / EMM [Managed package inventory/status and package metadata]; File Creation via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: App writes asymmetric-encrypted blob or encoded ciphertext to local staging path before network transmission — encrypted staging artifact]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[1]	{'field': 'AllowedCryptoApps', 'description': 'Apps expected to use asymmetric cryptography (e.g., secure messaging, VPN, enterprise auth apps)'}	{'field': 'InteractionThreshold', 'description': 'Default 300s.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': 'App invokes asymmetric cryptographic operations (e.g., RSA/ECC keypair generation OR public key encryption OR signature operations) on outbound data buffers'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}
x_mitre_log_source_references[4]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:MDMLog', 'channel': 'App not in approved cryptographic or secure communication category performing keypair + encryption + transmission behavior'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Keypair generation, import, or private-key access events occurring prior to outbound communication not matching app declared secure-communication function'}
x_mitre_log_source_references[3]	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'MobileEDR:telemetry', 'channel': 'Asymmetric crypto operations occur while app_state=background OR device_locked=true OR no recent user interaction'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes RSA/ECC keypair generation, public-key import, or asymmetric encryption operations (KeyPairGenerator, Cipher.RSA, ECDH) NOT IN $ApprovedCryptoApps$ before network transmission'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindow', 'description': 'Correlation window between keypair usage and outbound communication'}	{'field': 'ApprovedCryptoApps', 'description': 'VPN clients, enterprise secure messaging, MDM agent, apps with documented asymmetric crypto need (certificate-pinned enterprise apps). Derive from MDM catalog.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': 'Keypair generation, import, or access events (public/private key usage) occurring prior to network communication'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'android:EMM', 'channel': 'Managed package inventory/status and package metadata'}
x_mitre_mutable_elements[2]	{'field': 'ForegroundStateRequired', 'description': 'Whether key generation/encryption should occur only during user interaction'}	{'field': 'AppCDNList', 'description': '30-day per-app network destination baseline.'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'MobileEDR:telemetry', 'channel': 'App writes asymmetric-encrypted blobs or encoded ciphertext to local buffers or files prior to transmission'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: App writes asymmetric-encrypted blob or encoded ciphertext to local staging path before network transmission — encrypted staging artifact'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_mutable_elements	{'field': 'KeyGenerationThreshold', 'description': 'Frequency of keypair generation/import events considered anomalous'}
x_mitre_mutable_elements	{'field': 'PayloadSizeVariance', 'description': 'Expected variability in payload sizes due to asymmetric encryption overhead'}

[AN1764] Analytic 1764

Current version: 1.1

	Old Description			New Description
t	1	The defender correlates Android screen-capture-capable behav	t	1	For Android, detect Screen Capture from documented managemen
	>	ior from an app identity with runtime context showing that f		>	t, network, or vetting evidence; treat state queries as peri
	>	oreground content from another app is being captured outside		>	odic observations rather than real-time events. Correlate Ap
	>	expected user-driven workflows. The strongest Android evide		>	plication Permission via Android Enterprise DPC / Applicatio
	>	nce is MediaProjection-like capture initiation, accessibilit		>	n Vetting [DevicePolicyManager.getPermissionGrantState(); Pa
	>	y-assisted observation of foreground UI content, or privileg		>	ckageManager manifest/requested-permission review]; Applicat
	>	ed screencap or screenrecord behavior, followed by screensho		>	ion State via Android Enterprise / EMM [Managed package inve
	>	t or video artifact creation, buffer growth, or outbound tra		>	ntory/status and package metadata]; OS API Execution via App
	>	nsfer. The detection is strengthened when the capturing app		>	lication Vetting / Instrumented Dynamic Analysis [Dynamic AP
	>	is backgrounded, operates as a foreground service without cl		>	I/runtime trace: MediaProjection capture session, accessibil
	>	ear user-driven recording intent, captures while another sen		>	ity-based foreground content observation, or privileged scre
	>	sitive app is foregrounded, runs with accessibility or eleva		>	encap/screenrecord invocation from app while different app i
	>	ted access inconsistent with its role, or performs capture w		>	s foregrounded — cross-app screen content access]. Alert on
	>	ithout recent user interaction.		>	a sequence or state change inconsistent with the device/app
				>	baseline, approved management policy, or expected user workf
				>	low; do not infer unobserved API calls, file/process activit
				>	y, or payload content from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.377000+00:00	2026-10-13 17:40:54.426000+00:00
description	The defender correlates Android screen-capture-capable behavior from an app identity with runtime context showing that foreground content from another app is being captured outside expected user-driven workflows. The strongest Android evidence is MediaProjection-like capture initiation, accessibility-assisted observation of foreground UI content, or privileged screencap or screenrecord behavior, followed by screenshot or video artifact creation, buffer growth, or outbound transfer. The detection is strengthened when the capturing app is backgrounded, operates as a foreground service without clear user-driven recording intent, captures while another sensitive app is foregrounded, runs with accessibility or elevated access inconsistent with its role, or performs capture without recent user interaction.	For Android, detect Screen Capture from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; Application State via Android Enterprise / EMM [Managed package inventory/status and package metadata]; OS API Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: MediaProjection capture session, accessibility-based foreground content observation, or privileged screencap/screenrecord invocation from app while different app is foregrounded — cross-app screen content access]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[1]	{'field': 'AllowedAppList', 'description': 'Approved screen-recording, accessibility, remote-support, or QA/testing apps vary by organization and device group.'}	{'field': 'CaptureInteractionThreshold', 'description': 'Default 10s. Screen capture sessions starting >10s after last user interaction with capture app not foregrounded are covert.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': 'MediaProjection-style screen capture session began from app identity while a different app was foregrounded and capture path was not mapped to approved recording workflow'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindow', 'description': 'Correlation window linking capture-path invocation, foreground-app context, artifact creation, and optional upload.'}	{'field': 'ScreenCaptureAllowList', 'description': 'Approved screen recording apps (enterprise device management, approved accessibility tools, MDM-provisioned remote support). Minimal list. Derive from MDM catalog.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': 'Accessibility-service activity from app identity coincided with foreground content observation and subsequent screenshot, frame buffer, or screenrecord artifact behavior within TimeWindow'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'android:EMM', 'channel': 'Managed package inventory/status and package metadata'}
x_mitre_mutable_elements[2]	{'field': 'AllowedAccessibilityApps', 'description': 'Approved accessibility-enabled apps vary by assistive and enterprise workflow.'}	{'field': 'TargetAppList', 'description': 'Banking, enterprise SSO, auth, email apps. Screen capture of these is highest-confidence malicious.'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': 'Privileged screencap, screenrecord, adb-driven capture, or root-context screen acquisition behavior occurred from app, shell, or elevated identity while foreground app context changed or sensitive app remained active'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: MediaProjection capture session, accessibility-based foreground content observation, or privileged screencap/screenrecord invocation from app while different app is foregrounded — cross-app screen content access'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'MobileEDR:telemetry', 'channel': 'Capturing app remained backgrounded or foreground-service-only while screen capture session occurred and another app was foregrounded during capture interval'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'MobileEDR:telemetry', 'channel': 'LastUserInteractionDelta exceeded threshold before screen capture session start and no expected foreground transition or consent-linked interaction occurred during capture interval'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'MobileEDR:telemetry', 'channel': 'Sensitive app category remained foregrounded during screen capture session from different app identity'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:MDMLog', 'channel': 'App identity performing screen capture had unapproved accessibility posture, capture-related special access, unmanaged state, or was not approved for screen recording or assistive observation workflows'}
x_mitre_mutable_elements	{'field': 'AllowedForegroundServiceCaptureApps', 'description': 'Some approved apps may legitimately use foreground services during screen recording.'}
x_mitre_mutable_elements	{'field': 'RecentUserInteractionWindow', 'description': 'Defines how close capture initiation must be to user interaction to be considered expected.'}
x_mitre_mutable_elements	{'field': 'SensitiveForegroundAppCategories', 'description': 'Categories such as banking, identity, messaging, or enterprise apps may warrant higher sensitivity during capture.'}
x_mitre_mutable_elements	{'field': 'ArtifactWriteThreshold', 'description': 'Minimum screenshot/video/cache write volume indicating probable screen-capture output.'}
x_mitre_mutable_elements	{'field': 'UplinkBytesThreshold', 'description': 'Threshold for suspicious outbound transfer after capture.'}
x_mitre_mutable_elements	{'field': 'ConsentInteractionGracePeriod', 'description': 'Grace period allowed for expected user consent or explicit initiation before capture is treated as suspicious.'}

[AN1765] Analytic 1765

Current version: 1.0

	Old Description			New Description
t	1	Monitor for pseudo-randomly generated domain names based on	t	1	For Android, detect Domain Generation Algorithms by correlat
	>	frequency analysis, Markov chains, entropy, proportion of di		>	ing analyst-visible device/network evidence and management s
	>	ctionary words, ratio of vowels to other characters, and mor		>	tate; use streaming or batched telemetry only where the docu
	>	e.(Citation: Data Driven Security DGA) Additionally, check i		>	mented collector is deployed. Correlate Application Permissi
	>	f the suspicious domain has been recently registered, if it		>	on via Android Enterprise DPC / Application Vetting [DeviceP
	>	has been rarely visited, or if the domain had a spike in act		>	olicyManager.getPermissionGrantState(); PackageManager manif
	>	ivity after being dormant.(Citation: unit42_strat_aged_domai		>	est/requested-permission review]; Network Traffic Content vi
	>	n_det) Content delivery network (CDN) domains may trigger th		>	a Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspect
	>	ese detections due to the format of their domain names.		>	ion or proxy transaction metadata where enterprise decryptio
				>	n/inspection is deployed]; Network Traffic Flow via Android
				>	Enterprise Network Logging / Enterprise VPN [DevicePolicyMan
				>	ager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flo
				>	w metadata]. Alert on a sequence or state change inconsisten
				>	t with the device/app baseline, approved management policy,
				>	or expected user workflow; do not infer unobserved API calls
				>	, file/process activity, or payload content from management
				>	state alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'MDMApprovedCatalog', 'description': 'MDM-managed app list.'}, {'field': 'DGAEntropyThreshold', 'description': 'Default 3.5 bits Shannon. Calibrate from fleet DNS baseline.'}, {'field': 'DGALabelLength', 'description': 'Default 12 characters.'}, {'field': 'DGACandidateThreshold', 'description': 'Default 10 high-entropy queries within window.'}, {'field': 'DGAWindow', 'description': 'Default 60s.'}, {'field': 'DomainAgeThreshold', 'description': 'Default 30 days — newly-registered C2 domain.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:41:55.222000+00:00
description	Monitor for pseudo-randomly generated domain names based on frequency analysis, Markov chains, entropy, proportion of dictionary words, ratio of vowels to other characters, and more.(Citation: Data Driven Security DGA) Additionally, check if the suspicious domain has been recently registered, if it has been rarely visited, or if the domain had a spike in activity after being dormant.(Citation: unit42_strat_aged_domain_det) Content delivery network (CDN) domains may trigger these detections due to the format of their domain names.	For Android, detect Domain Generation Algorithms by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; Network Traffic Content via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed]; Network Traffic Flow via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--764ee29e-48d6-4934-8e6b-7a606aaaafc0', 'name': 'Application Vetting', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'webproxy:applog', 'channel': 'DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed'}
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'android:EnterpriseNetworkLog', 'channel': 'DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata'}

[AN1766] Analytic 1766

Current version: 1.0

	Old Description			New Description
t	1	Monitor for pseudo-randomly generated domain names based on	t	1	For iOS, detect Domain Generation Algorithms by correlating
	>	frequency analysis, Markov chains, entropy, proportion of di		>	analyst-visible device/network evidence and management state
	>	ctionary words, ratio of vowels to other characters, and mor		>	; use streaming or batched telemetry only where the document
	>	e.(Citation: Data Driven Security DGA) Additionally, check i		>	ed collector is deployed. Correlate Application Permission v
	>	f the suspicious domain has been recently registered, if it		>	ia Application Vetting [Code-signing entitlements and Info.p
	>	has been rarely visited, or if the domain had a spike in act		>	list privacy usage-description keys]; Network Traffic Conten
	>	ivity after being dormant.(Citation: unit42_strat_aged_domai		>	t via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) ins
	>	n_det) Content delivery network (CDN) domains may trigger th		>	pection or proxy transaction metadata where enterprise decry
	>	ese detections due to the format of their domain names.		>	ption/inspection is deployed]; Network Traffic Flow via Appl
				>	e Network Extension / Enterprise VPN [NEFilterFlow / per-app
				>	VPN / secure-web-gateway flow metadata]. Alert on a sequenc
				>	e or state change inconsistent with the device/app baseline,
				>	approved management policy, or expected user workflow; do n
				>	ot infer unobserved API calls, file/process activity, or pay
				>	load content from management state alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'MDMApprovedCatalog', 'description': 'MDM-managed app list.'}, {'field': 'DGAEntropyThreshold', 'description': 'Default 3.5 bits Shannon.'}, {'field': 'DGALabelLength', 'description': 'Default 12 characters.'}, {'field': 'DGACandidateThreshold', 'description': 'Default 10 high-entropy queries.'}, {'field': 'DGAWindow', 'description': 'Default 60s.'}, {'field': 'DomainAgeThreshold', 'description': 'Default 30 days.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:41:55.866000+00:00
description	Monitor for pseudo-randomly generated domain names based on frequency analysis, Markov chains, entropy, proportion of dictionary words, ratio of vowels to other characters, and more.(Citation: Data Driven Security DGA) Additionally, check if the suspicious domain has been recently registered, if it has been rarely visited, or if the domain had a spike in activity after being dormant.(Citation: unit42_strat_aged_domain_det) Content delivery network (CDN) domains may trigger these detections due to the format of their domain names.	For iOS, detect Domain Generation Algorithms by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]; Network Traffic Content via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed]; Network Traffic Flow via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--764ee29e-48d6-4934-8e6b-7a606aaaafc0', 'name': 'Application Vetting', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'mobile:ApplicationVetting', 'channel': 'Code-signing entitlements and Info.plist privacy usage-description keys'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'webproxy:applog', 'channel': 'DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed'}
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'iOS:NetworkExtension', 'channel': 'NEFilterFlow / per-app VPN / secure-web-gateway flow metadata'}

[AN1767] Analytic 1767

Current version: 1.1

	Old Description			New Description
t	1	The defender correlates recent access to locally collected o	t	1	For Android, detect Archive Collected Data from documented m
	>	r protected data with subsequent compression, packaging, or		>	anagement, network, or vetting evidence; treat state queries
	>	encryption behavior inside the same app context, followed by		>	as periodic observations rather than real-time events. Corr
	>	creation of archive-like or high-entropy output and optiona		>	elate Application Permission via Android Enterprise DPC / Ap
	>	l near-term network transmission. The analytic prioritizes A		>	plication Vetting [DevicePolicyManager.getPermissionGrantSta
	>	ndroid runtime and storage effects: application data access		>	te(); PackageManager manifest/requested-permission review];
	>	or sensor-derived collection, compression/encryption framewo		>	File Creation via Application Vetting / Forensic Acquisition
	>	rk use, archive/blob creation in app-accessible storage, and		>	[Dynamic filesystem trace or acquired app-container/filesys
	>	background or device-locked execution inconsistent with the		>	tem artifacts: App reads files across multiple directories o
	>	app’s declared function.		>	r databases in background state (collection phase) then invo
				>	kes archive or compression routines on collected content — r
				>	ead-then-archive sequence is the staging chain]; File Creati
				>	on via Application Vetting / Forensic Acquisition [Dynamic f
				>	ilesystem trace or acquired app-container/filesystem artifac
				>	ts: App writes archive-like container, high-entropy packaged
				>	blob, or .zip/.gz output to app-private or cache path after
				>	bulk data collection — archive artifact in private storage
				>	is the staging evidence]. Alert on a sequence or state chang
				>	e inconsistent with the device/app baseline, approved manage
				>	ment policy, or expected user workflow; do not infer unobser
				>	ved API calls, file/process activity, or payload content fro
				>	m management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.381000+00:00	2026-10-13 17:42:41.644000+00:00
description	The defender correlates recent access to locally collected or protected data with subsequent compression, packaging, or encryption behavior inside the same app context, followed by creation of archive-like or high-entropy output and optional near-term network transmission. The analytic prioritizes Android runtime and storage effects: application data access or sensor-derived collection, compression/encryption framework use, archive/blob creation in app-accessible storage, and background or device-locked execution inconsistent with the app’s declared function.	For Android, detect Archive Collected Data from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; File Creation via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: App reads files across multiple directories or databases in background state (collection phase) then invokes archive or compression routines on collected content — read-then-archive sequence is the staging chain]; File Creation via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: App writes archive-like container, high-entropy packaged blob, or .zip/.gz output to app-private or cache path after bulk data collection — archive artifact in private storage is the staging evidence]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': 'Application invokes archive, compression, or bulk-buffer packaging routines on previously accessed local data within the same execution chain'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: App writes archive-like container, high-entropy packaged blob, or .zip/.gz output to app-private or cache path after bulk data collection — archive artifact in private storage is the staging evidence'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'MobileEDR:telemetry', 'channel': 'Application reads multiple user-data files, media objects, message stores, or app-private records in burst sequence immediately before packaging or encryption activity'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}
x_mitre_log_source_references[4]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:MDMLog', 'channel': 'Managed application with no declared backup, sync, export, or media-editing role performs bulk local packaging or encrypted archive generation'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App applies encryption to newly created archive or staged data blob before network transmission — encrypt-after-archive confirms adversary-controlled packing for exfil'}
x_mitre_log_source_references[3]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': 'Application encrypts newly created archive or staged data blob after collection and before storage or outbound transfer'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes ZIP, GZIP, or bulk-buffer packaging routines (ZipOutputStream, DeflaterOutputStream, similar) on previously accessed local data in background state'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'MobileEDR:telemetry', 'channel': 'Application writes archive-like container or high-entropy packaged blob to app storage, cache, temp path, or shared external path after burst collection activity'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: App reads files across multiple directories or databases in background state (collection phase) then invokes archive or compression routines on collected content — read-then-archive sequence is the staging chain'}

[AN1768] Analytic 1768

Current version: 1.1

	Old Description			New Description
t	1	The defender correlates managed-app data access and lifecycl	t	1	For iOS, detect Archive Collected Data from documented manag
	>	e context with indirect evidence of packaging or encryption		>	ement, network, or vetting evidence; treat state queries as
	>	prior to outbound transfer. Because direct archive/compressi		>	periodic observations rather than real-time events. Correlat
	>	on visibility is generally weaker on iOS, the analytic ancho		>	e Application Permission via Application Vetting [Code-signi
	>	rs on app lifecycle state, file/output effects observable by		>	ng entitlements and Info.plist privacy usage-description key
	>	mobile EDR where available, managed app role via MDM, and d		>	s]; Application State via Apple MDM [InstalledApplicationLis
	>	ownstream network uploads that closely follow creation of ne		>	t / ManagedApplicationList]; File Creation via Application V
	>	w large or high-entropy local artifacts. Confidence is lower		>	etting / Forensic Acquisition [Dynamic filesystem trace or a
	>	when only network effects are available.		>	cquired app-container/filesystem artifacts: App writes large
				>	container, temp package, or high-entropy blob to container-
				>	local storage after clustered data access — staged archive a
				>	rtifact]. Alert on a sequence or state change inconsistent w
				>	ith the device/app baseline, approved management policy, or
				>	expected user workflow; do not infer unobserved API calls, f
				>	ile/process activity, or payload content from management sta
				>	te alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.376000+00:00	2026-10-13 17:42:42.358000+00:00
description	The defender correlates managed-app data access and lifecycle context with indirect evidence of packaging or encryption prior to outbound transfer. Because direct archive/compression visibility is generally weaker on iOS, the analytic anchors on app lifecycle state, file/output effects observable by mobile EDR where available, managed app role via MDM, and downstream network uploads that closely follow creation of new large or high-entropy local artifacts. Confidence is lower when only network effects are available.	For iOS, detect Archive Collected Data from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Application Permission via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]; Application State via Apple MDM [InstalledApplicationList / ManagedApplicationList]; File Creation via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: App writes large container, temp package, or high-entropy blob to container-local storage after clustered data access — staged archive artifact]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'iOS:MDMLog', 'channel': 'Supervised managed app without expected export, backup, or sync role performs local data staging behavior followed by opaque upload activity'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'mobile:ApplicationVetting', 'channel': 'Code-signing entitlements and Info.plist privacy usage-description keys'}
x_mitre_log_source_references[3]	{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'MobileEDR:telemetry', 'channel': 'Application writes new large container, temp package, or high-entropy blob after clustered local data access and before outbound communication'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App performs bulk data transformation or packaging-like processing on collected records prior to outbound transfer on supervised device'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'MobileEDR:telemetry', 'channel': 'Managed app enters background-capable execution or resumes processing immediately before archive-like file creation or upload behavior'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'iOS:MDM', 'channel': 'InstalledApplicationList / ManagedApplicationList'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': 'Application performs bulk data transformation or packaging-like processing on collected records prior to file creation or upload'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: App writes large container, temp package, or high-entropy blob to container-local storage after clustered data access — staged archive artifact'}

[AN1769] Analytic 1769

Current version: 1.0

	Old Description			New Description
t	1	The user may view applications with administrator access thr	t	1	For Android, detect Data Destruction from documented managem
	>	ough the device settings and may also notice if user data is		>	ent, network, or vetting evidence; treat state queries as pe
	>	inexplicably missing. Command-line activities can potentia		>	riodic observations rather than real-time events. Correlate
	>	lly be detected through Mobile Threat Defense (MTD) integrat		>	Command Execution via Application Vetting / Instrumented Dyn
	>	ions with lower-level OS APIs. This could grant the MTD agen		>	amic Analysis [Dynamic API/runtime trace: pm uninstall OR rm
	>	ts access to running processes and their parameters, potenti		>	-f called by process NOT IN $MDMAgentPackageList$ for packa
	>	ally detecting file deletion processes. The user is prompt		>	ge_count > $BulkUninstallThreshold$ within $DestructionWindo
	>	ed for approval when an application requests device administ		>	w$ — command-line destruction activity]; File Deletion via A
	>	rator permissions. Application vetting services may detect A		>	pplication Vetting / Forensic Acquisition [Dynamic filesyste
	>	PI calls for deleting files. Mobile security products can		>	m trace or acquired app-container/filesystem artifacts: unli
	>	detect which applications can request device administrator p		>	nk() or rmdir() on path IN /data/data/ OR /data/user/ OR /sd
	>	ermissions. Application vetting services could be extra scru		>	card/ by process NOT IN $MDMAgentPackageList$ at rate > $Del
	>	tinous of applications that request device administrator per		>	etionRateThreshold$ within $DestructionWindow$]; Process Cre
	>	missions.		>	ation via Application Vetting / Managed Device Telemetry [sh
				>	or cmd process spawned with arguments containing 'pm uninst
				>	all' or 'rm' by parent NOT IN $MDMAgentPackageList$ — shell
				>	invocation for destruction commands]. Alert on a sequence or
				>	state change inconsistent with the device/app baseline, app
				>	roved management policy, or expected user workflow; do not i
				>	nfer unobserved API calls, file/process activity, or payload
				>	content from management state alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'MDMAgentPackageList', 'description': 'MDM agent, OTA update service.'}, {'field': 'DeletionRateThreshold', 'description': 'Default 100 file deletions within window. Derive from MDM-managed wipe baseline.'}, {'field': 'BulkUninstallThreshold', 'description': 'Default 5 packages within window. MDM wipe uses different API.'}, {'field': 'DestructionWindow', 'description': 'Default 300s.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:42:14.178000+00:00
description	The user may view applications with administrator access through the device settings and may also notice if user data is inexplicably missing. Command-line activities can potentially be detected through Mobile Threat Defense (MTD) integrations with lower-level OS APIs. This could grant the MTD agents access to running processes and their parameters, potentially detecting file deletion processes. The user is prompted for approval when an application requests device administrator permissions. Application vetting services may detect API calls for deleting files. Mobile security products can detect which applications can request device administrator permissions. Application vetting services could be extra scrutinous of applications that request device administrator permissions.	For Android, detect Data Destruction from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Command Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: pm uninstall OR rm -f called by process NOT IN $MDMAgentPackageList$ for package_count > $BulkUninstallThreshold$ within $DestructionWindow$ — command-line destruction activity]; File Deletion via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: unlink() or rmdir() on path IN /data/data/ OR /data/user/ OR /sdcard/ by process NOT IN $MDMAgentPackageList$ at rate > $DeletionRateThreshold$ within $DestructionWindow$]; Process Creation via Application Vetting / Managed Device Telemetry [sh or cmd process spawned with arguments containing 'pm uninstall' or 'rm' by parent NOT IN $MDMAgentPackageList$ — shell invocation for destruction commands]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--56c2b384-77f8-461f-a71a-76f7888ebfb6', 'name': 'User Interface', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--685f917a-e95e-4ba0-ade1-c7d354dae6e0', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: pm uninstall OR rm -f called by process NOT IN $MDMAgentPackageList$ for package_count > $BulkUninstallThreshold$ within $DestructionWindow$ — command-line destruction activity'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--685f917a-e95e-4ba0-ade1-c7d354dae6e0', 'name': 'Command', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--e905dad2-00d6-477c-97e8-800427abd0e8', 'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: unlink() or rmdir() on path IN /data/data/ OR /data/user/ OR /sdcard/ by process NOT IN $MDMAgentPackageList$ at rate > $DeletionRateThreshold$ within $DestructionWindow$'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--e2f72131-14d1-411f-8e8c-aa3453dd5456', 'name': 'User Interface', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'mobile:DynamicAnalysis', 'channel': "sh or cmd process spawned with arguments containing 'pm uninstall' or 'rm' by parent NOT IN $MDMAgentPackageList$ — shell invocation for destruction commands"}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'Application Vetting', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'Application Vetting', 'channel': 'None'}

[AN1770] Analytic 1770

Current version: 1.1

	Old Description			New Description
t	1	The defender correlates outbound communication from an appli	t	1	For Android, detect Web Service by correlating analyst-visib
	>	cation or service to legitimate external web platforms with		>	le device/network evidence and management state; use streami
	>	mobile runtime context showing that the communication is inc		>	ng or batched telemetry only where the documented collector
	>	onsistent with the app's approved role, expected destination		>	is deployed. Correlate Application Permission via Android En
	>	s, user interaction pattern, or device state. The strongest		>	terprise DPC / Application Vetting [DevicePolicyManager.getP
	>	Android evidence is a managed or installed app communicating		>	ermissionGrantState(); PackageManager manifest/requested-per
	>	with cloud storage, social, messaging, code-hosting, or gen		>	mission review]; Application State via Android Enterprise /
	>	eric HTTPS web-service infrastructure shortly after backgrou		>	EMM [Managed package inventory/status and package metadata];
	>	nd activation, protected-resource use, or local staging acti		>	File Creation via Application Vetting / Forensic Acquisitio
	>	vity, especially when the device is locked, user interaction		>	n [Dynamic filesystem trace or acquired app-container/filesy
	>	is absent, or the app's historical network baseline does no		>	stem artifacts: App stages or caches content retrieved from
	>	t include that service class.		>	web-service platform locally before initiating secondary net
				>	work connection]. Alert on a sequence or state change incons
				>	istent with the device/app baseline, approved management pol
				>	icy, or expected user workflow; do not infer unobserved API
				>	calls, file/process activity, or payload content from manage
				>	ment state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.381000+00:00	2026-10-13 17:42:27.336000+00:00
description	The defender correlates outbound communication from an application or service to legitimate external web platforms with mobile runtime context showing that the communication is inconsistent with the app's approved role, expected destinations, user interaction pattern, or device state. The strongest Android evidence is a managed or installed app communicating with cloud storage, social, messaging, code-hosting, or generic HTTPS web-service infrastructure shortly after background activation, protected-resource use, or local staging activity, especially when the device is locked, user interaction is absent, or the app's historical network baseline does not include that service class.	For Android, detect Web Service by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; Application State via Android Enterprise / EMM [Managed package inventory/status and package metadata]; File Creation via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: App stages or caches content retrieved from web-service platform locally before initiating secondary network connection]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[1]	{'field': 'AllowedAppList', 'description': 'Approved app identities and expected business roles vary by fleet and device group.'}	{'field': 'AppDeclaredCDN', 'description': 'Per-app declared network destinations from Info.plist or AndroidManifest network config. Legitimate web-service access should be declared.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'VPN:MobileProxy', 'channel': "Application or device component communicates with legitimate external web-service infrastructure such as cloud storage, social media, messaging, collaboration, paste, code-hosting, CDN-backed API, or generic HTTPS service in a pattern inconsistent with the app's approved network baseline, timing, or service class"}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}
x_mitre_log_source_references[4]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:MDMLog', 'channel': 'App communicating with legitimate web-service infrastructure is unmanaged, newly installed, recently updated, outside approved app list, or shows baseline drift in role, installer source, or expected capability profile'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App uses background work scheduler, JobScheduler, or persistent service to trigger web-service resolver fetch without user interaction'}
x_mitre_log_source_references[3]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': 'App uses Android framework behaviors associated with background work scheduling, network job execution, IPC/provider access, overlay or accessibility-like interaction, or unusual package visibility immediately adjacent to web-service communication'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'webproxy:applog', 'channel': 'DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindow', 'description': 'Correlation window linking app state, resource use, staging activity, and web-service communication.'}	{'field': 'ApprovedWebServiceApps', 'description': 'Per-platform approved apps for each web service (e.g., GitHub: com.github.android; Dropbox: com.dropbox.android). Derive from MDM catalog. Apps accessing web service platforms outside their declared function are anomalous.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'MobileEDR:telemetry', 'channel': 'App communicating with external web service is backgrounded, persistent, recently awakened, or active while device is locked or without recent user interaction in a way inconsistent with expected app behavior'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'android:EMM', 'channel': 'Managed package inventory/status and package metadata'}
x_mitre_mutable_elements[2]	{'field': 'AllowedServiceClasses', 'description': 'Some organizations legitimately use cloud storage, messaging, or collaboration services from mobile apps.'}	{'field': 'ResolverPivotWindow', 'description': 'Default 120s between web-service platform session and novel C2 connection. Tightening: 30s — synchronous resolve-then-connect. Loosening: 300s — catches deferred pivot.'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'MobileEDR:telemetry', 'channel': 'App stages, buffers, caches, or exports data locally immediately before communication with legitimate external web-service endpoints in a way inconsistent with normal sync or offline workflow'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: App stages or caches content retrieved from web-service platform locally before initiating secondary network connection'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_mutable_elements	{'field': 'AllowedDestinations', 'description': 'Expected domains, SNI values, CDNs, API endpoints, and redirectors vary by application and tenant.'}
x_mitre_mutable_elements	{'field': 'ForegroundStateRequired', 'description': 'Certain apps may legitimately communicate only in foreground, while others support background sync.'}
x_mitre_mutable_elements	{'field': 'RecentUserInteractionWindow', 'description': 'Defines how close traffic must be to user activity to be considered expected.'}
x_mitre_mutable_elements	{'field': 'BeaconIntervalTolerance', 'description': 'Recurring connection periodicity thresholds vary with push, sync, and collaboration workloads.'}
x_mitre_mutable_elements	{'field': 'UplinkBytesThreshold', 'description': 'Data volume threshold for suspicious transfer to legitimate web-service infrastructure.'}
x_mitre_mutable_elements	{'field': 'ExpectedBackgroundBehavior', 'description': 'Normal background communication differs across app categories such as mail, chat, navigation, and security tools.'}

[AN1771] Analytic 1771

Current version: 1.1

	Old Description			New Description
t	1	The defender correlates communication to legitimate external	t	1	For iOS, detect Web Service by correlating analyst-visible d
	>	web-service platforms with supervised managed-app context a		>	evice/network evidence and management state; use streaming o
	>	nd device-state information showing that the traffic is inco		>	r batched telemetry only where the documented collector is d
	>	nsistent with the app's expected role, background-refresh pr		>	eployed. Correlate Application Permission via Application Ve
	>	ofile, or user interaction timing. On iOS, the strongest rel		>	tting [Code-signing entitlements and Info.plist privacy usag
	>	iable evidence is network telemetry tied to a managed app or		>	e-description keys]; Application State via Apple MDM [Instal
	>	device plus app state and supervision context, especially w		>	ledApplicationList / ManagedApplicationList]; Network Traffi
	>	hen traffic to social, collaboration, cloud-storage, or gene		>	c Content via Enterprise Secure Web Gateway / Proxy [DNS/HTT
	>	ric HTTPS platforms occurs shortly after background activity		>	P(S) inspection or proxy transaction metadata where enterpri
	>	, while the device is locked, or without expected user-drive		>	se decryption/inspection is deployed]. Alert on a sequence o
	>	n foreground execution. Direct low-level framework visibilit		>	r state change inconsistent with the device/app baseline, ap
	>	y is weaker than Android, so primary analytic confidence sho		>	proved management policy, or expected user workflow; do not
	>	uld be anchored to supervised app context plus network behav		>	infer unobserved API calls, file/process activity, or payloa
	>	ior rather than assumed host-level proof.		>	d content from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.381000+00:00	2026-10-13 17:42:28.065000+00:00
description	The defender correlates communication to legitimate external web-service platforms with supervised managed-app context and device-state information showing that the traffic is inconsistent with the app's expected role, background-refresh profile, or user interaction timing. On iOS, the strongest reliable evidence is network telemetry tied to a managed app or device plus app state and supervision context, especially when traffic to social, collaboration, cloud-storage, or generic HTTPS platforms occurs shortly after background activity, while the device is locked, or without expected user-driven foreground execution. Direct low-level framework visibility is weaker than Android, so primary analytic confidence should be anchored to supervised app context plus network behavior rather than assumed host-level proof.	For iOS, detect Web Service by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]; Application State via Apple MDM [InstalledApplicationList / ManagedApplicationList]; Network Traffic Content via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[1]	{'field': 'SupervisedRequired', 'description': 'Strongest app context and managed state analytics depend on supervised iOS devices.'}	{'field': 'AppDeclaredCDN', 'description': 'Per-app declared network destinations from Info.plist or AndroidManifest network config. Legitimate web-service access should be declared.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'VPN:MobileProxy', 'channel': 'Supervised device or managed app communicates with legitimate external web-service infrastructure such as cloud storage, messaging, collaboration, social, paste, or generic HTTPS API platforms in a pattern inconsistent with expected service baseline, managed app role, or normal background refresh behavior'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'mobile:ApplicationVetting', 'channel': 'Code-signing entitlements and Info.plist privacy usage-description keys'}
x_mitre_log_source_references[3]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'iOS:unifiedlog', 'channel': 'Supplemental launch, background task, networking, or extension-handling anomalies occur temporally adjacent to suspicious web-service communication from a managed app or supervised device'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Background task or networking subsystem event occurs immediately before web-service resolver fetch'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindow', 'description': 'Correlation window between app state changes and communication with legitimate web-service infrastructure.'}	{'field': 'ApprovedWebServiceApps', 'description': 'Per-platform approved apps for each web service (e.g., GitHub: com.github.android; Dropbox: com.dropbox.android). Derive from MDM catalog. Apps accessing web service platforms outside their declared function are anomalous.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'MobileEDR:telemetry', 'channel': 'Managed app shows background activity, refresh, or lock-state-adjacent execution temporally aligned to web-service communication without expected foreground use or recent user interaction'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'iOS:MDM', 'channel': 'InstalledApplicationList / ManagedApplicationList'}
x_mitre_mutable_elements[2]	{'field': 'AllowedManagedApps', 'description': 'Approved managed apps and expected business use vary by organization and device profile.'}	{'field': 'ResolverPivotWindow', 'description': 'Default 120s between web-service platform session and novel C2 connection. Tightening: 30s — synchronous resolve-then-connect. Loosening: 300s — catches deferred pivot.'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'iOS:MDMLog', 'channel': 'Managed app communicating with legitimate web-service infrastructure is newly installed, recently updated, outside expected managed-app set, or displays baseline drift in app role, release path, or business justification'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'webproxy:applog', 'channel': 'DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_mutable_elements	{'field': 'AllowedServiceClasses', 'description': 'Some managed apps legitimately communicate with collaboration, cloud-storage, or messaging services.'}
x_mitre_mutable_elements	{'field': 'AllowedDestinations', 'description': 'Expected Apple, enterprise, SaaS, CDN, and API destinations vary by app and tenant.'}
x_mitre_mutable_elements	{'field': 'BackgroundRefreshBaseline', 'description': 'Normal background network behavior differs across mail, chat, navigation, and enterprise apps.'}
x_mitre_mutable_elements	{'field': 'RecentUserInteractionWindow', 'description': 'Defines how close traffic must be to user activity to be considered expected.'}
x_mitre_mutable_elements	{'field': 'BeaconIntervalTolerance', 'description': 'Allowed periodicity for sync, push, and refresh traffic varies across app categories.'}
x_mitre_mutable_elements	{'field': 'UplinkBytesThreshold', 'description': 'Threshold for suspicious transfer volume to legitimate web-service platforms.'}

[AN1772] Analytic 1772

Current version: 1.1

	Old Description			New Description
t	1	A defender observes an application holding microphone captur	t	1	For Android, detect Audio Capture by correlating analyst-vis
	>	e capability transitioning into active microphone resource u		>	ible device/network evidence and management state; use strea
	>	sage through Android audio APIs (e.g., MediaRecorder or Audi		>	ming or batched telemetry only where the documented collecto
	>	oRecord), followed by sustained capture while the applicatio		>	r is deployed. Correlate API Calls via Application Vetting /
	>	n is backgrounded or the device is locked, and subsequent ou		>	Instrumented Dynamic Analysis [Dynamic API/runtime trace: A
	>	tbound network traffic suggesting potential audio exfiltrati		>	udioRecord.startRecording() or MediaRecorder.start() called
	>	on or streaming.		>	by app NOT IN $AudioAllowList$]; File Creation via Applicati
				>	on Vetting / Forensic Acquisition [Dynamic filesystem trace
				>	or acquired app-container/filesystem artifacts: open() with
				>	O_CREAT for file with audio MIME type (audio/mp4, audio/aac,
				>	audio/3gpp) in /data/data/<app>/files/ within $AudioCapture
				>	Window$ of recording API start]; Network Traffic Flow via An
				>	droid Enterprise Network Logging / Enterprise VPN [DevicePol
				>	icyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; V
				>	PN flow metadata]. Alert on a sequence or state change incon
				>	sistent with the device/app baseline, approved management po
				>	licy, or expected user workflow; do not infer unobserved API
				>	calls, file/process activity, or payload content from manag
				>	ement state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.382000+00:00	2026-10-13 17:41:24.362000+00:00
description	A defender observes an application holding microphone capture capability transitioning into active microphone resource usage through Android audio APIs (e.g., MediaRecorder or AudioRecord), followed by sustained capture while the application is backgrounded or the device is locked, and subsequent outbound network traffic suggesting potential audio exfiltration or streaming.	For Android, detect Audio Capture by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: AudioRecord.startRecording() or MediaRecorder.start() called by app NOT IN $AudioAllowList$]; File Creation via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: open() with O_CREAT for file with audio MIME type (audio/mp4, audio/aac, audio/3gpp) in /data/data//files/ within $AudioCaptureWindow$ of recording API start]; Network Traffic Flow via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[1]	{'field': 'BackgroundCapturePolicy', 'description': 'Environment-specific baseline for legitimate background microphone usage'}	{'field': 'AudioCaptureWindow', 'description': 'Default 60s between recording start and file write.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'android:logcat', 'channel': 'Invocation of MediaRecorder.start(), AudioRecord.startRecording(), or VOICE_CALL audio source'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: AudioRecord.startRecording() or MediaRecorder.start() called by app NOT IN $AudioAllowList$'}
x_mitre_log_source_references[3]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:MDMLog', 'channel': 'Application granted or retaining RECORD_AUDIO permission or privileged CAPTURE_AUDIO_OUTPUT capability'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--e2f72131-14d1-411f-8e8c-aa3453dd5456', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}
x_mitre_mutable_elements[0]	{'field': 'RecordingDurationThreshold', 'description': 'Minimum microphone session duration before triggering detection to reduce noise from short legitimate captures.'}	{'field': 'AudioAllowList', 'description': 'VoIP, voice memo, approved call recorder apps. Derive from MDM catalog.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--56c2b384-77f8-461f-a71a-76f7888ebfb6', 'name': 'MobileEDR:telemetry', 'channel': 'Microphone sensor activation or audio recording session initiated by application process'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: open() with O_CREAT for file with audio MIME type (audio/mp4, audio/aac, audio/3gpp) in /data/data//files/ within $AudioCaptureWindow$ of recording API start'}
x_mitre_mutable_elements[2]	{'field': 'CaptureToNetworkTimeWindow', 'description': 'Time window correlating microphone activation with outbound network traffic.'}	{'field': 'AudioUplinkThreshold', 'description': 'Default 50KB — ~10s of audio at typical mobile codec rate.'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--56c2b384-77f8-461f-a71a-76f7888ebfb6', 'name': 'MobileEDR:telemetry', 'channel': 'Application transitions to background or executes while screen locked during microphone session'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'android:EnterpriseNetworkLog', 'channel': 'DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		{'field': 'AppCDNList', 'description': 'Per-app CDN. Derive by measurement.'}
x_mitre_mutable_elements		{'field': 'ExfilWindow', 'description': 'Default 120s.'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'MobileEDR:telemetry', 'channel': 'Application writes audio buffer or recorded audio file into application storage directories'}

[AN1773] Analytic 1773

Current version: 1.1

	Old Description			New Description
t	1	A defender observes an application with declared microphone	t	1	For iOS, detect Audio Capture by correlating analyst-visible
	>	capability initiating microphone resource use through iOS au		>	device/network evidence and management state; use streaming
	>	dio frameworks, potentially during background execution or s		>	or batched telemetry only where the documented collector is
	>	hortly after a silent wake event, followed by sustained audi		>	deployed. Correlate Application Permission via Application
	>	o capture and outbound encrypted traffic suggesting audio st		>	Vetting [Code-signing entitlements and Info.plist privacy us
	>	reaming or upload activity.		>	age-description keys]; Network Traffic Flow via Apple Networ
				>	k Extension / Enterprise VPN [NEFilterFlow / per-app VPN / s
				>	ecure-web-gateway flow metadata]; Permissions Request via Ap
				>	plication Vetting [Code-signing entitlements and Info.plist
				>	privacy usage-description keys]. Alert on a sequence or stat
				>	e change inconsistent with the device/app baseline, approved
				>	management policy, or expected user workflow; do not infer
				>	unobserved API calls, file/process activity, or payload cont
				>	ent from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.377000+00:00	2026-10-13 17:41:25.043000+00:00
description	A defender observes an application with declared microphone capability initiating microphone resource use through iOS audio frameworks, potentially during background execution or shortly after a silent wake event, followed by sustained audio capture and outbound encrypted traffic suggesting audio streaming or upload activity.	For iOS, detect Audio Capture by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]; Network Traffic Flow via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]; Permissions Request via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[1]	{'field': 'BackgroundWakeCorrelationWindow', 'description': 'Time window correlating background wake events with microphone activation.'}	{'field': 'AudioUplinkThreshold', 'description': 'Default 50KB — ~10 seconds of audio at typical mobile codec.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--56c2b384-77f8-461f-a71a-76f7888ebfb6', 'name': 'MobileEDR:telemetry', 'channel': 'Microphone sensor activation or audio recording session initiated by application process'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'mobile:ApplicationVetting', 'channel': 'Code-signing entitlements and Info.plist privacy usage-description keys'}
x_mitre_mutable_elements[0]	{'field': 'ExpectedAudioAppsBaseline', 'description': 'Allow-list of legitimate applications expected to record audio on the device.'}	{'field': 'AudioAllowList', 'description': 'VoIP, voice memo, approved recording app bundle IDs. Derive from MDM catalog.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'iOS:unifiedlog', 'channel': 'Invocation of AVAudioRecorder, AVCaptureSession, or related audio capture framework calls'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'iOS:NetworkExtension', 'channel': 'NEFilterFlow / per-app VPN / secure-web-gateway flow metadata'}
x_mitre_mutable_elements[2]	{'field': 'MicSessionDurationThreshold', 'description': 'Minimum microphone recording duration considered suspicious.'}	{'field': 'AppCDNList', 'description': 'Per-app CDN baseline.'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'MobileEDR:telemetry', 'channel': 'Application writes audio buffer or recorded audio file into application storage directories'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--e2f72131-14d1-411f-8e8c-aa3453dd5456', 'name': 'mobile:ApplicationVetting', 'channel': 'Code-signing entitlements and Info.plist privacy usage-description keys'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--56c2b384-77f8-461f-a71a-76f7888ebfb6', 'name': 'MobileEDR:telemetry', 'channel': 'Application transitions to background or executes while screen locked during microphone session'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'iOS:MDMLog', 'channel': 'Application installed with NSMicrophoneUsageDescription entitlement indicating microphone capability'}
x_mitre_mutable_elements	{'field': 'MicToNetworkCorrelationWindow', 'description': 'Time window linking microphone activation to outbound network activity.'}
x_mitre_mutable_elements	{'field': 'UplinkBytesThreshold', 'description': 'Threshold for outbound traffic volume indicating possible audio upload.'}

[AN1774] Analytic 1774

Current version: 2.0

	Old Description			New Description
t	1	OLD: Application vetting services could look for `android.p	t	1	For Android, detect Calendar Entries by correlating analyst-
	>	ermission.READ_CALENDAR` or `android.permission.WRITE_CALEND		>	visible device/network evidence and management state; use st
	>	AR` in an Android application’s manifest, or `NSCalendarsUsa		>	reaming or batched telemetry only where the documented colle
	>	geDescription` in an iOS application’s `Info.plist` file. Mo		>	ctor is deployed. Correlate API Calls via Application Vettin
	>	st applications do not need calendar access, so extra scruti		>	g / Instrumented Dynamic Analysis [Dynamic API/runtime trace
	>	ny could be applied to those that request it. On both Andro		>	: ContentResolver.query(CalendarContract) with query_count >
	>	id and iOS, the user can manage which applications have perm		>	$CalendarQueryThreshold$ by app NOT IN $ApprovedCalendarApp
	>	ission to access calendar information through the device set		>	s$]; Network Traffic Flow via Android Enterprise Network Log
	>	tings screen, revoke the permission if necessary. NEW: A d		>	ging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLo
	>	efender observes an Android application requesting for `andr		>	gs(): DnsEvent / ConnectEvent; VPN flow metadata]; Permissio
	>	oid.permission.READ_CALENDAR` or `android.permission.WRITE_C		>	ns Request via Android Enterprise DPC / Application Vetting
	>	ALENDAR`, which may also be listed in the application’s Mani		>	[DevicePolicyManager.getPermissionGrantState(); PackageManag
	>	fest.		>	er manifest/requested-permission review]. Alert on a sequenc
				>	e or state change inconsistent with the device/app baseline,
				>	approved management policy, or expected user workflow; do n
				>	ot infer unobserved API calls, file/process activity, or pay
				>	load content from management state alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ApprovedCalendarApps', 'description': 'Exchange, Google Calendar, enterprise calendar sync apps.'}, {'field': 'CalendarQueryThreshold', 'description': 'Default 30 queries/2min. Tune per calendar sync app baseline.'}, {'field': 'CalendarUplinkThreshold', 'description': 'Default 50KB — ~25 calendar events average ~2KB each.'}, {'field': 'CalendarSyncCDNList', 'description': 'O365, Google Calendar API endpoints.'}, {'field': 'ExfilWindow', 'description': 'Default 120s.'}]

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.376000+00:00	2026-10-13 17:41:47.197000+00:00
description	OLD: Application vetting services could look for `android.permission.READ_CALENDAR` or `android.permission.WRITE_CALENDAR` in an Android application’s manifest, or `NSCalendarsUsageDescription` in an iOS application’s `Info.plist` file. Most applications do not need calendar access, so extra scrutiny could be applied to those that request it. On both Android and iOS, the user can manage which applications have permission to access calendar information through the device settings screen, revoke the permission if necessary. NEW: A defender observes an Android application requesting for `android.permission.READ_CALENDAR` or `android.permission.WRITE_CALENDAR`, which may also be listed in the application’s Manifest.	For Android, detect Calendar Entries by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: ContentResolver.query(CalendarContract) with query_count > $CalendarQueryThreshold$ by app NOT IN $ApprovedCalendarApps$]; Network Traffic Flow via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]; Permissions Request via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'android:logcat', 'channel': 'Invocation of Calendar.set() and Calendar.add()'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: ContentResolver.query(CalendarContract) with query_count > $CalendarQueryThreshold$ by app NOT IN $ApprovedCalendarApps$'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:MDMLog ', 'channel': 'Application granted or retaining the READ_CALENDAR or WRITE_CALENDAR permissions. '}	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'android:EnterpriseNetworkLog', 'channel': 'DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--e2f72131-14d1-411f-8e8c-aa3453dd5456', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}

[AN1775] Analytic 1775

Current version: 1.0

	Old Description			New Description
t	1	Application vetting services could look for `android.permiss	t	1	For iOS, detect Calendar Entries by correlating analyst-visi
	>	ion.READ_CALENDAR` or `android.permission.WRITE_CALENDAR` in		>	ble device/network evidence and management state; use stream
	>	an Android application’s manifest, or `NSCalendarsUsageDesc		>	ing or batched telemetry only where the documented collector
	>	ription` in an iOS application’s `Info.plist` file. Most app		>	is deployed. Correlate API Calls via Application Vetting /
	>	lications do not need calendar access, so extra scrutiny cou		>	Instrumented Dynamic Analysis [Dynamic API/runtime trace: EK
	>	ld be applied to those that request it. On both Android and		>	EventStore.fetchEvents() or enumerateEvents() with date_rang
	>	iOS, the user can manage which applications have permission		>	e > $CalendarDateRangeThreshold$ days by app NOT IN $Approve
	>	to access calendar information through the device settings		>	dCalendarApps$]; Network Traffic Flow via Apple Network Exte
	>	screen, revoke the permission if necessary.		>	nsion / Enterprise VPN [NEFilterFlow / per-app VPN / secure-
				>	web-gateway flow metadata]; Permissions Request via Applicat
				>	ion Vetting [Code-signing entitlements and Info.plist privac
				>	y usage-description keys]. Alert on a sequence or state chan
				>	ge inconsistent with the device/app baseline, approved manag
				>	ement policy, or expected user workflow; do not infer unobse
				>	rved API calls, file/process activity, or payload content fr
				>	om management state alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ApprovedCalendarApps', 'description': 'com.microsoft.outlook, com.google.calendar.app, enterprise calendar bundles.'}, {'field': 'CalendarDateRangeThreshold', 'description': 'Default 365 days — full-store fetch vs incremental sync.'}, {'field': 'CalendarUplinkThreshold', 'description': 'Default 50KB.'}, {'field': 'CalendarSyncCDNList', 'description': 'O365, Google Calendar API endpoints.'}, {'field': 'ExfilWindow', 'description': 'Default 120s.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:41:48.135000+00:00
description	Application vetting services could look for `android.permission.READ_CALENDAR` or `android.permission.WRITE_CALENDAR` in an Android application’s manifest, or `NSCalendarsUsageDescription` in an iOS application’s `Info.plist` file. Most applications do not need calendar access, so extra scrutiny could be applied to those that request it. On both Android and iOS, the user can manage which applications have permission to access calendar information through the device settings screen, revoke the permission if necessary.	For iOS, detect Calendar Entries by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: EKEventStore.fetchEvents() or enumerateEvents() with date_range > $CalendarDateRangeThreshold$ days by app NOT IN $ApprovedCalendarApps$]; Network Traffic Flow via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]; Permissions Request via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'Application Vetting', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: EKEventStore.fetchEvents() or enumerateEvents() with date_range > $CalendarDateRangeThreshold$ days by app NOT IN $ApprovedCalendarApps$'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--56c2b384-77f8-461f-a71a-76f7888ebfb6', 'name': 'User Interface', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'iOS:NetworkExtension', 'channel': 'NEFilterFlow / per-app VPN / secure-web-gateway flow metadata'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--e2f72131-14d1-411f-8e8c-aa3453dd5456', 'name': 'mobile:ApplicationVetting', 'channel': 'Code-signing entitlements and Info.plist privacy usage-description keys'}

[AN1776] Analytic 1776

Current version: 1.1

	Old Description			New Description
t	1	Defender correlates an application gaining/retaining fine or	t	1	For Android, detect Location Tracking by correlating analyst
	>	background location capability with subsequent location sen		>	-visible device/network evidence and management state; use s
	>	sor sessions that occur while the app is backgrounded or the		>	treaming or batched telemetry only where the documented coll
	>	device is locked, followed by repeated location reads at a		>	ector is deployed. Correlate API Calls via Application Vetti
	>	periodic cadence and near-term outbound connections to domai		>	ng / Instrumented Dynamic Analysis [Dynamic API/runtime trac
	>	ns not typical for fleet navigation/MDM services, indicating		>	e: LocationManager.requestLocationUpdates() called with minT
	>	covert location tracking.		>	ime < $LocationUpdateFreqThreshold$ by app NOT IN $LocationA
				>	llowList$]; Network Traffic Content via Enterprise Secure We
				>	b Gateway / Proxy [DNS/HTTP(S) inspection or proxy transacti
				>	on metadata where enterprise decryption/inspection is deploy
				>	ed]; Permissions Request via Android Enterprise DPC / Applic
				>	ation Vetting [DevicePolicyManager.getPermissionGrantState()
				>	; PackageManager manifest/requested-permission review]. Aler
				>	t on a sequence or state change inconsistent with the device
				>	/app baseline, approved management policy, or expected user
				>	workflow; do not infer unobserved API calls, file/process ac
				>	tivity, or payload content from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.379000+00:00	2026-10-13 17:41:25.683000+00:00
description	Defender correlates an application gaining/retaining fine or background location capability with subsequent location sensor sessions that occur while the app is backgrounded or the device is locked, followed by repeated location reads at a periodic cadence and near-term outbound connections to domains not typical for fleet navigation/MDM services, indicating covert location tracking.	For Android, detect Location Tracking by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: LocationManager.requestLocationUpdates() called with minTime < $LocationUpdateFreqThreshold$ by app NOT IN $LocationAllowList$]; Network Traffic Content via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed]; Permissions Request via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[3]	{'field': 'UserInteractionWindow', 'description': 'Maximum time since last user interaction before location access becomes suspicious.'}	{'field': 'ExfilWindow', 'description': 'Default 300s.'}
x_mitre_mutable_elements[1]	{'field': 'BackgroundLocationPolicy', 'description': 'Baseline of legitimate background location usage across applications'}	{'field': 'LocationUpdateFreqThreshold', 'description': 'Default 60000ms (1 min) — below this = continuous surveillance vs occasional check-in.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'android:logcat', 'channel': 'Application invokes LocationManager, FusedLocationProviderClient, or GPS/location sensor APIs'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: LocationManager.requestLocationUpdates() called with minTime < $LocationUpdateFreqThreshold$ by app NOT IN $LocationAllowList$'}
x_mitre_mutable_elements[0]	{'field': 'LocationSamplingFrequencyThreshold', 'description': 'Defines acceptable rate of location queries before triggering anomaly conditions'}	{'field': 'LocationAllowList', 'description': 'Navigation, delivery, enterprise fleet management apps. Derive from MDM catalog.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--1887a270-576a-4049-84de-ef746b2572d6', 'name': 'EDR:telemetry', 'channel': 'Sustained or high-frequency location sensor access, including background location usage'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'webproxy:applog', 'channel': 'DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed'}
x_mitre_mutable_elements[2]	{'field': 'LocationToNetworkTimeWindow', 'description': 'Temporal linkage between location access and outbound traffic'}	{'field': 'LocationCDNList', 'description': 'Google Maps, Apple Maps, Mapbox, enterprise fleet CDN endpoints.'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:MDMLog', 'channel': 'Application granted/retaining ACCESS_FINE_LOCATION and/or ACCESS_COARSE_LOCATION; background location capability present (ACCESS_BACKGROUND_LOCATION on Android 10+)'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--e2f72131-14d1-411f-8e8c-aa3453dd5456', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_mutable_elements	{'field': 'AllowedLocationApps', 'description': 'Allow-list of expected location-heavy apps (maps, rideshare, fleet apps) for the enterprise device population'}
x_mitre_mutable_elements	{'field': 'DevicePolicySensitivity', 'description': 'Tuning for how aggressively to treat background location permission as risky depending on org policy.'}
x_mitre_mutable_elements	{'field': 'AllowedDestinationsBaseline', 'description': 'Baseline of expected domains/IPs for legitimate location services (OEM, mapping SDKs, MDM endpoints) to reduce false positives.'}

[AN1777] Analytic 1777

Current version: 1.1

	Old Description			New Description
t	1	Defender correlates an application’s location authorization	t	1	For iOS, detect Location Tracking by correlating analyst-vis
	>	level (When-In-Use vs Always) and entitlement posture with o		>	ible device/network evidence and management state; use strea
	>	bserved location sensor activity that occurs without proxima		>	ming or batched telemetry only where the documented collecto
	>	te user interaction, including background updates, followed		>	r is deployed. Correlate Application Permission via Applicat
	>	by periodic outbound network sessions aligned to location up		>	ion Vetting [Code-signing entitlements and Info.plist privac
	>	date timing—suggesting covert or policy-violating location t		>	y usage-description keys]; Network Traffic Flow via Apple Ne
	>	racking.		>	twork Extension / Enterprise VPN [NEFilterFlow / per-app VPN
				>	/ secure-web-gateway flow metadata]; Permissions Request vi
				>	a Application Vetting [Code-signing entitlements and Info.pl
				>	ist privacy usage-description keys]. Alert on a sequence or
				>	state change inconsistent with the device/app baseline, appr
				>	oved management policy, or expected user workflow; do not in
				>	fer unobserved API calls, file/process activity, or payload
				>	content from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.383000+00:00	2026-10-13 17:41:26.310000+00:00
description	Defender correlates an application’s location authorization level (When-In-Use vs Always) and entitlement posture with observed location sensor activity that occurs without proximate user interaction, including background updates, followed by periodic outbound network sessions aligned to location update timing—suggesting covert or policy-violating location tracking.	For iOS, detect Location Tracking by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]; Network Traffic Flow via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]; Permissions Request via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'iOS:unifiedlog', 'channel': 'Application activates CoreLocation services or CLLocationManager APIs'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'mobile:ApplicationVetting', 'channel': 'Code-signing entitlements and Info.plist privacy usage-description keys'}
x_mitre_mutable_elements[0]	{'field': 'ForegroundLocationExpectation', 'description': 'Defines legitimate location usage relative to app state'}	{'field': 'LocationAllowList', 'description': 'Navigation, delivery, enterprise fleet app bundle IDs.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'iOS:MDMLog', 'channel': 'App installed with location usage declarations (WhenInUse/Always usage description) and granted authorization level via managed policy state'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'iOS:NetworkExtension', 'channel': 'NEFilterFlow / per-app VPN / secure-web-gateway flow metadata'}
x_mitre_mutable_elements[1]	{'field': 'LocationAccessDurationThreshold', 'description': 'Baseline deviation tolerance for sustained location tracking'}	{'field': 'LocationCDNList', 'description': 'Apple Maps, Google Maps, Mapbox, enterprise fleet endpoints.'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--e2f72131-14d1-411f-8e8c-aa3453dd5456', 'name': 'mobile:ApplicationVetting', 'channel': 'Code-signing entitlements and Info.plist privacy usage-description keys'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_mutable_elements	{'field': 'LocationToTransmissionWindow', 'description': 'Temporal threshold linking location access to network activity'}

[AN1778] Analytic 1778

Current version: 1.1

	Old Description			New Description
t	1	Defender correlates an app preparing to phish (gaining overl	t	1	For Android, detect GUI Input Capture by correlating analyst
	>	ay/notification/accessibility capability) with precise foreg		>	-visible device/network evidence and management state; use s
	>	round targeting (reading activity in front via accessibility		>	treaming or batched telemetry only where the documented coll
	>	/focus) and then presenting a look-alike UI (overlay window		>	ector is deployed. Correlate Application State via Android E
	>	or activity-on-top) immediately before local storage or smal		>	nterprise / EMM [Managed package inventory/status and packag
	>	l-burst egress of entered data. Chain: capability/permission		>	e metadata]; Network Traffic Content via Enterprise Secure W
	>	→ target app in foreground detected → overlay/activity-on-t		>	eb Gateway / Proxy [DNS/HTTP(S) inspection or proxy transact
	>	op or fake notification tap → local prompt input write → nea		>	ion metadata where enterprise decryption/inspection is deplo
	>	r-term network egress.		>	yed]; Permissions Request via Android Enterprise DPC / Appli
				>	cation Vetting [DevicePolicyManager.getPermissionGrantState(
				>	); PackageManager manifest/requested-permission review]. Ale
				>	rt on a sequence or state change inconsistent with the devic
				>	e/app baseline, approved management policy, or expected user
				>	workflow; do not infer unobserved API calls, file/process a
				>	ctivity, or payload content from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.376000+00:00	2026-10-13 17:41:10.789000+00:00
description	Defender correlates an app preparing to phish (gaining overlay/notification/accessibility capability) with precise foreground targeting (reading activity in front via accessibility/focus) and then presenting a look-alike UI (overlay window or activity-on-top) immediately before local storage or small-burst egress of entered data. Chain: capability/permission → target app in foreground detected → overlay/activity-on-top or fake notification tap → local prompt input write → near-term network egress.	For Android, detect GUI Input Capture by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application State via Android Enterprise / EMM [Managed package inventory/status and package metadata]; Network Traffic Content via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed]; Permissions Request via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[3]	{'field': 'PersistPathRegex', 'description': 'Regex for local prompt data artifacts.'}	{'field': 'CredentialExfilWindow', 'description': 'Default 30s — credential submission is immediate.'}
x_mitre_mutable_elements[1]	{'field': 'OverlayRequired', 'description': 'Require overlay evidence unless activity-on-top is observed (true/false).'}	{'field': 'TargetAppList', 'description': 'Banking, enterprise SSO, auth apps.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--1887a270-576a-4049-84de-ef746b2572d6', 'name': 'android:logcat', 'channel': 'Grant/enablement of SYSTEM_ALERT_WINDOW, BIND_ACCESSIBILITY_SERVICE, POST_NOTIFICATIONS for '}	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'android:EMM', 'channel': 'Managed package inventory/status and package metadata'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindowSeconds', 'description': 'Max time from overlay/activity to persist/exfil (e.g., 5–60s).'}	{'field': 'OverlayAllowList', 'description': 'Approved chat bubble apps, enterprise accessibility tools. Minimal.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'android:logcat', 'channel': 'TYPE_WINDOW_STATE_CHANGED / TYPE_VIEW_FOCUSED shows foreign target package in foreground'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'webproxy:applog', 'channel': 'DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed'}
x_mitre_mutable_elements[2]	{'field': 'TargetPkgWatchlist', 'description': 'List of high-value target packages (banking, identity) to raise severity.'}	{'field': 'EnterpriseDestList', 'description': 'Enterprise IdP, known app backend endpoints.'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'android:logcat', 'channel': 'addView TYPE_APPLICATION_OVERLAY\|TYPE_APPLICATION_ATTACHED_DIALOG shown over '}	{'x_mitre_data_component_ref': 'x-mitre-data-component--e2f72131-14d1-411f-8e8c-aa3453dd5456', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'android:logcat', 'channel': 'startActivity on top of (launchMode/singleTop), task switch immediately after focus'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'android:logcat', 'channel': 'CREATE/WRITE to /data/data//(files\|databases)/(creds\|form\|prompt).*\\\\.(db\|sqlite\|json\|txt)'}
x_mitre_mutable_elements	{'field': 'ExfilDomainAllowlist', 'description': 'Known-good analytics/CDN/service domains to suppress FPs.'}
x_mitre_mutable_elements	{'field': 'UserContext', 'description': 'Work Profile/Kiosk mode/Accessibility allowlist to scope benign cases.'}

[AN1779] Analytic 1779

Current version: 1.1

	Old Description			New Description
t	1	Defender correlates a look-alike prompt inside an app (e.g.,	t	1	For iOS, detect GUI Input Capture by correlating analyst-vis
	>	faux Apple ID password view, webview of brand login) with t		>	ible device/network evidence and management state; use strea
	>	iming against scene/foreground activation, optional push not		>	ming or batched telemetry only where the documented collecto
	>	ification bait, then local form cache writes and/or small eg		>	r is deployed. Correlate Application Permission via Applicat
	>	ress. Chain: scene activation around sensitive UI → suspicio		>	ion Vetting [Code-signing entitlements and Info.plist privac
	>	us prompt creation (UIKit events without expected auth contr		>	y usage-description keys]; Application State via Apple MDM [
	>	oller) or webview navigated to look-alike domain → local cac		>	InstalledApplicationList / ManagedApplicationList]; Network
	>	he write → near-term egress		>	Traffic Content via Enterprise Secure Web Gateway / Proxy [D
				>	NS/HTTP(S) inspection or proxy transaction metadata where en
				>	terprise decryption/inspection is deployed]. Alert on a sequ
				>	ence or state change inconsistent with the device/app baseli
				>	ne, approved management policy, or expected user workflow; d
				>	o not infer unobserved API calls, file/process activity, or
				>	payload content from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.379000+00:00	2026-10-13 17:41:11.444000+00:00
description	Defender correlates a look-alike prompt inside an app (e.g., faux Apple ID password view, webview of brand login) with timing against scene/foreground activation, optional push notification bait, then local form cache writes and/or small egress. Chain: scene activation around sensitive UI → suspicious prompt creation (UIKit events without expected auth controller) or webview navigated to look-alike domain → local cache write → near-term egress	For iOS, detect GUI Input Capture by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]; Application State via Apple MDM [InstalledApplicationList / ManagedApplicationList]; Network Traffic Content via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[3]	{'field': 'ExfilDomainAllowlist', 'description': 'Enterprise/analytics endpoints to suppress FPs'}	{'field': 'EnterpriseDestList', 'description': 'Enterprise IdP and app backends.'}
x_mitre_mutable_elements[1]	{'field': 'LookalikeDomainScore', 'description': 'Threshold for domain visual similarity (e.g., ≥0.85).'}	{'field': 'MDMApprovedCatalog', 'description': 'MDM-managed app list. Derive from MDM platform.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'iOS:unifiedlog', 'channel': 'Presentation of credential-like view (UIAlertController with text fields / custom modal) not backed by system auth controller; frequent editingChanged in secureTextEntry fields'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'mobile:ApplicationVetting', 'channel': 'Code-signing entitlements and Info.plist privacy usage-description keys'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindowSeconds', 'description': 'Max time from prompt to persist/exfil (e.g., 5–60s).'}	{'field': 'TargetAppList', 'description': 'Banking, enterprise SSO, auth apps.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--1887a270-576a-4049-84de-ef746b2572d6', 'name': 'iOS:unifiedlog', 'channel': 'Scene/foreground transitions for to contextualize timing'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'iOS:MDM', 'channel': 'InstalledApplicationList / ManagedApplicationList'}
x_mitre_mutable_elements[2]	{'field': 'PersistPathRegex', 'description': 'Regex for credential/form cache artifacts in container.'}	{'field': 'ImpersonationTriggerWindow', 'description': 'Default 60s — adversary overlays target app context.'}
x_mitre_mutable_elements[4]	{'field': 'UserContext', 'description': 'MDM policy, Focus mode, foreground requirement.'}	{'field': 'CredentialExfilWindow', 'description': 'Default 30s.'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'iOS:unifiedlog', 'channel': 'WKWebView navigation to domain visually similar to target brand (IDN/punycode/alike score)'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'webproxy:applog', 'channel': 'DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'iOS:unifiedlog', 'channel': 'CREATE/WRITE of form cache/credential-like artifacts (forms.db, creds.json) in container'}

[AN1780] Analytic 1780

Current version: 1.1

	Old Description			New Description
t	1	Defender correlates an app's opaque media ingress (download/	t	1	For Android, detect Steganography by correlating analyst-vis
	>	IPC) with high-entropy or anomalous edits to image/audio/vid		>	ible device/network evidence and management state; use strea
	>	eo files in app-writable storage (e.g., bursts of bitmap/cod		>	ming or batched telemetry only where the documented collecto
	>	ec operations, EXIF/IPTC/XMP mutation, suspicious container		>	r is deployed. Correlate File Creation via Application Vetti
	>	growth), followed by decoding/extraction behavior (new non-m		>	ng / Forensic Acquisition [Dynamic filesystem trace or acqui
	>	edia artifact derived from the edited media) and optional ex		>	red app-container/filesystem artifacts: open() with O_CREAT
	>	filtration/sharing of the stego media. Focus is on: (1) opaq		>	on binary-typed path in /data/data/<app>/ within $StegoExecW
	>	ue media arrival → (2) rapid metadata or pixel-domain mutati		>	indow$ of media file download from same session]; Module Loa
	>	ons with atypical size/entropy deltas → (3a) decoded payload		>	d via Application Vetting / Instrumented Dynamic Analysis [D
	>	creation or dynamic load from decoded path, and/or (3b) upl		>	ynamic API/runtime trace: DexClassLoader() or dlopen() on pa
	>	oad/share of the modified media within a tight window.		>	th written within $StegoExecWindow$ of media download event
				>	— download-write-load chain confirms steganographic payload
				>	delivery]; Network Connection Creation via Android Enterpris
				>	e Network Logging / Enterprise VPN [DevicePolicyManager.retr
				>	ieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadat
				>	a]. Alert on a sequence or state change inconsistent with th
				>	e device/app baseline, approved management policy, or expect
				>	ed user workflow; do not infer unobserved API calls, file/pr
				>	ocess activity, or payload content from management state alo
				>	ne.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.382000+00:00	2026-10-13 17:41:02.476000+00:00
description	Defender correlates an app's opaque media ingress (download/IPC) with high-entropy or anomalous edits to image/audio/video files in app-writable storage (e.g., bursts of bitmap/codec operations, EXIF/IPTC/XMP mutation, suspicious container growth), followed by decoding/extraction behavior (new non-media artifact derived from the edited media) and optional exfiltration/sharing of the stego media. Focus is on: (1) opaque media arrival → (2) rapid metadata or pixel-domain mutations with atypical size/entropy deltas → (3a) decoded payload creation or dynamic load from decoded path, and/or (3b) upload/share of the modified media within a tight window.	For Android, detect Steganography by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate File Creation via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: open() with O_CREAT on binary-typed path in /data/data// within $StegoExecWindow$ of media file download from same session]; Module Load via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: DexClassLoader() or dlopen() on path written within $StegoExecWindow$ of media download event — download-write-load chain confirms steganographic payload delivery]; Network Connection Creation via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'android:logcat', 'channel': 'App UID writes edited media to container paths (e.g., /data/data//files/, .../cache/, /storage/emulated/0/Pictures//) with high delta in size vs. original and elevated estimated segment entropy '}	{'x_mitre_data_component_ref': 'x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba', 'name': 'android:EnterpriseNetworkLog', 'channel': 'DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata'}
x_mitre_mutable_elements[1]	{'field': 'PayloadEntropyThresholdMediaSegment', 'description': 'Minimum Shannon entropy for edited media regions or container deltas (e.g., ≥ 7.1) to flag likely embedded payloads.'}	{'field': 'StegoExecWindow', 'description': 'Default 120s from download to write-then-load chain. Tightening: 30s — synchronous extraction.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'NSM:Flow', 'channel': 'HTTP(S)/QUIC media download with opaque content types (image/, audio/, video/*) from non-gallery domains or CDNs not previously used by the app'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: open() with O_CREAT on binary-typed path in /data/data// within $StegoExecWindow$ of media file download from same session'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindowSeconds', 'description': 'Max time between media download/ingress, edit, and payload use/share (e.g., 10–120s depending on device performance).'}	{'field': 'AppMediaCDNList', 'description': "App's known image/audio CDN domains from 30-day baseline. Derive by measurement."}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--84572de3-9583-4c73-aabd-06ea88123dd8', 'name': 'android:logcat', 'channel': 'INSERT or UPDATE of image/, audio/, video/* via ContentResolver with same URI re-written within short window; abnormal MIME/container change'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--c0a4a086-cc20-4e1e-b7cb-29d99dfa3fb1', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: DexClassLoader() or dlopen() on path written within $StegoExecWindow$ of media download event — download-write-load chain confirms steganographic payload delivery'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_mutable_elements	{'field': 'SizeDeltaRatio', 'description': 'Minimum growth ratio between pre/post edit media (e.g., ≥ 1.25) to reduce noise from normal compression.'}
x_mitre_mutable_elements	{'field': 'EditBurstWriteCount', 'description': 'Minimum sequential small-write count to indicate chunked embedding or re-encode bursts.'}
x_mitre_mutable_elements	{'field': 'SuspiciousMimeTransitions', 'description': 'List of atypical MIME/container transitions (e.g., PNG→JPEG with EXIF injection, WAV→M4A) for local tuning.'}
x_mitre_mutable_elements	{'field': 'KnownGoodMediaAppsAllowlist', 'description': 'Trusted editors/camera apps allowed to perform frequent edits without alerting.'}
x_mitre_mutable_elements	{'field': 'NetworkCDNAllowlist', 'description': 'CDNs/domains expected to host user media for the enterprise; suppresses FP for legitimate apps.'}
x_mitre_mutable_elements	{'field': 'UserContext', 'description': 'Foreground, Work Profile, developer mode flags used to scope analytics.'}

[AN1781] Analytic 1781

Current version: 1.1

	Old Description			New Description
t	1	An application with access to broad file scopes or sensitive	t	1	For Android, detect Data Encrypted for Impact by correlating
	>	storage areas becomes active, performs abnormal burst file		>	analyst-visible device/network evidence and management stat
	>	reads and writes across many user or shared-storage location		>	e; use streaming or batched telemetry only where the documen
	>	s, transforms file content or extensions at scale in a short		>	ted collector is deployed. Correlate Application Permission
	>	window, and causes rapid file inaccessibility, rewrite, or		>	via Android Enterprise DPC / Application Vetting [DevicePoli
	>	replacement inconsistent with normal sync, backup, media pro		>	cyManager.getPermissionGrantState(); PackageManager manifest
	>	cessing, or document-editing behavior. The defender correlat		>	/requested-permission review]; Application State via Android
	>	es capability state, app lifecycle, framework use, bulk file		>	Enterprise / EMM [Managed package inventory/status and pack
	>	-write effects, and optional network communications to disti		>	age metadata]; OS API Execution via Application Vetting / In
	>	nguish encrypt-for-impact behavior from benign bulk file ope		>	strumented Dynamic Analysis [Dynamic API/runtime trace: Cont
	>	rations.		>	entResolver, DocumentProvider, StorageAccessFramework, or bu
				>	lk stream I/O invocations exceed $FileModificationRateThresh
				>	old$ operations per minute across distinct file paths — API-
				>	level operation rate distinguishes ransomware from norma]. A
				>	lert on a sequence or state change inconsistent with the dev
				>	ice/app baseline, approved management policy, or expected us
				>	er workflow; do not infer unobserved API calls, file/process
				>	activity, or payload content from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.382000+00:00	2026-10-13 17:42:22.306000+00:00
description	An application with access to broad file scopes or sensitive storage areas becomes active, performs abnormal burst file reads and writes across many user or shared-storage locations, transforms file content or extensions at scale in a short window, and causes rapid file inaccessibility, rewrite, or replacement inconsistent with normal sync, backup, media processing, or document-editing behavior. The defender correlates capability state, app lifecycle, framework use, bulk file-write effects, and optional network communications to distinguish encrypt-for-impact behavior from benign bulk file operations.	For Android, detect Data Encrypted for Impact by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; Application State via Android Enterprise / EMM [Managed package inventory/status and package metadata]; OS API Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: ContentResolver, DocumentProvider, StorageAccessFramework, or bulk stream I/O invocations exceed $FileModificationRateThreshold$ operations per minute across distinct file paths — API-level operation rate distinguishes ransomware from norma]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[3]	{'field': 'RecentUserInteractionWindow', 'description': 'Threshold for determining whether large-scale file transformation was user-driven versus unattended.'}	{'field': 'RansomwareWindow', 'description': 'Default 60s observation window for rate calculation.'}
x_mitre_mutable_elements[1]	{'field': 'AllowedAppList', 'description': 'Approved apps allowed to perform legitimate broad file operations such as backup, sync, AV scanning, enterprise migration, media editing, or document management.'}	{'field': 'FileModificationRateThreshold', 'description': 'Default 50 file writes/minute across 3+ directories. Derive from legitimate backup/sync app baseline. Tightening: 20 writes/min — catches slower encryption.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--6c62144a-cd5c-401c-ada9-58c4c74cd9d2', 'name': 'android:MDMLog', 'channel': 'Managed storage, backup, enterprise file access, or device policy state remains unchanged while bulk destructive file transformation occurs'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}
x_mitre_log_source_references[3]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': 'Content resolver, document provider, media store, storage access framework, bulk stream processing, or repeated crypto-adjacent framework use observed during multi-file transformation'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--6c62144a-cd5c-401c-ada9-58c4c74cd9d2', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindow', 'description': 'Maximum correlation span between app activation, framework use, and burst file transformation.'}	{'field': 'ApprovedFileManagerApps', 'description': 'Approved file management and backup apps. Derive from MDM catalog. Tightening: empty — all MANAGE_EXTERNAL_STORAGE holders flagged outside MDM agent.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'MobileEDR:telemetry', 'channel': 'Application holds or is granted broad storage, document-provider, media, or file-management capability inconsistent with its expected role before or during bulk file transformation'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'android:EMM', 'channel': 'Managed package inventory/status and package metadata'}
x_mitre_mutable_elements[2]	{'field': 'ForegroundStateRequired', 'description': 'Whether a benign bulk file operation is expected to occur only while the app is visible and actively used.'}	{'field': 'MinDirectoryCount', 'description': 'Default 3 distinct parent directories within window. Single-directory encryption is less confident.'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'MobileEDR:telemetry', 'channel': 'Application runs in foreground, service, or sustained background-active state while concentrated file transformation occurs with weak or no recent user interaction'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: ContentResolver, DocumentProvider, StorageAccessFramework, or bulk stream I/O invocations exceed $FileModificationRateThreshold$ operations per minute across distinct file paths — API-level operation rate distinguishes ransomware from norma'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_mutable_elements	{'field': 'FileWriteBurstThreshold', 'description': 'Threshold for number of file create, overwrite, rename, or replace actions within the correlation window.'}
x_mitre_mutable_elements	{'field': 'DistinctDirectoryThreshold', 'description': 'Threshold for number of distinct folders or content roots touched during the file-impact burst.'}
x_mitre_mutable_elements	{'field': 'ExtensionChangeThreshold', 'description': 'Threshold for suspicious file extension changes or replacement-file patterns indicative of mass transformation.'}
x_mitre_mutable_elements	{'field': 'BytesWrittenThreshold', 'description': 'Threshold for cumulative bytes written during the impact window.'}
x_mitre_mutable_elements	{'field': 'ProtectedPathAllowList', 'description': 'Known paths, document roots, or work-profile storage locations where benign enterprise migration or sync tooling may rewrite many files.'}
x_mitre_mutable_elements	{'field': 'DestinationAllowList', 'description': 'Expected network destinations contacted by legitimate storage, sync, backup, or MDM remediation apps.'}

[AN1782] Analytic 1782

Current version: 2.0

	Old Description			New Description
t	1	OLD: Application vetting services could look for `android.pe	t	1	For Android, detect Contact List by correlating analyst-visi
	>	rmission.READ_CONTACTS` in an Android application’s manifest		>	ble device/network evidence and management state; use stream
	>	, or `NSContactsUsageDescription` in an iOS application’s `I		>	ing or batched telemetry only where the documented collector
	>	nfo.plist` file. Most applications do not need contact list		>	is deployed. Correlate API Calls via Application Vetting /
	>	access, so extra scrutiny could be applied to those that req		>	Instrumented Dynamic Analysis [Dynamic API/runtime trace: Co
	>	uest it. On both Android and iOS, the user can manage which		>	ntentResolver.query(ContactsContract) with projection=all_fi
	>	applications have permission to access the contact list thro		>	elds]; Network Traffic Flow via Android Enterprise Network L
	>	ugh the device settings screen, revoking the permission if n		>	ogging / Enterprise VPN [DevicePolicyManager.retrieveNetwork
	>	ecessary. NEW: A defender observes an Android application		>	Logs(): DnsEvent / ConnectEvent; VPN flow metadata]; Permiss
	>	requesting for android.permission.READ_CONTACTS, which may a		>	ions Request via Android Enterprise DPC / Application Vettin
	>	lso be listed in the application's manifest file.		>	g [DevicePolicyManager.getPermissionGrantState(); PackageMan
				>	ager manifest/requested-permission review]. Alert on a seque
				>	nce or state change inconsistent with the device/app baselin
				>	e, approved management policy, or expected user workflow; do
				>	not infer unobserved API calls, file/process activity, or p
				>	ayload content from management state alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ApprovedContactsApps', 'description': 'Approved CRM, exchange sync, address book apps. Derive from MDM catalog.'}, {'field': 'ContactQueryThreshold', 'description': 'Default 50 queries/2min — CRM apps legitimately read contacts; tune by app category. Tightening: 20 for unknown apps.'}, {'field': 'ContactUplinkThreshold', 'description': 'Default 100KB — contact records average ~4KB; 25 contacts = 100KB.'}, {'field': 'ContactSyncCDNList', 'description': 'Exchange, Salesforce, Google People API endpoints.'}, {'field': 'ExfilWindow', 'description': 'Default 120s.'}]

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.383000+00:00	2026-10-13 17:41:50.102000+00:00
description	OLD: Application vetting services could look for `android.permission.READ_CONTACTS` in an Android application’s manifest, or `NSContactsUsageDescription` in an iOS application’s `Info.plist` file. Most applications do not need contact list access, so extra scrutiny could be applied to those that request it. On both Android and iOS, the user can manage which applications have permission to access the contact list through the device settings screen, revoking the permission if necessary. NEW: A defender observes an Android application requesting for android.permission.READ_CONTACTS, which may also be listed in the application's manifest file.	For Android, detect Contact List by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: ContentResolver.query(ContactsContract) with projection=all_fields]; Network Traffic Flow via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]; Permissions Request via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'android:logcat', 'channel': 'Invocation of ContactsContract.Contacts.getLookupUri() and/or ContactsContract.Contacts.lookupContact()'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: ContentResolver.query(ContactsContract) with projection=all_fields'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:MDMLog', 'channel': 'Application granted or retaining the READ_CONTACTS permission.'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'android:EnterpriseNetworkLog', 'channel': 'DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--e2f72131-14d1-411f-8e8c-aa3453dd5456', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}

[AN1783] Analytic 1783

Current version: 1.0

	Old Description			New Description
t	1	Application vetting services could look for `android.permiss	t	1	For iOS, detect Contact List by correlating analyst-visible
	>	ion.READ_CONTACTS` in an Android application’s manifest, or		>	device/network evidence and management state; use streaming
	>	`NSContactsUsageDescription` in an iOS application’s `Info.p		>	or batched telemetry only where the documented collector is
	>	list` file. Most applications do not need contact list acces		>	deployed. Correlate API Calls via Application Vetting / Inst
	>	s, so extra scrutiny could be applied to those that request		>	rumented Dynamic Analysis [Dynamic API/runtime trace: CNCont
	>	it. On both Android and iOS, the user can manage which appli		>	actStore.enumerateContacts with CNContactFetchRequest.keysTo
	>	cations have permission to access the contact list through t		>	Fetch containing all contact keys by app NOT IN $ApprovedCon
	>	he device settings screen, revoking the permission if necess		>	tactsApps$]; Network Traffic Flow via Apple Network Extensio
	>	ary.		>	n / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-
				>	gateway flow metadata]; Permissions Request via Application
				>	Vetting [Code-signing entitlements and Info.plist privacy us
				>	age-description keys]. Alert on a sequence or state change i
				>	nconsistent with the device/app baseline, approved managemen
				>	t policy, or expected user workflow; do not infer unobserved
				>	API calls, file/process activity, or payload content from m
				>	anagement state alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ApprovedContactsApps', 'description': 'com.microsoft.outlook, Salesforce, enterprise address book bundles.'}, {'field': 'ContactUplinkThreshold', 'description': 'Default 100KB.'}, {'field': 'ContactSyncCDNList', 'description': 'Exchange, Salesforce, Google People API endpoints.'}, {'field': 'ExfilWindow', 'description': 'Default 120s.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:41:50.742000+00:00
description	Application vetting services could look for `android.permission.READ_CONTACTS` in an Android application’s manifest, or `NSContactsUsageDescription` in an iOS application’s `Info.plist` file. Most applications do not need contact list access, so extra scrutiny could be applied to those that request it. On both Android and iOS, the user can manage which applications have permission to access the contact list through the device settings screen, revoking the permission if necessary.	For iOS, detect Contact List by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: CNContactStore.enumerateContacts with CNContactFetchRequest.keysToFetch containing all contact keys by app NOT IN $ApprovedContactsApps$]; Network Traffic Flow via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]; Permissions Request via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'Application Vetting', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: CNContactStore.enumerateContacts with CNContactFetchRequest.keysToFetch containing all contact keys by app NOT IN $ApprovedContactsApps$'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--56c2b384-77f8-461f-a71a-76f7888ebfb6', 'name': 'User Interface', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'iOS:NetworkExtension', 'channel': 'NEFilterFlow / per-app VPN / secure-web-gateway flow metadata'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--e2f72131-14d1-411f-8e8c-aa3453dd5456', 'name': 'mobile:ApplicationVetting', 'channel': 'Code-signing entitlements and Info.plist privacy usage-description keys'}

[AN1784] Analytic 1784

Current version: 1.1

	Old Description			New Description
t	1	Defender observes an app enumerating installed security/mana	t	1	For Android, detect Security Software Discovery by correlati
	>	gement controls (AV/EDR/MDM/VPN/Play Protect) via PackageMan		>	ng analyst-visible device/network evidence and management st
	>	ager, DevicePolicyManager, AppOps, and Settings queries or s		>	ate; use streaming or batched telemetry only where the docum
	>	hell ‘pm list’ usage, optionally probing Accessibility/Devic		>	ented collector is deployed. Correlate API Calls via Applica
	>	e Admin state. Enumeration is followed by local inventory ar		>	tion Vetting / Instrumented Dynamic Analysis [Dynamic API/ru
	>	tifact creation and/or small egress. Chain: capability to qu		>	ntime trace: PackageManager.getPackageInfo() called for pack
	>	ery → burst of security-focused checks (packages/permissions		>	age names IN $SecurityToolPackageList$ by app NOT IN $AppEnu
	>	/policies) → optional foreground targeting → artifact write		>	mAllowList$]; Application State via Android Enterprise / EMM
	>	→ quick POST.		>	[Managed package inventory/status and package metadata]; Ne
				>	twork Connection Creation via Android Enterprise Network Log
				>	ging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLo
				>	gs(): DnsEvent / ConnectEvent; VPN flow metadata]. Alert on
				>	a sequence or state change inconsistent with the device/app
				>	baseline, approved management policy, or expected user workf
				>	low; do not infer unobserved API calls, file/process activit
				>	y, or payload content from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.379000+00:00	2026-10-13 17:41:13.382000+00:00
description	Defender observes an app enumerating installed security/management controls (AV/EDR/MDM/VPN/Play Protect) via PackageManager, DevicePolicyManager, AppOps, and Settings queries or shell ‘pm list’ usage, optionally probing Accessibility/Device Admin state. Enumeration is followed by local inventory artifact creation and/or small egress. Chain: capability to query → burst of security-focused checks (packages/permissions/policies) → optional foreground targeting → artifact write → quick POST.	For Android, detect Security Software Discovery by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: PackageManager.getPackageInfo() called for package names IN $SecurityToolPackageList$ by app NOT IN $AppEnumAllowList$]; Application State via Android Enterprise / EMM [Managed package inventory/status and package metadata]; Network Connection Creation via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[1]	{'field': 'MinEnumCount', 'description': 'Minimum API calls/rows indicating inventory (e.g., ≥30 in 10s).'}	{'field': 'AppEnumAllowList', 'description': 'MDM agent, system diagnostic only.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'android:logcat', 'channel': 'getInstalledPackages/getPackagesHoldingPermissions with filters for known security/MDM/VPN package names. Queries to isDeviceOwnerApp/isProfileOwnerApp/getActiveAdmins/getPermissionGrantState. Requests list of enabled services or monitors TYPE_WINDOW_STATE_CHANGED to time checks'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: PackageManager.getPackageInfo() called for package names IN $SecurityToolPackageList$ by app NOT IN $AppEnumAllowList$'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindowSeconds', 'description': 'Max time from discovery burst to persist/exfil (e.g., 10–120s).'}	{'field': 'SecurityToolPackageList', 'description': 'Known MDM agent, MTD/EDR, AV package names. Maintain from vendor documentation. Update when new tools deployed.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--685f917a-e95e-4ba0-ade1-c7d354dae6e0', 'name': 'android:logcat', 'channel': "Command 'pm list packages' executed by app sandbox or child proc"}	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'android:EMM', 'channel': 'Managed package inventory/status and package metadata'}
x_mitre_mutable_elements[2]	{'field': 'SecurityTargetsList', 'description': 'Regex/prefix list of AV/EDR/MDM/VPN packages & services to elevate severity.'}	{'field': 'GuardrailWindow', 'description': 'Default 300s — time window within which C2 connection is expected post-check if guardrail not triggered.'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--1887a270-576a-4049-84de-ef746b2572d6', 'name': 'android:logcat', 'channel': 'Reads/queries ops for PACKAGE_USAGE_STATS, QUERY_ALL_PACKAGES, BIND_DEVICE_ADMIN, BIND_VPN_SERVICE'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba', 'name': 'android:EnterpriseNetworkLog', 'channel': 'DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'android:logcat', 'channel': 'Secure/Global reads of device_policy_manager, accessibility_enabled, default_vpn, always_on_vpn'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'android:logcat', 'channel': 'CREATE/WRITE /data/data//(files\|databases)/(security_inventory\|policy_audit).*\\\\.(json\|txt\|db\|plist)'}
x_mitre_mutable_elements	{'field': 'PersistPathRegex', 'description': 'Regex for local inventory artifacts (DB/JSON/TXT) in app container.'}
x_mitre_mutable_elements	{'field': 'ExfilDomainAllowlist', 'description': 'Allowlisted analytics/endpoints to suppress FPs.'}
x_mitre_mutable_elements	{'field': 'WorkProfileOnly', 'description': 'Scope to Work Profile events to reduce personal-profile noise.'}

[AN1785] Analytic 1785

Current version: 1.1

	Old Description			New Description
t	1	Defender correlates app attempts to enumerate or infer secur	t	1	For iOS, detect Security Software Discovery by correlating a
	>	ity/management tooling (ManagedConfiguration/MDM presence, V		>	nalyst-visible device/network evidence and management state;
	>	PN/NEFilter config, AV/EDR app presence via LaunchServices o		>	use streaming or batched telemetry only where the documente
	>	r URL-scheme probing, private APIs) with local inventory per		>	d collector is deployed. Correlate API Calls via Application
	>	sistence and egress. Chain: probe (MDM/NE/VPN/AV presence) →		>	Vetting / Instrumented Dynamic Analysis [Dynamic API/runtim
	>	burst of LS/canOpenURL/ManagedConfiguration calls → invento		>	e trace: UIApplication.canOpenURL() called with schemes IN $
	>	ry cache write → small POST.		>	MDMToolSchemeList$ by app NOT IN $AppEnumAllowList$]; Applic
				>	ation Permission via Application Vetting [Code-signing entit
				>	lements and Info.plist privacy usage-description keys]; Netw
				>	ork Connection Creation via Apple Network Extension / Enterp
				>	rise VPN [NEFilterFlow / per-app VPN / secure-web-gateway fl
				>	ow metadata]. Alert on a sequence or state change inconsiste
				>	nt with the device/app baseline, approved management policy,
				>	or expected user workflow; do not infer unobserved API call
				>	s, file/process activity, or payload content from management
				>	state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.381000+00:00	2026-10-13 17:41:14.020000+00:00
description	Defender correlates app attempts to enumerate or infer security/management tooling (ManagedConfiguration/MDM presence, VPN/NEFilter config, AV/EDR app presence via LaunchServices or URL-scheme probing, private APIs) with local inventory persistence and egress. Chain: probe (MDM/NE/VPN/AV presence) → burst of LS/canOpenURL/ManagedConfiguration calls → inventory cache write → small POST.	For iOS, detect Security Software Discovery by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: UIApplication.canOpenURL() called with schemes IN $MDMToolSchemeList$ by app NOT IN $AppEnumAllowList$]; Application Permission via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]; Network Connection Creation via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[1]	{'field': 'MinProbeCount', 'description': 'Minimum API/probe count to flag (e.g., ≥25/10s).'}	{'field': 'AppEnumAllowList', 'description': 'MDM agent, system tools only.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'iOS:unifiedlog', 'channel': 'Queries indicating MDM profile presence, supervised state, restrictions read. LSApplicationWorkspace enumeration or app proxy queries referencing security vendors'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: UIApplication.canOpenURL() called with schemes IN $MDMToolSchemeList$ by app NOT IN $AppEnumAllowList$'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindowSeconds', 'description': 'Max time from probe burst to persist/exfil (e.g., 10–120s).'}	{'field': 'MDMToolSchemeList', 'description': 'Known MDM agent, MTD/EDR URI scheme patterns. Derive from deployed tool documentation.'}
x_mitre_mutable_elements[2]	{'field': 'SecurityTargetsList', 'description': 'Schemes/bundle IDs for AV/EDR/MDM/VPN vendors (regex/prefix).'}	{'field': 'GuardrailWindow', 'description': 'Default 300s.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'iOS:unifiedlog', 'channel': 'CREATE/WRITE of /Library/Caches/security_inventory.*\\\\.(json\|plist\|db)'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'mobile:ApplicationVetting', 'channel': 'Code-signing entitlements and Info.plist privacy usage-description keys'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba', 'name': 'iOS:NetworkExtension', 'channel': 'NEFilterFlow / per-app VPN / secure-web-gateway flow metadata'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_mutable_elements	{'field': 'PersistPathRegex', 'description': 'Regex for inventory artifacts in app/extension containers.'}
x_mitre_mutable_elements	{'field': 'ExfilDomainAllowlist', 'description': 'Known-good analytics/CDN allowlist.'}
x_mitre_mutable_elements	{'field': 'JailbreakContext', 'description': 'Escalate severity if private APIs used on non-managed devices.'}

[AN1786] Analytic 1786

Current version: 1.0

	Old Description			New Description
t	1	The user can view permissions granted to an application in d	t	1	For Android, detect Protected User Data by correlating analy
	>	evice settings. Application vetting services typically flag		>	st-visible device/network evidence and management state; use
	>	permissions requested by an application, which can be revie		>	streaming or batched telemetry only where the documented co
	>	wed by an administrator. Certain dangerous permissions, such		>	llector is deployed. Correlate API Calls via Application Vet
	>	as `RECEIVE_SMS`, could receive additional scrutiny.		>	ting / Instrumented Dynamic Analysis [Dynamic API/runtime tr
				>	ace: ContentResolver.query() to sensitive provider URI (cont
				>	acts, calendar, call_log, sms) with query_count > $ContentQu
				>	eryThreshold$ by app NOT IN $ApprovedDataApps$]; Network Tra
				>	ffic Flow via Android Enterprise Network Logging / Enterpris
				>	e VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent /
				>	ConnectEvent; VPN flow metadata]; Permissions Request via A
				>	ndroid Enterprise DPC / Application Vetting [DevicePolicyMan
				>	ager.getPermissionGrantState(); PackageManager manifest/requ
				>	ested-permission review]. Alert on a sequence or state chang
				>	e inconsistent with the device/app baseline, approved manage
				>	ment policy, or expected user workflow; do not infer unobser
				>	ved API calls, file/process activity, or payload content fro
				>	m management state alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ApprovedDataApps', 'description': 'Per-data-type approved apps: calendar sync, dialer, SMS default, CRM apps. Derive from MDM catalog.'}, {'field': 'ContentQueryThreshold', 'description': 'Varies by data type: Contacts=50, Calendar=30, CallLog=10, SMS=20 queries/2min. Derive from per-app baseline.'}, {'field': 'UplinkThreshold', 'description': 'Default 100KB. Adjust per data-type expected size.'}, {'field': 'AppCDNList', 'description': 'Per-app CDN. Derive by measurement.'}, {'field': 'ExfilWindow', 'description': 'Default 120s.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:41:45.925000+00:00
description	The user can view permissions granted to an application in device settings. Application vetting services typically flag permissions requested by an application, which can be reviewed by an administrator. Certain dangerous permissions, such as `RECEIVE_SMS`, could receive additional scrutiny.	For Android, detect Protected User Data by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: ContentResolver.query() to sensitive provider URI (contacts, calendar, call_log, sms) with query_count > $ContentQueryThreshold$ by app NOT IN $ApprovedDataApps$]; Network Traffic Flow via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]; Permissions Request via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--56c2b384-77f8-461f-a71a-76f7888ebfb6', 'name': 'User Interface', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: ContentResolver.query() to sensitive provider URI (contacts, calendar, call_log, sms) with query_count > $ContentQueryThreshold$ by app NOT IN $ApprovedDataApps$'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'Application Vetting', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'android:EnterpriseNetworkLog', 'channel': 'DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--e2f72131-14d1-411f-8e8c-aa3453dd5456', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}

[AN1787] Analytic 1787

Current version: 1.0

	Old Description			New Description
t	1	The user can view permissions granted to an application in d	t	1	For iOS, detect Protected User Data by correlating analyst-v
	>	evice settings. Application vetting services typically flag		>	isible device/network evidence and management state; use str
	>	permissions requested by an application, which can be revie		>	eaming or batched telemetry only where the documented collec
	>	wed by an administrator. Certain dangerous permissions, such		>	tor is deployed. Correlate API Calls via Application Vetting
	>	as `RECEIVE_SMS`, could receive additional scrutiny.		>	/ Instrumented Dynamic Analysis [Dynamic API/runtime trace:
				>	CNContactStore.enumerateContacts or EKEventStore.fetchEvent
				>	s or CLLocationManager.startUpdatingLocation called with bro
				>	ad scope by app NOT IN $ApprovedDataApps$]; Network Traffic
				>	Flow via Apple Network Extension / Enterprise VPN [NEFilterF
				>	low / per-app VPN / secure-web-gateway flow metadata]; Permi
				>	ssions Request via Application Vetting [Code-signing entitle
				>	ments and Info.plist privacy usage-description keys]. Alert
				>	on a sequence or state change inconsistent with the device/a
				>	pp baseline, approved management policy, or expected user wo
				>	rkflow; do not infer unobserved API calls, file/process acti
				>	vity, or payload content from management state alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ApprovedDataApps', 'description': 'Approved sync, CRM, navigation apps per permission type. Derive from MDM catalog.'}, {'field': 'UplinkThreshold', 'description': 'Default 100KB.'}, {'field': 'AppCDNList', 'description': 'Per-app CDN. Derive by measurement.'}, {'field': 'ExfilWindow', 'description': 'Default 120s.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:41:46.569000+00:00
description	The user can view permissions granted to an application in device settings. Application vetting services typically flag permissions requested by an application, which can be reviewed by an administrator. Certain dangerous permissions, such as `RECEIVE_SMS`, could receive additional scrutiny.	For iOS, detect Protected User Data by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: CNContactStore.enumerateContacts or EKEventStore.fetchEvents or CLLocationManager.startUpdatingLocation called with broad scope by app NOT IN $ApprovedDataApps$]; Network Traffic Flow via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]; Permissions Request via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--56c2b384-77f8-461f-a71a-76f7888ebfb6', 'name': 'User Interface', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: CNContactStore.enumerateContacts or EKEventStore.fetchEvents or CLLocationManager.startUpdatingLocation called with broad scope by app NOT IN $ApprovedDataApps$'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'Application Vetting', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'iOS:NetworkExtension', 'channel': 'NEFilterFlow / per-app VPN / secure-web-gateway flow metadata'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--e2f72131-14d1-411f-8e8c-aa3453dd5456', 'name': 'mobile:ApplicationVetting', 'channel': 'Code-signing entitlements and Info.plist privacy usage-description keys'}

[AN1788] Analytic 1788

Current version: 1.1

	Old Description			New Description
t	1	Defender observes an app (package/UID) issuing high-rate dir	t	1	For Android, detect File and Directory Discovery by correlat
	>	ectory or content-index enumerations against external/shared		>	ing analyst-visible device/network evidence and management s
	>	storage or other apps’ Documents/Media providers (logcat:Co		>	tate; use streaming or batched telemetry only where the docu
	>	ntentResolver, logcat:StorageAccessFramework), followed with		>	mented collector is deployed. Correlate Application State vi
	>	in a short window by bulk READ handles or stat/list calls ov		>	a Android Enterprise / EMM [Managed package inventory/status
	>	er many distinct paths (logcat:FileIO). Activity occurs with		>	and package metadata]; File Access via Application Vetting
	>	out foreground UI or exceeds typical per-app baseline, indic		>	/ Forensic Acquisition [Dynamic filesystem trace or acquired
	>	ating automated file/dir discovery rather than user-driven b		>	app-container/filesystem artifacts: opendir() or File.listF
	>	rowsing. Correlate on package/UID/profile and time proximity		>	iles() on path IN $ExternalStoragePaths$ called > $FileEnumT
	>	.		>	hreshold$ times within $EnumWindow$ by app NOT IN $FileEnumA
				>	llowList$]; Network Traffic Flow via Android Enterprise Netw
				>	ork Logging / Enterprise VPN [DevicePolicyManager.retrieveNe
				>	tworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]. Al
				>	ert on a sequence or state change inconsistent with the devi
				>	ce/app baseline, approved management policy, or expected use
				>	r workflow; do not infer unobserved API calls, file/process
				>	activity, or payload content from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.376000+00:00	2026-10-13 17:41:14.639000+00:00
description	Defender observes an app (package/UID) issuing high-rate directory or content-index enumerations against external/shared storage or other apps’ Documents/Media providers (logcat:ContentResolver, logcat:StorageAccessFramework), followed within a short window by bulk READ handles or stat/list calls over many distinct paths (logcat:FileIO). Activity occurs without foreground UI or exceeds typical per-app baseline, indicating automated file/dir discovery rather than user-driven browsing. Correlate on package/UID/profile and time proximity.	For Android, detect File and Directory Discovery by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application State via Android Enterprise / EMM [Managed package inventory/status and package metadata]; File Access via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: opendir() or File.listFiles() on path IN $ExternalStoragePaths$ called > $FileEnumThreshold$ times within $EnumWindow$ by app NOT IN $FileEnumAllowList$]; Network Traffic Flow via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[3]	{'field': 'TargetPathRegex', 'description': 'Scope to enterprise-relevant locations (e.g., /Documents, /Android/media/).'}	{'field': 'FileEnumAllowList', 'description': 'Approved file managers, media apps, MDM agent.'}
x_mitre_mutable_elements[1]	{'field': 'MinDistinctPaths', 'description': 'Minimum unique paths accessed to qualify as discovery (e.g., ≥50).'}	{'field': 'FileEnumThreshold', 'description': 'Default 100 directory operations within window. Derive from baseline file manager behavior.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'android:logcat', 'channel': 'query() against MediaStore/DocumentsContract URIs (Images/Video/Audio/Downloads/DocumentTree)'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'android:EMM', 'channel': 'Managed package inventory/status and package metadata'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindowSeconds', 'description': 'Time window to correlate API queries with file listings (e.g., 30–300s).'}	{'field': 'ExternalStoragePaths', 'description': '/sdcard/, /storage/emulated/0/, /mnt/sdcard/. Vary by device.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'android:logcat', 'channel': 'ACTION_OPEN_DOCUMENT_TREE / ACTION_OPEN_DOCUMENT invoked without user gesture or repeatedly in background'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--235b7491-2d2b-4617-9a52-3c0783680f71', 'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: opendir() or File.listFiles() on path IN $ExternalStoragePaths$ called > $FileEnumThreshold$ times within $EnumWindow$ by app NOT IN $FileEnumAllowList$'}
x_mitre_mutable_elements[2]	{'field': 'BackgroundOnly', 'description': 'Require app to be backgrounded to reduce user-driven noise.'}	{'field': 'EnumWindow', 'description': 'Default 60s.'}
x_mitre_mutable_elements[4]	{'field': 'AllowlistedPackages', 'description': 'Backup/DLP/security apps expected to enumerate broadly.'}	{'field': 'UplinkThreshold', 'description': 'Default 500KB.'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--235b7491-2d2b-4617-9a52-3c0783680f71', 'name': 'android:logcat', 'channel': 'READ/LIST/STAT of /sdcard\|/storage/emulated/0\|/Android/media\|/Documents with >N distinct paths in TimeWindow'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'android:EnterpriseNetworkLog', 'channel': 'DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata'}
x_mitre_mutable_elements[5]	{'field': 'ProfileScope', 'description': 'Limit to Work Profile to reduce personal data noise.'}	{'field': 'AppCDNList', 'description': 'Per-app CDN. Derive by measurement.'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		{'field': 'ExfilWindow', 'description': 'Default 120s.'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:logcat', 'channel': 'READ_EXTERNAL_STORAGE / MANAGE_EXTERNAL_STORAGE permission present or toggled at runtime'}

[AN1789] Analytic 1789

Current version: 1.1

	Old Description			New Description
t	1	Defender observes an app (bundle/process) performing large-s	t	1	For iOS, detect File and Directory Discovery by correlating
	>	cope directory listings or metadata reads via FileProvider/N		>	analyst-visible device/network evidence and management state
	>	SFileManager against user-visible containers (Files app loca		>	; use streaming or batched telemetry only where the document
	>	tions, iCloud/On-My-iPhone) or external providers, with rapi		>	ed collector is deployed. Correlate Application State via Ap
	>	d traversal across many folders while the app is backgrounde		>	ple MDM [InstalledApplicationList / ManagedApplicationList];
	>	d or without corresponding UI activity (unifiedlogs:FileProv		>	Host Status via Apple MDM [DeviceInformation / SecurityInfo
	>	ider, unifiedlogs:FileIO). Optional signals include Photo li		>	/ ProfileList / restrictions and compliance queries]; Netwo
	>	brary or document picker bulk enumeration absent recent user		>	rk Traffic Flow via Apple Network Extension / Enterprise VPN
	>	gesture. Correlate on bundle/process/profile and path volum		>	[NEFilterFlow / per-app VPN / secure-web-gateway flow metad
	>	e within a bounded window.		>	ata]. Alert on a sequence or state change inconsistent with
				>	the device/app baseline, approved management policy, or expe
				>	cted user workflow; do not infer unobserved API calls, file/
				>	process activity, or payload content from management state a
				>	lone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.375000+00:00	2026-10-13 17:41:15.284000+00:00
description	Defender observes an app (bundle/process) performing large-scope directory listings or metadata reads via FileProvider/NSFileManager against user-visible containers (Files app locations, iCloud/On-My-iPhone) or external providers, with rapid traversal across many folders while the app is backgrounded or without corresponding UI activity (unifiedlogs:FileProvider, unifiedlogs:FileIO). Optional signals include Photo library or document picker bulk enumeration absent recent user gesture. Correlate on bundle/process/profile and path volume within a bounded window.	For iOS, detect File and Directory Discovery by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application State via Apple MDM [InstalledApplicationList / ManagedApplicationList]; Host Status via Apple MDM [DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries]; Network Traffic Flow via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[3]	{'field': 'RequireBackgroundState', 'description': 'Set true to require background discovery for higher confidence.'}	{'field': 'SmallRequestThreshold', 'description': 'Default 50KB per request — file listing and small file pickups.'}
x_mitre_mutable_elements[1]	{'field': 'MinDistinctPaths', 'description': 'Minimum number of unique paths to flag discovery (e.g., ≥40).'}	{'field': 'HighValueAppCount', 'description': 'Default 2 — single app could be accidental; multiple indicates targeted environment.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'iOS:unifiedlog', 'channel': 'enumeratorForContainerItemIdentifier / itemForIdentifier across multiple containers/providers'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'iOS:MDM', 'channel': 'InstalledApplicationList / ManagedApplicationList'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindowSeconds', 'description': 'Correlation window between enumeration API calls and path bursts (e.g., 30–300s).'}	{'field': 'HighValueAppList', 'description': 'Banking, auth, enterprise apps with sensitive local data.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--235b7491-2d2b-4617-9a52-3c0783680f71', 'name': 'iOS:unifiedlog', 'channel': 'readdir/stat/read of /private/var/mobile/Containers/Shared/AppGroup\|/Library/Mobile Documents\|/On\\\\ My\\\\ iPhone with >N distinct paths in TimeWindow'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--85a533a4-5fa4-4dba-b45d-f0717bedd6e6', 'name': 'iOS:MDM', 'channel': 'DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries'}
x_mitre_mutable_elements[2]	{'field': 'TargetPathRegex', 'description': 'Enterprise-relevant containers/providers to include/exclude.'}	{'field': 'ConnectionBurstThreshold', 'description': 'Default 5 connections to same dest within window.'}
x_mitre_mutable_elements[4]	{'field': 'AllowlistedBundles', 'description': 'Legitimate backup/DLP/file-management apps to suppress.'}	{'field': 'ExfilWindow', 'description': 'Default 300s after jailbreak detection.'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'iOS:unifiedlog', 'channel': 'UIDocumentPickerViewController presented repeatedly without foreground interaction or with short dwell time'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'iOS:NetworkExtension', 'channel': 'NEFilterFlow / per-app VPN / secure-web-gateway flow metadata'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_mutable_elements	{'field': 'ManagedProfileScope', 'description': 'Limit to managed devices/profiles.'}

[AN1790] Analytic 1790

Current version: 1.0

+For Android, detect Transmitted Data Manipulation by correla
->
+ting analyst-visible device/network evidence and management
->
+state; use streaming or batched telemetry only where the doc
+umented collector is deployed. Correlate API Calls via Appli
+cation Vetting / Instrumented Dynamic Analysis [Dynamic API/
+runtime trace: ClipboardManager.addOnPrimaryClipChangedListe
+ner() registered]; Application State via Android Enterprise
+/ EMM [Managed package inventory/status and package metadata
+]; System Notifications via Android Enterprise / Managed App
+ Telemetry [Documented DPC/admin callbacks or managed-app ge
+nerated event telemetry]. Alert on a sequence or state chang
+e inconsistent with the device/app baseline, approved manage
+ment policy, or expected user workflow; do not infer unobser
+ved API calls, file/process activity, or payload content fro
+m management state alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ClipboardAllowList', 'description': 'Approved password managers, approved clipboard tools. Minimal.'}, {'field': 'ClipboardReplaceWindow', 'description': 'Default 5s between original copy and replacement — clipper acts immediately.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:42:01.034000+00:00
description	Applications could be vetted for their use of the clipboard manager APIs with extra scrutiny given to application that make use of them.	For Android, detect Transmitted Data Manipulation by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: ClipboardManager.addOnPrimaryClipChangedListener() registered]; Application State via Android Enterprise / EMM [Managed package inventory/status and package metadata]; System Notifications via Android Enterprise / Managed App Telemetry [Documented DPC/admin callbacks or managed-app generated event telemetry]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'Application Vetting', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: ClipboardManager.addOnPrimaryClipChangedListener() registered'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'android:EMM', 'channel': 'Managed package inventory/status and package metadata'}
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--bf0ff551-a5a7-40e5-bff9-f9405011b1f4', 'name': 'android:ManagedAppLog', 'channel': 'Documented DPC/admin callbacks or managed-app generated event telemetry'}

[AN1791] Analytic 1791

Current version: 1.0

	Old Description			New Description
t	1	Mobile security products may provide URL inspection services	t	1	For Android, detect Phishing by correlating analyst-visible
	>	that could determine if a domain being visited is malicious		>	device/network evidence and management state; use streaming
	>	. Enterprises may be able to detect anomalous traffic origin		>	or batched telemetry only where the documented collector is
	>	ating from mobile devices, which could indicate compromise.		>	deployed. Correlate File Creation via Application Vetting /
				>	Forensic Acquisition [Dynamic filesystem trace or acquired a
				>	pp-container/filesystem artifacts: open() with O_CREAT for A
				>	PK file in /sdcard/ or /data/local/tmp/ within $PhishingWind
				>	ow$ of navigation to flagged URL — APK drop confirms malware
				>	delivery phase]; Network Traffic Content via Enterprise Sec
				>	ure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy tra
				>	nsaction metadata where enterprise decryption/inspection is
				>	deployed]; Process Creation via Application Vetting / Manage
				>	d Device Telemetry [execve() from APK installed within $Phis
				>	hingWindow$ of navigation to flagged URL — first execution c
				>	onfirms malware activation]. Alert on a sequence or state ch
				>	ange inconsistent with the device/app baseline, approved man
				>	agement policy, or expected user workflow; do not infer unob
				>	served API calls, file/process activity, or payload content
				>	from management state alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'URLReputationThreshold', 'description': 'Default 50/100. Derive from threat intel feed vendor scoring.'}, {'field': 'DomainAgeDays', 'description': 'Default 30 days — newly registered phishing domains.'}, {'field': 'PhishingWindow', 'description': 'Default 300s from URL navigation to APK install and execution.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-24 14:49:38.837000+00:00	2026-10-13 17:42:11.082000+00:00
description	Mobile security products may provide URL inspection services that could determine if a domain being visited is malicious. Enterprises may be able to detect anomalous traffic originating from mobile devices, which could indicate compromise.	For Android, detect Phishing by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate File Creation via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: open() with O_CREAT for APK file in /sdcard/ or /data/local/tmp/ within $PhishingWindow$ of navigation to flagged URL — APK drop confirms malware delivery phase]; Network Traffic Content via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed]; Process Creation via Application Vetting / Managed Device Telemetry [execve() from APK installed within $PhishingWindow$ of navigation to flagged URL — first execution confirms malware activation]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'Network Traffic', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: open() with O_CREAT for APK file in /sdcard/ or /data/local/tmp/ within $PhishingWindow$ of navigation to flagged URL — APK drop confirms malware delivery phase'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'Network Traffic', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'webproxy:applog', 'channel': 'DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'mobile:DynamicAnalysis', 'channel': 'execve() from APK installed within $PhishingWindow$ of navigation to flagged URL — first execution confirms malware activation'}

[AN1792] Analytic 1792

Current version: 1.0

	Old Description			New Description
t	1	Mobile security products may provide URL inspection services	t	1	For iOS, detect Phishing by correlating analyst-visible devi
	>	that could determine if a domain being visited is malicious		>	ce/network evidence and management state; use streaming or b
	>	. Enterprises may be able to detect anomalous traffic origin		>	atched telemetry only where the documented collector is depl
	>	ating from mobile devices, which could indicate compromise.		>	oyed. Correlate Network Traffic Content via Enterprise Secur
				>	e Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy trans
				>	action metadata where enterprise decryption/inspection is de
				>	ployed]; Network Traffic Flow via Apple Network Extension /
				>	Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gate
				>	way flow metadata]; Protected Configuration via Apple MDM [D
				>	eviceInformation / SecurityInfo / ProfileList / restrictions
				>	and compliance queries]. Alert on a sequence or state chang
				>	e inconsistent with the device/app baseline, approved manage
				>	ment policy, or expected user workflow; do not infer unobser
				>	ved API calls, file/process activity, or payload content fro
				>	m management state alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'URLReputationThreshold', 'description': 'Default 50/100. Derive from threat intel feed vendor scoring.'}, {'field': 'SafariBrowsingBaseline', 'description': 'Per-device Safari browsing destination baseline, 30-day. Derive by measurement.'}, {'field': 'PhishingWindow', 'description': 'Default 300s from URL navigation to C2 contact.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:42:11.758000+00:00
description	Mobile security products may provide URL inspection services that could determine if a domain being visited is malicious. Enterprises may be able to detect anomalous traffic originating from mobile devices, which could indicate compromise.	For iOS, detect Phishing by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Network Traffic Content via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed]; Network Traffic Flow via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]; Protected Configuration via Apple MDM [DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'Network Traffic', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'webproxy:applog', 'channel': 'DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'Network Traffic', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'iOS:NetworkExtension', 'channel': 'NEFilterFlow / per-app VPN / secure-web-gateway flow metadata'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--6c62144a-cd5c-401c-ada9-58c4c74cd9d2', 'name': 'iOS:MDM', 'channel': 'DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries'}

[AN1793] Analytic 1793

Current version: 1.1

	Old Description			New Description
t	1	A defender observes an application establishing application-	t	1	For Android, detect Exfiltration Over Alternative Protocol b
	>	layer network sessions (e.g., HTTP(S), WebSocket, DNS, SMTP/		>	y correlating analyst-visible device/network evidence and ma
	>	IMAP) with destinations and request patterns that deviate fr		>	nagement state; use streaming or batched telemetry only wher
	>	om the enterprise baseline for that app category, especially		>	e the documented collector is deployed. Correlate Applicatio
	>	when sessions occur during background execution or while th		>	n Permission via Android Enterprise DPC / Application Vettin
	>	e device is locked and exhibit beacon-like periodicity, anom		>	g [DevicePolicyManager.getPermissionGrantState(); PackageMan
	>	alous SNI/Host patterns, or suspicious request/response size		>	ager manifest/requested-permission review]; Application Stat
	>	symmetry consistent with command polling and tasking over l		>	e via Android Enterprise / EMM [Managed package inventory/st
	>	egitimate-looking protocols.		>	atus and package metadata]; Network Connection Creation via
				>	Android Enterprise Network Logging / Enterprise VPN [DeviceP
				>	olicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent;
				>	VPN flow metadata]. Alert on a sequence or state change inc
				>	onsistent with the device/app baseline, approved management
				>	policy, or expected user workflow; do not infer unobserved A
				>	PI calls, file/process activity, or payload content from man
				>	agement state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.382000+00:00	2026-10-13 17:41:57.843000+00:00
description	A defender observes an application establishing application-layer network sessions (e.g., HTTP(S), WebSocket, DNS, SMTP/IMAP) with destinations and request patterns that deviate from the enterprise baseline for that app category, especially when sessions occur during background execution or while the device is locked and exhibit beacon-like periodicity, anomalous SNI/Host patterns, or suspicious request/response size symmetry consistent with command polling and tasking over legitimate-looking protocols.	For Android, detect Exfiltration Over Alternative Protocol by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; Application State via Android Enterprise / EMM [Managed package inventory/status and package metadata]; Network Connection Creation via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[1]	{'field': 'ConnectionFrequencyThreshold', 'description': 'Baseline-dependent threshold for anomalous connection rates'}	{'field': 'PayloadVarianceThreshold', 'description': 'Default 100 bytes stdev — beacon payloads are uniform; human traffic varies.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'NSM:Flow', 'channel': 'Application-layer protocol traffic exhibiting beacon-like periodicity, anomalous session structure, or protocol misuse patterns'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}
x_mitre_mutable_elements[0]	{'field': 'BeaconIntervalVarianceThreshold', 'description': 'Defines acceptable periodicity variance for network communications'}	{'field': 'BeaconVarianceThreshold', 'description': 'Default 15% interval variance — human-driven traffic varies more. Derive from baseline traffic analysis.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'NSM:Flow', 'channel': 'Application-layer indicators observable via enterprise network controls (HTTP method, URI path pattern class, TLS SNI, JA3/ALPN when available, DNS qname/type) showing anomalous or low-and-slow command polling behavior'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'android:EMM', 'channel': 'Managed package inventory/status and package metadata'}
x_mitre_mutable_elements[2]	{'field': 'PayloadEntropyThreshold', 'description': 'Defines anomaly conditions for encoded or structured payload content'}	{'field': 'AppBaselineDomains', 'description': 'Per-app known CDN/update domains from 30-day baseline. Derive by measurement.'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': 'Framework-based networking usage spikes or uncommon networking stacks observed by agent telemetry (e.g., repeated URLSession/OkHttp-like patterns) without corresponding foreground/user interaction'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba', 'name': 'android:EnterpriseNetworkLog', 'channel': 'DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'webproxy:applog', 'channel': 'DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed'}
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'android:EnterpriseNetworkLog', 'channel': 'DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata'}
x_mitre_mutable_elements		{'field': 'BeaconMinCount', 'description': 'Default 10 connections — single or few connections are not beacon patterns.'}

[AN1794] Analytic 1794

Current version: 1.1

	Old Description			New Description
t	1	A defender observes an application generating application-la	t	1	For iOS, detect Application Layer Protocol by correlating an
	>	yer communications that blend with normal traffic (HTTP(S),		>	alyst-visible device/network evidence and management state;
	>	WebSocket, DNS, mail protocols) but show deviations from ent		>	use streaming or batched telemetry only where the documented
	>	erprise baselines for that bundle ID—such as persistent back		>	collector is deployed. Correlate Application Permission via
	>	ground network sessions, regular low-volume polling interval		>	Application Vetting [Code-signing entitlements and Info.pli
	>	s, anomalous SNI/Host destinations, uncommon DNS patterns, o		>	st privacy usage-description keys]; Application State via Ap
	>	r uniform request/response sizing—suggesting command and con		>	ple MDM [InstalledApplicationList / ManagedApplicationList];
	>	trol over legitimate-looking protocols without relying on to		>	Network Connection Creation via Apple Network Extension / E
	>	ol signatures.		>	nterprise VPN [NEFilterFlow / per-app VPN / secure-web-gatew
				>	ay flow metadata]. Alert on a sequence or state change incon
				>	sistent with the device/app baseline, approved management po
				>	licy, or expected user workflow; do not infer unobserved API
				>	calls, file/process activity, or payload content from manag
				>	ement state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.380000+00:00	2026-10-13 17:41:58.537000+00:00
description	A defender observes an application generating application-layer communications that blend with normal traffic (HTTP(S), WebSocket, DNS, mail protocols) but show deviations from enterprise baselines for that bundle ID—such as persistent background network sessions, regular low-volume polling intervals, anomalous SNI/Host destinations, uncommon DNS patterns, or uniform request/response sizing—suggesting command and control over legitimate-looking protocols without relying on tool signatures.	For iOS, detect Application Layer Protocol by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]; Application State via Apple MDM [InstalledApplicationList / ManagedApplicationList]; Network Connection Creation via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[1]	{'field': 'SessionPersistenceThreshold', 'description': 'Baseline deviation tolerance for long-lived sessions'}	{'field': 'AppBaselineDomains', 'description': 'Per-app CDN/update domains, 30-day baseline.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'NSM:Flow', 'channel': 'Application-layer protocol traffic exhibiting beacon-like periodicity, anomalous session structure, or protocol misuse patterns'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'mobile:ApplicationVetting', 'channel': 'Code-signing entitlements and Info.plist privacy usage-description keys'}
x_mitre_mutable_elements[0]	{'field': 'CadenceAnomalyThreshold', 'description': 'Defines acceptable deviation in protocol communication timing'}	{'field': 'MDMApprovedCatalog', 'description': 'MDM-managed app list.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'NSM:Flow', 'channel': 'Application-layer indicators observable via enterprise network controls (HTTP method, URI path pattern class, TLS SNI, JA3/ALPN when available, DNS qname/type) showing anomalous or low-and-slow command polling behavior'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'iOS:MDM', 'channel': 'InstalledApplicationList / ManagedApplicationList'}
x_mitre_mutable_elements[2]	{'field': 'AppNetworkBehaviorBaseline', 'description': 'Expected mapping of application functionality to protocol usage'}	{'field': 'BeaconVarianceThreshold', 'description': 'Default 15% interval variance. Derive from baseline traffic analysis.'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': 'Framework-based networking usage spikes or uncommon networking stacks observed by agent telemetry (e.g., repeated URLSession/OkHttp-like patterns) without corresponding foreground/user interaction'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba', 'name': 'iOS:NetworkExtension', 'channel': 'NEFilterFlow / per-app VPN / secure-web-gateway flow metadata'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'webproxy:applog', 'channel': 'DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed'}
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'iOS:NetworkExtension', 'channel': 'NEFilterFlow / per-app VPN / secure-web-gateway flow metadata'}
x_mitre_mutable_elements		{'field': 'PayloadVarianceThreshold', 'description': 'Default 100 bytes stdev.'}
x_mitre_mutable_elements		{'field': 'BeaconMinCount', 'description': 'Default 10 connections.'}

[AN1795] Analytic 1795

Current version: 2.0

	Old Description			New Description
t	1	OLD: Application vetting services could look for `android.pe	t	1	For Android, detect SMS Messages by correlating analyst-visi
	>	rmission.READ_SMS` in an Android application’s manifest. Mos		>	ble device/network evidence and management state; use stream
	>	t applications do not need access to SMS messages, so extra		>	ing or batched telemetry only where the documented collector
	>	scrutiny could be applied to those that request it. On Andr		>	is deployed. Correlate API Calls via Application Vetting /
	>	oid, the user can manage which applications have permission		>	Instrumented Dynamic Analysis [Dynamic API/runtime trace: Co
	>	to access SMS messages through the device settings screen, r		>	ntentResolver.query(Telephony.Sms) including both inbox]; Ne
	>	evoking the permission if necessary. NEW: A defender observ		>	twork Traffic Flow via Android Enterprise Network Logging /
	>	es an Android application requesting for `android.permission		>	Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): D
	>	. READ_SMS` and/or ` android.permission. RECEIVE_SMS `, whic		>	nsEvent / ConnectEvent; VPN flow metadata]; Permissions Requ
	>	h may also be listed in the application's manifest file.		>	est via Android Enterprise DPC / Application Vetting [Device
				>	PolicyManager.getPermissionGrantState(); PackageManager mani
				>	fest/requested-permission review]. Alert on a sequence or st
				>	ate change inconsistent with the device/app baseline, approv
				>	ed management policy, or expected user workflow; do not infe
				>	r unobserved API calls, file/process activity, or payload co
				>	ntent from management state alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ApprovedSMSApps', 'description': 'Default SMS app, approved SMS backup apps. Keep minimal.'}, {'field': 'SMSUplinkThreshold', 'description': 'Default 10KB — SMS messages are ~500 bytes; even 20 with 2FA codes is high-confidence exfil.'}, {'field': 'AppCDNList', 'description': 'Per-app CDN. Derive by measurement.'}, {'field': 'ExfilWindow', 'description': 'Default 120s.'}]

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.377000+00:00	2026-10-13 17:41:51.369000+00:00
description	OLD: Application vetting services could look for `android.permission.READ_SMS` in an Android application’s manifest. Most applications do not need access to SMS messages, so extra scrutiny could be applied to those that request it. On Android, the user can manage which applications have permission to access SMS messages through the device settings screen, revoking the permission if necessary. NEW: A defender observes an Android application requesting for `android.permission. READ_SMS` and/or ` android.permission. RECEIVE_SMS `, which may also be listed in the application's manifest file.	For Android, detect SMS Messages by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: ContentResolver.query(Telephony.Sms) including both inbox]; Network Traffic Flow via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]; Permissions Request via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:MDMLog', 'channel': 'Application granted or retaining the READ_SMS or RECEIVE_SMS permission.'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: ContentResolver.query(Telephony.Sms) including both inbox'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'android:EnterpriseNetworkLog', 'channel': 'DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata'}
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--e2f72131-14d1-411f-8e8c-aa3453dd5456', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}

[AN1796] Analytic 1796

Current version: 1.0

	Old Description			New Description
t	1	Application vetting services could look for `android.permiss	t	1	For iOS, detect SMS Messages by correlating analyst-visible
	>	ion.READ_SMS` in an Android application’s manifest. Most app		>	device/network evidence and management state; use streaming
	>	lications do not need access to SMS messages, so extra scrut		>	or batched telemetry only where the documented collector is
	>	iny could be applied to those that request it. On Android,		>	deployed. Correlate Application State via Apple MDM [Install
	>	the user can manage which applications have permission to ac		>	edApplicationList / ManagedApplicationList]; Host Status via
	>	cess SMS messages through the device settings screen, revoki		>	Apple MDM [DeviceInformation / SecurityInfo / ProfileList /
	>	ng the permission if necessary.		>	restrictions and compliance queries]; Network Traffic Flow
				>	via Apple Network Extension / Enterprise VPN [NEFilterFlow /
				>	per-app VPN / secure-web-gateway flow metadata]. Alert on a
				>	sequence or state change inconsistent with the device/app b
				>	aseline, approved management policy, or expected user workfl
				>	ow; do not infer unobserved API calls, file/process activity
				>	, or payload content from management state alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'MessagingAppList', 'description': 'Messages (SMS), WhatsApp, Signal, Telegram — apps that use sms.db or have message value.'}, {'field': 'SMSDumpThreshold', 'description': 'Default 10KB — even high-value targeted message grabs are small; full inbox dumps are larger.'}, {'field': 'AppCDNList', 'description': 'Per-device CDN baseline.'}, {'field': 'ExfilWindow', 'description': 'Default 300s.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:41:52.039000+00:00
description	Application vetting services could look for `android.permission.READ_SMS` in an Android application’s manifest. Most applications do not need access to SMS messages, so extra scrutiny could be applied to those that request it. On Android, the user can manage which applications have permission to access SMS messages through the device settings screen, revoking the permission if necessary.	For iOS, detect SMS Messages by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application State via Apple MDM [InstalledApplicationList / ManagedApplicationList]; Host Status via Apple MDM [DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries]; Network Traffic Flow via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'Application Vetting', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'iOS:MDM', 'channel': 'InstalledApplicationList / ManagedApplicationList'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--56c2b384-77f8-461f-a71a-76f7888ebfb6', 'name': 'User Interface', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--85a533a4-5fa4-4dba-b45d-f0717bedd6e6', 'name': 'iOS:MDM', 'channel': 'DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'iOS:NetworkExtension', 'channel': 'NEFilterFlow / per-app VPN / secure-web-gateway flow metadata'}

[AN1797] Analytic 1797

Current version: 1.1

	Old Description			New Description
t	1	Correlates (1) application-driven modification of device sec	t	1	For Android, detect Impair Defenses from documented manageme
	>	urity posture or monitoring capability (e.g., accessibility		>	nt, network, or vetting evidence; treat state queries as per
	>	abuse, disabling security app components, altering monitorin		>	iodic observations rather than real-time events. Correlate A
	>	g configuration), (2) immediate degradation or cessation of		>	pplication Permission via Android Enterprise DPC / Applicati
	>	expected telemetry sources such as mobile EDR, sensor visibi		>	on Vetting [DevicePolicyManager.getPermissionGrantState(); P
	>	lity, or system monitoring, and (3) subsequent application a		>	ackageManager manifest/requested-permission review]; OS API
	>	ctivity continuing with reduced observability. The defender		>	Execution via Application Vetting / Instrumented Dynamic Ana
	>	observes a causal chain where defensive visibility or enforc		>	lysis [Dynamic API/runtime trace: App invokes package manage
	>	ement is altered first, followed by continued execution unde		>	ment, DevicePolicyManager, or settings operations capable of
	>	r reduced monitoring conditions.		>	disabling security tooling — API invocation to disable secu
				>	rity control]. Alert on a sequence or state change inconsist
				>	ent with the device/app baseline, approved management policy
				>	, or expected user workflow; do not infer unobserved API cal
				>	ls, file/process activity, or payload content from managemen
				>	t state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.383000+00:00	2026-10-13 17:42:48.880000+00:00
description	Correlates (1) application-driven modification of device security posture or monitoring capability (e.g., accessibility abuse, disabling security app components, altering monitoring configuration), (2) immediate degradation or cessation of expected telemetry sources such as mobile EDR, sensor visibility, or system monitoring, and (3) subsequent application activity continuing with reduced observability. The defender observes a causal chain where defensive visibility or enforcement is altered first, followed by continued execution under reduced monitoring conditions.	For Android, detect Impair Defenses from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; OS API Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: App invokes package management, DevicePolicyManager, or settings operations capable of disabling security tooling — API invocation to disable security control]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:MDMLog', 'channel': 'change to security-relevant device configuration or managed policy (e.g., accessibility enablement, app admin changes, security service state change) preceding telemetry degradation'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindow', 'description': 'Correlation window between configuration change, telemetry degradation, and subsequent activity'}	{'field': 'ElevationAllowList', 'description': 'MDM agent and approved Device Admin apps only. Any other app acquiring Device Admin then modifying security settings is Impair Defenses.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'MobileEDR:telemetry', 'channel': 'ecurity or monitoring application transitions to disabled, inactive, or non-reporting state while other applications remain active'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes package management, DevicePolicyManager, or settings operations capable of disabling security tooling — API invocation to disable security control'}
x_mitre_mutable_elements[1]	{'field': 'ExpectedTelemetrySources', 'description': 'Baseline set of telemetry sources expected to report continuously (EDR, sensor feeds, monitoring services)'}	{'field': 'SecurityToolPackageList', 'description': 'MDM agent, AV, MTD packages deployed on managed fleet. Derive from MDM enrollment configuration.'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': 'application invokes system framework operations that alter monitoring, accessibility, or execution visibility followed by reduction in expected telemetry generation'}
x_mitre_mutable_elements	{'field': 'TelemetryGapThreshold', 'description': 'Duration or volume threshold defining abnormal loss of telemetry'}
x_mitre_mutable_elements	{'field': 'AllowedAppList', 'description': 'Applications legitimately capable of modifying device configuration or security posture'}
x_mitre_mutable_elements	{'field': 'CriticalControlSet', 'description': 'Set of security-relevant controls considered high-impact if altered (EDR, accessibility, admin APIs)'}
x_mitre_mutable_elements	{'field': 'UplinkBytesThreshold', 'description': 'Outbound traffic threshold used to confirm continued activity during telemetry loss'}

[AN1798] Analytic 1798

Current version: 1.0

+For Android, detect Out of Band Data by correlating analyst-
->
+visible device/network evidence and management state; use st
->
+reaming or batched telemetry only where the documented colle
+ctor is deployed. Correlate API Calls via Application Vettin
+g / Instrumented Dynamic Analysis [Dynamic API/runtime trace
+: NotificationListenerService.onNotificationPosted() receivi
+ng notifications from source_app IN $HighValueNotifApps$ by
+listener NOT IN $NotificationAllowList$]; Network Traffic Co
+ntent via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S)
+ inspection or proxy transaction metadata where enterprise d
+ecryption/inspection is deployed]; System Notifications via
+Android Enterprise / Managed App Telemetry [Documented DPC/a
+dmin callbacks or managed-app generated event telemetry]. Al
+ert on a sequence or state change inconsistent with the devi
+ce/app baseline, approved management policy, or expected use
+r workflow; do not infer unobserved API calls, file/process
+activity, or payload content from management state alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'NotificationAllowList', 'description': 'Approved companion/wearable apps. Minimal. Derive from MDM catalog.'}, {'field': 'HighValueNotifApps', 'description': 'Banking, auth, enterprise SSO, SMS/messaging app packages.'}, {'field': 'AppCDNList', 'description': 'Per-app CDN. Derive by measurement.'}, {'field': 'NotifExfilWindow', 'description': 'Default 30s — OTP codes expire quickly; transmission is immediate.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:42:04.503000+00:00
description	If the user sees a notification with text they do not recognize, they should review their list of installed applications.	For Android, detect Out of Band Data by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: NotificationListenerService.onNotificationPosted() receiving notifications from source_app IN $HighValueNotifApps$ by listener NOT IN $NotificationAllowList$]; Network Traffic Content via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed]; System Notifications via Android Enterprise / Managed App Telemetry [Documented DPC/admin callbacks or managed-app generated event telemetry]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--bf0ff551-a5a7-40e5-bff9-f9405011b1f4', 'name': 'User Interface', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: NotificationListenerService.onNotificationPosted() receiving notifications from source_app IN $HighValueNotifApps$ by listener NOT IN $NotificationAllowList$'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'webproxy:applog', 'channel': 'DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed'}
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--bf0ff551-a5a7-40e5-bff9-f9405011b1f4', 'name': 'android:ManagedAppLog', 'channel': 'Documented DPC/admin callbacks or managed-app generated event telemetry'}

[AN1799] Analytic 1799

Current version: 1.0

	Old Description			New Description
t	1	If the user sees a notification with text they do not recogn	t	1	For iOS, detect Out of Band Data by correlating analyst-visi
	>	ize, they should review their list of installed applications		>	ble device/network evidence and management state; use stream
	>	.		>	ing or batched telemetry only where the documented collector
				>	is deployed. Correlate Application Permission via Applicati
				>	on Vetting [Code-signing entitlements and Info.plist privacy
				>	usage-description keys]; Network Traffic Flow via Apple Net
				>	work Extension / Enterprise VPN [NEFilterFlow / per-app VPN
				>	/ secure-web-gateway flow metadata]; Protected Configuration
				>	via Apple MDM [DeviceInformation / SecurityInfo / ProfileLi
				>	st / restrictions and compliance queries]. Alert on a sequen
				>	ce or state change inconsistent with the device/app baseline
				>	, approved management policy, or expected user workflow; do
				>	not infer unobserved API calls, file/process activity, or pa
				>	yload content from management state alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'MDMApprovedCatalog', 'description': 'MDM-managed app list.'}, {'field': 'APNSAllowList', 'description': 'Enterprise Apple Team IDs for deployed apps.'}, {'field': 'AppBaselineDomains', 'description': 'Per-device CDN baseline, 30-day.'}, {'field': 'BeaconVarianceThreshold', 'description': 'Default 15% interval variance.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:42:05.137000+00:00
description	If the user sees a notification with text they do not recognize, they should review their list of installed applications.	For iOS, detect Out of Band Data by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]; Network Traffic Flow via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]; Protected Configuration via Apple MDM [DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--bf0ff551-a5a7-40e5-bff9-f9405011b1f4', 'name': 'User Interface', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'mobile:ApplicationVetting', 'channel': 'Code-signing entitlements and Info.plist privacy usage-description keys'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'iOS:NetworkExtension', 'channel': 'NEFilterFlow / per-app VPN / secure-web-gateway flow metadata'}
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--6c62144a-cd5c-401c-ada9-58c4c74cd9d2', 'name': 'iOS:MDM', 'channel': 'DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries'}

[AN1800] Analytic 1800

Current version: 1.1

	Old Description			New Description
t	1	Correlates (1) modification or replacement of system runtime	t	1	For Android, detect System Runtime API Hijacking primarily d
	>	libraries or API resolution paths, (2) repeated invocation		>	uring application vetting or controlled analysis rather than
	>	of hijacked APIs across multiple applications, and (3) incon		>	assuming a live device SOC feed. Correlate OS API Execution
	>	sistent or suppressed outputs from those APIs compared to ex		>	via Application Vetting / Instrumented Dynamic Analysis [Dy
	>	pected OS-enforced behavior. The defender observes a causal		>	namic API/runtime trace: Multiple applications invoking core
	>	chain where system-level API behavior is altered, resulting		>	system APIs (sensor, permission, telephony, PackageManager)
	>	in multiple applications exhibiting consistent anomalies in		>	show inconsistent, suppressed, or modified return values co
	>	sensor access, permission checks, or system state reporting.		>	mpared to OS-expected behavior — cross-app API result incons
				>	istency is the runtime hi]; OS API Execution via Application
				>	Vetting / Instrumented Dynamic Analysis [Dynamic API/runtim
				>	e trace: Device integrity degradation (root detected, system
				>	partition modification, SafetyNet/Play Integrity failure) c
				>	oincident with anomalous system API behavior affecting runti
				>	me resolution]. Alert on a sequence or state change inconsis
				>	tent with the device/app baseline, approved management polic
				>	y, or expected user workflow; do not infer unobserved API ca
				>	lls, file/process activity, or payload content from manageme
				>	nt state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.380000+00:00	2026-10-13 17:40:55.029000+00:00
description	Correlates (1) modification or replacement of system runtime libraries or API resolution paths, (2) repeated invocation of hijacked APIs across multiple applications, and (3) inconsistent or suppressed outputs from those APIs compared to expected OS-enforced behavior. The defender observes a causal chain where system-level API behavior is altered, resulting in multiple applications exhibiting consistent anomalies in sensor access, permission checks, or system state reporting.	For Android, detect System Runtime API Hijacking primarily during application vetting or controlled analysis rather than assuming a live device SOC feed. Correlate OS API Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: Multiple applications invoking core system APIs (sensor, permission, telephony, PackageManager) show inconsistent, suppressed, or modified return values compared to OS-expected behavior — cross-app API result inconsistency is the runtime hi]; OS API Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: Device integrity degradation (root detected, system partition modification, SafetyNet/Play Integrity failure) coincident with anomalous system API behavior affecting runtime resolution]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': 'multiple applications invoking core system APIs (e.g., sensor, permission, telephony) with abnormal or inconsistent return values across apps within short interval'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Multiple applications invoking core system APIs (sensor, permission, telephony, PackageManager) show inconsistent, suppressed, or modified return values compared to OS-expected behavior — cross-app API result inconsistency is the runtime hi'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindow', 'description': 'Correlation window across multiple applications invoking affected APIs'}	{'field': 'APIBaselineValues', 'description': 'Expected return values for key system APIs on clean device of this model/version. Derive from fleet measurement on known-good devices. Deviations from baseline indicate runtime hijacking.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': 'device integrity degradation + root detected or system partition modification affecting runtime libraries (e.g., /system/lib, /vendor/lib)'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Device integrity degradation (root detected, system partition modification, SafetyNet/Play Integrity failure) coincident with anomalous system API behavior affecting runtime resolution'}
x_mitre_mutable_elements[1]	{'field': 'SensitiveAPISet', 'description': 'Set of APIs monitored for integrity (e.g., location, telephony, permission checks)'}	{'field': 'MultiAppInconsistencyThreshold', 'description': 'Default 3 distinct apps showing API result anomalies simultaneously. Single-app anomaly may be app bug; multi-app simultaneous anomaly indicates system-level hook.'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_mutable_elements	{'field': 'CrossAppConsistencyThreshold', 'description': 'Number of applications required to exhibit anomalous API behavior to trigger detection'}
x_mitre_mutable_elements	{'field': 'ExpectedAPIBaseline', 'description': 'Baseline of expected API return values or behavior patterns per device state'}

[AN1801] Analytic 1801

Current version: 1.1

	Old Description			New Description
t	1	Correlates (1) a malicious application gaining or using a re	t	1	For Android, detect Uninstall Malicious Application from doc
	>	moval-capable control path, such as device owner or delegate		>	umented management, network, or vetting evidence; treat stat
	>	d app-management authority, accessibility service control ov		>	e queries as periodic observations rather than real-time eve
	>	er uninstall UI, or rooted filesystem access, (2) initiation		>	nts. Correlate Application Permission via Android Enterprise
	>	of uninstall or package-removal behavior, and (3) disappear		>	DPC / Application Vetting [DevicePolicyManager.getPermissio
	>	ance of the application from installed-state inventory or ap		>	nGrantState(); PackageManager manifest/requested-permission
	>	p runtime immediately afterward, often with a short-lived fi		>	review]; File Deletion via Application Vetting / Forensic Ac
	>	nal burst of local cleanup or outbound communication. The de		>	quisition [Dynamic filesystem trace or acquired app-containe
	>	fender observes a causal chain where the application first e		>	r/filesystem artifacts: App deletes package files or local s
	>	stablishes the ability to remove itself, then triggers unins		>	tate immediately before package inventory disappearance — pr
	>	tall or deletion, and then vanishes from expected app presen		>	e-removal evidence cleanup]; OS API Execution via Applicatio
	>	ce while device activity continues.		>	n Vetting / Instrumented Dynamic Analysis [Dynamic API/runti
				>	me trace: App invokes PackageInstaller uninstall or pm unins
				>	tall for own package or companion package NOT IN $ProtectedP
				>	ackageList$ without user-initiated UI flow matching]. Alert
				>	on a sequence or state change inconsistent with the device/a
				>	pp baseline, approved management policy, or expected user wo
				>	rkflow; do not infer unobserved API calls, file/process acti
				>	vity, or payload content from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.376000+00:00	2026-10-13 17:40:55.589000+00:00
description	Correlates (1) a malicious application gaining or using a removal-capable control path, such as device owner or delegated app-management authority, accessibility service control over uninstall UI, or rooted filesystem access, (2) initiation of uninstall or package-removal behavior, and (3) disappearance of the application from installed-state inventory or app runtime immediately afterward, often with a short-lived final burst of local cleanup or outbound communication. The defender observes a causal chain where the application first establishes the ability to remove itself, then triggers uninstall or deletion, and then vanishes from expected app presence while device activity continues.	For Android, detect Uninstall Malicious Application from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; File Deletion via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: App deletes package files or local state immediately before package inventory disappearance — pre-removal evidence cleanup]; OS API Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: App invokes PackageInstaller uninstall or pm uninstall for own package or companion package NOT IN $ProtectedPackageList$ without user-initiated UI flow matching]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:MDMLog', 'channel': 'device posture indicates rooted, compromised, or non-compliant state before package files disappear without standard managed uninstall workflow'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes PackageInstaller uninstall or pm uninstall for own package or companion package NOT IN $ProtectedPackageList$ without user-initiated UI flow matching'}
x_mitre_mutable_elements[1]	{'field': 'RemovalAuthoritySet', 'description': 'Roles or privileges considered capable of enabling silent or assisted uninstall, such as device owner, delegated app-management authority, accessibility, or rooted filesystem access'}	{'field': 'ProtectedPackageList', 'description': 'Security-critical packages that should never be self-uninstalled: MDM agent, MTD, enterprise required apps. Any self-uninstall of these is highest-confidence malicious.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:MDMLog', 'channel': 'application holds device-owner, profile-owner, or delegated app-management authority capable of package removal before uninstall event'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindow', 'description': 'Correlation window between uninstall-capable control, removal action, and app disappearance'}	{'field': 'MDMAgentList', 'description': 'MDM agent packages authorized for managed uninstall. Derive from MDM enrollment policy.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:MDMLog', 'channel': 'application has accessibility service privileges immediately before package-removal UI flow and subsequent application disappearance'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--e905dad2-00d6-477c-97e8-800427abd0e8', 'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: App deletes package files or local state immediately before package inventory disappearance — pre-removal evidence cleanup'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': 'application invokes uninstall-related package-management operations, accessibility-driven uninstall confirmation actions, or privileged file-removal operations immediately before installed-state loss'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--e905dad2-00d6-477c-97e8-800427abd0e8', 'name': 'MobileEDR:telemetry', 'channel': 'application deletes package files, cleanup artifacts, or app-local state immediately before disappearance from installed inventory or runtime'}
x_mitre_mutable_elements	{'field': 'AllowedRemovalApps', 'description': 'Legitimate enterprise or device-management apps allowed to uninstall applications'}
x_mitre_mutable_elements	{'field': 'RemovalAttemptSignalSet', 'description': 'Signals used to recognize uninstall initiation, such as package-removal actions, uninstall intent flows, or accessibility-driven confirmation steps'}
x_mitre_mutable_elements	{'field': 'DisappearanceThreshold', 'description': 'Maximum time between removal action and loss of installed-state visibility'}
x_mitre_mutable_elements	{'field': 'UplinkBytesThreshold', 'description': 'Outbound traffic threshold used to confirm final activity before self-removal'}

[AN1802] Analytic 1802

Current version: 1.1

	Old Description			New Description
t	1	Defender correlates a causal chain where a device transition	t	1	For Android, detect Replication Through Removable Media by c
	>	s into USB debugging or file transfer mode after a physical		>	orrelating analyst-visible device/network evidence and manag
	>	connection event, followed by application installation, file		>	ement state; use streaming or batched telemetry only where t
	>	replication, or execution originating from the USB interfac		>	he documented collector is deployed. Correlate Application P
	>	e rather than the application store ecosystem.		>	ermission via Android Enterprise DPC / Application Vetting [
				>	DevicePolicyManager.getPermissionGrantState(); PackageManage
				>	r manifest/requested-permission review]; File Creation via A
				>	pplication Vetting / Forensic Acquisition [Dynamic filesyste
				>	m trace or acquired app-container/filesystem artifacts: File
				>	with binary signature (.apk, .dex, .so, .sh) written to app
				>	storage or /data/local/tmp/ from USB-mounted path or extern
				>	al storage within $USBInstallWindow$]; Process Creation via
				>	Application Vetting / Managed Device Telemetry [Application
				>	installed with install_source=adb or install_source=sideload
				>	from USB-connected host within $USBInstallWindow$ of USB mo
				>	de change]. Alert on a sequence or state change inconsistent
				>	with the device/app baseline, approved management policy, o
				>	r expected user workflow; do not infer unobserved API calls,
				>	file/process activity, or payload content from management s
				>	tate alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.381000+00:00	2026-10-13 17:42:20.947000+00:00
description	Defender correlates a causal chain where a device transitions into USB debugging or file transfer mode after a physical connection event, followed by application installation, file replication, or execution originating from the USB interface rather than the application store ecosystem.	For Android, detect Replication Through Removable Media by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; File Creation via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: File with binary signature (.apk, .dex, .so, .sh) written to app storage or /data/local/tmp/ from USB-mounted path or external storage within $USBInstallWindow$]; Process Creation via Application Vetting / Managed Device Telemetry [Application installed with install_source=adb or install_source=sideload from USB-connected host within $USBInstallWindow$ of USB mode change]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[1]	{'field': 'AllowedDeveloperDevices', 'description': 'List of devices legitimately allowed to use ADB debugging.'}	{'field': 'AuthorizedDeveloperDevices', 'description': 'Device serial numbers authorized for developer mode (test/dev fleet only). Derive from IT device management. Production devices should have empty list.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--56c2b384-77f8-461f-a71a-76f7888ebfb6', 'name': 'android:MDMLog', 'channel': 'device USB mode change (charging to file transfer / debugging / accessory)'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}
x_mitre_log_source_references[3]	{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'MobileEDR:telemetry', 'channel': 'large file write originating from /mnt/usb or external mounted storage'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--56c2b384-77f8-461f-a71a-76f7888ebfb6', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindow', 'description': 'Correlation window between USB connection state change and application installation.'}	{'field': 'USBInstallWindow', 'description': 'Default 300s between USB mode change and install or file delivery event. Tightening: 60s — synchronous USB delivery.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:MDMLog', 'channel': 'ADB_DEBUGGING_ENABLED'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: File with binary signature (.apk, .dex, .so, .sh) written to app storage or /data/local/tmp/ from USB-mounted path or external storage within $USBInstallWindow$'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'MobileEDR:telemetry', 'channel': 'application installed from adb, sideload, or unknown USB source'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'mobile:DynamicAnalysis', 'channel': 'Application installed with install_source=adb or install_source=sideload from USB-connected host within $USBInstallWindow$ of USB mode change'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_mutable_elements	{'field': 'AllowedSideloadApps', 'description': 'Approved enterprise apps allowed to install outside Google Play.'}
x_mitre_mutable_elements	{'field': 'FileReplicationThreshold', 'description': 'Volume of file writes from mounted external storage considered suspicious.'}

[AN1803] Analytic 1803

Current version: 1.1

	Old Description			New Description
t	1	Defender correlates a chain where a device establishes a new	t	1	For iOS, detect Replication Through Removable Media from doc
	>	trusted USB host pairing or enters developer/debug configur		>	umented management, network, or vetting evidence; treat stat
	>	ation state, followed by device data extraction activity, co		>	e queries as periodic observations rather than real-time eve
	>	nfiguration manipulation, or abnormal application behavior s		>	nts. Correlate Host Status via Apple MDM [DeviceInformation
	>	hortly after the pairing event.		>	/ SecurityInfo / ProfileList / restrictions and compliance q
				>	ueries]; Protected Configuration via Apple MDM [DeviceInform
				>	ation / SecurityInfo / ProfileList / restrictions and compli
				>	ance queries]; System Settings via Apple MDM [DeviceInformat
				>	ion / SecurityInfo / ProfileList / restrictions and complian
				>	ce queries]. Alert on a sequence or state change inconsisten
				>	t with the device/app baseline, approved management policy,
				>	or expected user workflow; do not infer unobserved API calls
				>	, file/process activity, or payload content from management
				>	state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.381000+00:00	2026-10-13 17:42:21.634000+00:00
description	Defender correlates a chain where a device establishes a new trusted USB host pairing or enters developer/debug configuration state, followed by device data extraction activity, configuration manipulation, or abnormal application behavior shortly after the pairing event.	For iOS, detect Replication Through Removable Media from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Host Status via Apple MDM [DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries]; Protected Configuration via Apple MDM [DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries]; System Settings via Apple MDM [DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--85a533a4-5fa4-4dba-b45d-f0717bedd6e6', 'name': 'iOS:MDMLog', 'channel': 'Device risk, compliance, or security posture changes after trusted host pairing or developer-state transition'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--56c2b384-77f8-461f-a71a-76f7888ebfb6', 'name': 'iOS:MDM', 'channel': 'DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries'}
x_mitre_mutable_elements[1]	{'field': 'AllowedTrustedHosts', 'description': 'Enterprise-authorized computers permitted to pair with managed devices.'}	{'field': 'AuthorizedDeveloperDevices', 'description': 'Device serial numbers authorized for developer mode (test/dev fleet only). Derive from IT device management. Production devices should have empty list.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--6c62144a-cd5c-401c-ada9-58c4c74cd9d2', 'name': 'iOS:MDMLog', 'channel': 'Developer Mode enabled, supervised-device restriction changed, or trust-related protected device posture changed'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--85a533a4-5fa4-4dba-b45d-f0717bedd6e6', 'name': 'iOS:MDM', 'channel': 'DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries'}
x_mitre_mutable_elements[0]	{'field': 'PairingEventWindow', 'description': 'Time window between trusted host pairing and suspicious device behavior.'}	{'field': 'USBInstallWindow', 'description': 'Default 300s between USB mode change and install or file delivery event. Tightening: 60s — synchronous USB delivery.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--56c2b384-77f8-461f-a71a-76f7888ebfb6', 'name': 'iOS:MDMLog', 'channel': 'Trusted computer / host relationship established or relevant device trust setting changed'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--6c62144a-cd5c-401c-ada9-58c4c74cd9d2', 'name': 'iOS:MDM', 'channel': 'DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': 'Observed device-service, trust-service, backup/service interaction, or other privileged framework activity associated with physical host access'}
x_mitre_mutable_elements	{'field': 'DeveloperModePolicy', 'description': 'Whether developer mode is permitted in the organization.'}

[AN1804] Analytic 1804

Current version: 1.1

	Old Description			New Description
t	1	Defender observes an app/package attempting to enumerate run	t	1	For Android, detect Process Discovery by correlating analyst
	>	ning processes by triggering restricted process visibility m		>	-visible device/network evidence and management state; use s
	>	echanisms (e.g., repeated queries for running tasks/services		>	treaming or batched telemetry only where the documented coll
	>	, rapid iteration over process identifiers, or access attemp		>	ector is deployed. Correlate File Access via Application Vet
	>	ts against /proc entries) that are atypical for its declared		>	ting / Forensic Acquisition [Dynamic filesystem trace or acq
	>	function and occur without an associated user-facing diagno		>	uired app-container/filesystem artifacts: opendir('/proc/')
	>	stic workflow. The detection relies on correlating (1) OS/AP		>	with recursive listdir by app NOT IN $ProcessDiscoveryAllowL
	>	I calls or shell/system utility execution indicative of proc		>	ist$ on device with android_version < $HidepidVersion$]; Net
	>	ess listing or /proc traversal, (2) app privilege context (r		>	work Connection Creation via Android Enterprise Network Logg
	>	oot, debug build, device owner/profile owner, accessibility/		>	ing / Enterprise VPN [DevicePolicyManager.retrieveNetworkLog
	>	IME status), (3) background execution state, and (4) optiona		>	s(): DnsEvent / ConnectEvent; VPN flow metadata]; Process Me
	>	l follow-on behaviors consistent with automated discovery (s		>	tadata via Application Vetting / Instrumented Dynamic Analys
	>	hort bursts of local IPC probes, network beacons immediately		>	is [Dynamic API/runtime trace: running process names read fr
	>	after enumeration, or rapid targeting of specific high-valu		>	om /proc/<PID>/status or /proc/<PID>/cmdline by app NOT IN $
	>	e package/process names). The analytic should describe what		>	ProcessDiscoveryAllowList$]. Alert on a sequence or state ch
	>	is observable: repeated enumeration signals + privilege cont		>	ange inconsistent with the device/app baseline, approved man
	>	ext + timing relationship, not the adversary’s intent.		>	agement policy, or expected user workflow; do not infer unob
				>	served API calls, file/process activity, or payload content
				>	from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.378000+00:00	2026-10-13 17:41:20.904000+00:00
description	Defender observes an app/package attempting to enumerate running processes by triggering restricted process visibility mechanisms (e.g., repeated queries for running tasks/services, rapid iteration over process identifiers, or access attempts against /proc entries) that are atypical for its declared function and occur without an associated user-facing diagnostic workflow. The detection relies on correlating (1) OS/API calls or shell/system utility execution indicative of process listing or /proc traversal, (2) app privilege context (root, debug build, device owner/profile owner, accessibility/IME status), (3) background execution state, and (4) optional follow-on behaviors consistent with automated discovery (short bursts of local IPC probes, network beacons immediately after enumeration, or rapid targeting of specific high-value package/process names). The analytic should describe what is observable: repeated enumeration signals + privilege context + timing relationship, not the adversary’s intent.	For Android, detect Process Discovery by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate File Access via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: opendir('/proc/') with recursive listdir by app NOT IN $ProcessDiscoveryAllowList$ on device with android_version < $HidepidVersion$]; Network Connection Creation via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]; Process Metadata via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: running process names read from /proc//status or /proc//cmdline by app NOT IN $ProcessDiscoveryAllowList$]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[3]	{'field': 'BackgroundOnly', 'description': 'If true, require background state to reduce legitimate in-app diagnostics noise.'}	{'field': 'FollowOnWindow', 'description': 'Default 120s.'}
x_mitre_mutable_elements[1]	{'field': 'MinEnumerationSignals', 'description': 'Minimum count of process enumeration indicators to alert (tune by OS build and telemetry quality).'}	{'field': 'HidepidVersion', 'description': '7.0 (Nougat) — hidepid enabled. Derive from MDM OS version telemetry.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'android:logcat', 'channel': 'repeated queries or dumps related to running tasks/services/process state by same package/UID (e.g., getRunningAppProcesses, running services/task inspection)'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--235b7491-2d2b-4617-9a52-3c0783680f71', 'name': 'mobile:ForensicArtifacts', 'channel': "Dynamic filesystem trace or acquired app-container/filesystem artifacts: opendir('/proc/') with recursive listdir by app NOT IN $ProcessDiscoveryAllowList$ on device with android_version < $HidepidVersion$"}
x_mitre_mutable_elements[0]	{'field': 'TimeWindowSeconds', 'description': 'Correlation window for enumeration → follow-on activity (e.g., 60–600s).'}	{'field': 'ProcessDiscoveryAllowList', 'description': 'System diagnostic tools, MDM agent. Minimal.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'android:logcat', 'channel': 'unexpected spikes in fork/exec/app process start events for helper utilities used for enumeration (ps, toybox/toolbox variants) from same UID'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba', 'name': 'android:EnterpriseNetworkLog', 'channel': 'DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata'}
x_mitre_mutable_elements[2]	{'field': 'ProcTraversalThreshold', 'description': 'How many distinct /proc paths opened within the window counts as enumeration (e.g., ≥50).'}	{'field': 'AppCDNList', 'description': 'Per-app CDN. Derive by measurement.'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--235b7491-2d2b-4617-9a52-3c0783680f71', 'name': 'auditd:SYSCALL', 'channel': 'attempts to read /proc/* entries at scale (openat/getdents64/readlink) or access denied for /proc traversal; correlate to app UID'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--ee575f4a-2d4f-48f6-b18b-89067760adc1', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: running process names read from /proc//status or /proc//cmdline by app NOT IN $ProcessDiscoveryAllowList$'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_mutable_elements	{'field': 'AllowlistedPackages', 'description': 'Legitimate security/diagnostic/MDM agents expected to inspect processes.'}
x_mitre_mutable_elements	{'field': 'HighValueProcessNames', 'description': 'Process/package names of interest (e.g., security agents, banking apps) used only as enrichment, not a signature.'}
x_mitre_mutable_elements	{'field': 'NetworkProbePorts', 'description': 'Ports considered a ‘probe/beacon’ after enumeration (53/80/443/etc.).'}
x_mitre_mutable_elements	{'field': 'PrivilegeEscalationGate', 'description': 'If true, increase severity when enumeration co-occurs with root/debuggable/jailbreak-like posture.'}

[AN1805] Analytic 1805

Current version: 1.1

	Old Description			New Description
t	1	Defender observes signals consistent with attempted process	t	1	For iOS, detect Process Discovery by correlating analyst-vis
	>	listing on iOS where modern OS protections generally prevent		>	ible device/network evidence and management state; use strea
	>	broad process enumeration for non-root apps. Detections the		>	ming or batched telemetry only where the documented collecto
	>	refore focus on: (1) feasibility gating via integrity/jailbr		>	r is deployed. Correlate Application State via Apple MDM [In
	>	eak posture, and (2) observable security/log anomalies consi		>	stalledApplicationList / ManagedApplicationList]; Host Statu
	>	stent with attempts to query process tables or restricted sy		>	s via Apple MDM [DeviceInformation / SecurityInfo / ProfileL
	>	stem interfaces (e.g., repeated sandbox denials, suspicious		>	ist / restrictions and compliance queries]; Network Traffic
	>	sysctl-like access attempts, or abnormal use of private fram		>	Flow via Apple Network Extension / Enterprise VPN [NEFilterF
	>	eworks). Correlate integrity compromise indicators with repe		>	low / per-app VPN / secure-web-gateway flow metadata]. Alert
	>	ated restricted-access events and optional follow-on behavio		>	on a sequence or state change inconsistent with the device/
	>	rs (rapid targeting of specific bundles/services or immediat		>	app baseline, approved management policy, or expected user w
	>	e network beacons) to raise confidence that process discover		>	orkflow; do not infer unobserved API calls, file/process act
	>	y is occurring.		>	ivity, or payload content from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.378000+00:00	2026-10-13 17:41:21.536000+00:00
description	Defender observes signals consistent with attempted process listing on iOS where modern OS protections generally prevent broad process enumeration for non-root apps. Detections therefore focus on: (1) feasibility gating via integrity/jailbreak posture, and (2) observable security/log anomalies consistent with attempts to query process tables or restricted system interfaces (e.g., repeated sandbox denials, suspicious sysctl-like access attempts, or abnormal use of private frameworks). Correlate integrity compromise indicators with repeated restricted-access events and optional follow-on behaviors (rapid targeting of specific bundles/services or immediate network beacons) to raise confidence that process discovery is occurring.	For iOS, detect Process Discovery by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application State via Apple MDM [InstalledApplicationList / ManagedApplicationList]; Host Status via Apple MDM [DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries]; Network Traffic Flow via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--85a533a4-5fa4-4dba-b45d-f0717bedd6e6', 'name': 'MDM:DeviceIntegrity', 'channel': 'jailbreak/root compromise indicators or integrity attestation failures enabling process visibility'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'iOS:MDM', 'channel': 'InstalledApplicationList / ManagedApplicationList'}
x_mitre_mutable_elements[0]	{'field': 'IntegritySignalRequired', 'description': 'If true, alert only when integrity/jailbreak posture indicates process discovery is feasible.'}	{'field': 'GuardrailWindow', 'description': 'Default 300s — time in which C2 expected post-jailbreak on non-managed device.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'iOS:unifiedlog', 'channel': 'repeated sandbox denials related to restricted process/system interfaces consistent with process-table querying attempts'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--85a533a4-5fa4-4dba-b45d-f0717bedd6e6', 'name': 'iOS:MDM', 'channel': 'DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'iOS:unifiedlog', 'channel': 'security-relevant kernel log messages indicating restricted system interface access attempts by app process (device-dependent visibility)'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'iOS:NetworkExtension', 'channel': 'NEFilterFlow / per-app VPN / secure-web-gateway flow metadata'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_mutable_elements	{'field': 'MinSandboxDenials', 'description': 'Threshold for sandbox denials within a window to treat as sustained restricted-access attempts.'}
x_mitre_mutable_elements	{'field': 'TimeWindowSeconds', 'description': 'Correlation window between integrity signals and sandbox/network events (e.g., 1–24 hours).'}
x_mitre_mutable_elements	{'field': 'AllowlistedBundles', 'description': 'Enterprise monitoring/networking apps that may generate benign sandbox noise.'}

[AN1806] Analytic 1806

Current version: 1.1

	Old Description			New Description
t	1	Correlates (1) application acquisition or use of elevated co	t	1	For Android, detect Disable or Modify Tools from documented
	>	ntrol paths capable of altering defensive tooling or protect		>	management, network, or vetting evidence; treat state querie
	>	ed system state, such as device administration, root-enabled		>	s as periodic observations rather than real-time events. Cor
	>	modification, or security-setting manipulation, (2) direct		>	relate Application Permission via Android Enterprise DPC / A
	>	changes to security-tool configuration, service state, packa		>	pplication Vetting [DevicePolicyManager.getPermissionGrantSt
	>	ge state, or protected enforcement settings such as SELinux-		>	ate(); PackageManager manifest/requested-permission review];
	>	relevant files or security-app components, and (3) immediate		>	File Creation via Application Vetting / Forensic Acquisitio
	>	degradation, suppression, or disappearance of expected secu		>	n [Dynamic filesystem trace or acquired app-container/filesy
	>	rity telemetry while the device and initiating application r		>	stem artifacts: App writes to or modifies protected configur
	>	emain active. The defender observes a causal chain where a s		>	ation files or local control structures of deployed security
	>	ecurity control is modified first, then monitoring or protec		>	tools]; OS API Execution via Application Vetting / Instrume
	>	tion weakens, and subsequent activity continues under reduce		>	nted Dynamic Analysis [Dynamic API/runtime trace: App invoke
	>	d defensive visibility.		>	s package manager operations (disable component, clear data,
				>	request uninstall) or settings modifications targeting secu
				>	rity tool packages IN $SecurityToolPackageList$]. Alert on a
				>	sequence or state change inconsistent with the device/app b
				>	aseline, approved management policy, or expected user workfl
				>	ow; do not infer unobserved API calls, file/process activity
				>	, or payload content from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.379000+00:00	2026-10-13 17:42:50.241000+00:00
description	Correlates (1) application acquisition or use of elevated control paths capable of altering defensive tooling or protected system state, such as device administration, root-enabled modification, or security-setting manipulation, (2) direct changes to security-tool configuration, service state, package state, or protected enforcement settings such as SELinux-relevant files or security-app components, and (3) immediate degradation, suppression, or disappearance of expected security telemetry while the device and initiating application remain active. The defender observes a causal chain where a security control is modified first, then monitoring or protection weakens, and subsequent activity continues under reduced defensive visibility.	For Android, detect Disable or Modify Tools from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; File Creation via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: App writes to or modifies protected configuration files or local control structures of deployed security tools]; OS API Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: App invokes package manager operations (disable component, clear data, request uninstall) or settings modifications targeting security tool packages IN $SecurityToolPackageList$]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': 'application invokes package, settings, or privileged framework operations capable of disabling security software, altering security enforcement, or interfering with reporting before telemetry loss'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes package manager operations (disable component, clear data, request uninstall) or settings modifications targeting security tool packages IN $SecurityToolPackageList$'}
x_mitre_mutable_elements[1]	{'field': 'CriticalToolSet', 'description': 'Security-relevant applications or components expected to remain enabled and reporting, such as mobile EDR, Play Protect-associated controls, or agent services'}	{'field': 'ElevationAllowList', 'description': 'MDM agent only for legitimate Device Admin operations against security tools.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:MDMLog', 'channel': 'device posture changes to rooted, non-compliant, weakened security state, or elevated control role becomes active before security-tool degradation'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindow', 'description': 'Correlation window between security-setting change, tool degradation, and subsequent continued activity'}	{'field': 'SecurityToolPackageList', 'description': 'MDM agent, MTD (Zimperium, Lookout, MS Defender), AV packages deployed on managed fleet. Derive from MDM enrollment configuration. Update when new tools deployed.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:MDMLog', 'channel': 'security-relevant application package state, enabled status, administrator state, or managed protection setting changes immediately before monitoring degradation'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: App writes to or modifies protected configuration files or local control structures of deployed security tools'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'MobileEDR:telemetry', 'channel': 'application modifies protected configuration, local control files, security settings, or tool-related data immediately before security service degradation or non-reporting state'}
x_mitre_mutable_elements	{'field': 'TelemetryGapThreshold', 'description': 'Duration or volume threshold defining abnormal loss of expected security telemetry'}
x_mitre_mutable_elements	{'field': 'ProtectedSettingSet', 'description': 'Protected settings or files treated as suspicious if modified, including SELinux-relevant enforcement state or security-app configuration'}
x_mitre_mutable_elements	{'field': 'AllowedAdminApps', 'description': 'Legitimate applications or management agents allowed to modify security-relevant posture'}
x_mitre_mutable_elements	{'field': 'UplinkBytesThreshold', 'description': 'Outbound traffic threshold used to confirm continued meaningful activity during reduced defensive visibility'}

[AN1807] Analytic 1807

Current version: 1.1

	Old Description			New Description
t	1	Correlates (1) abnormal application or system resource resol	t	1	For Android, detect Hijack Execution Flow from documented ma
	>	ution behavior (e.g., library loading, path resolution, or i		>	nagement, network, or vetting evidence; treat state queries
	>	ntent redirection), (2) execution of code or resources not a		>	as periodic observations rather than real-time events. Corre
	>	ligned with the originating application’s package identity o		>	late File Access via Application Vetting / Forensic Acquisit
	>	r expected runtime context, and (3) follow-on execution or n		>	ion [Dynamic filesystem trace or acquired app-container/file
	>	etwork activity originating from the hijacked flow. The defe		>	system artifacts: App loads executable or library from writa
	>	nder observes a causal chain where execution is redirected f		>	ble external directory (/sdcard/, app cache, /data/local/tmp
	>	rom an expected code path to an alternate resource or payloa		>	/) — writable-path library load is exploitable hijack vector
	>	d, resulting in execution under a trusted context but with u		>	]; OS API Execution via Application Vetting / Instrumented D
	>	ntrusted origin.		>	ynamic Analysis [Dynamic API/runtime trace: App loads librar
				>	y or executes component]; Process Creation via Application V
				>	etting / Managed Device Telemetry [App execution triggered w
				>	ith unexpected parent context or via indirect invocation (in
				>	tent redirect, implicit intent resolution to unexpected hand
				>	ler) — indirect invocation path is the flow hijack confirmat
				>	ion]. Alert on a sequence or state change inconsistent with
				>	the device/app baseline, approved management policy, or expe
				>	cted user workflow; do not infer unobserved API calls, file/
				>	process activity, or payload content from management state a
				>	lone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.375000+00:00	2026-10-13 17:42:45.356000+00:00
description	Correlates (1) abnormal application or system resource resolution behavior (e.g., library loading, path resolution, or intent redirection), (2) execution of code or resources not aligned with the originating application’s package identity or expected runtime context, and (3) follow-on execution or network activity originating from the hijacked flow. The defender observes a causal chain where execution is redirected from an expected code path to an alternate resource or payload, resulting in execution under a trusted context but with untrusted origin.	For Android, detect Hijack Execution Flow from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate File Access via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: App loads executable or library from writable external directory (/sdcard/, app cache, /data/local/tmp/) — writable-path library load is exploitable hijack vector]; OS API Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: App loads library or executes component]; Process Creation via Application Vetting / Managed Device Telemetry [App execution triggered with unexpected parent context or via indirect invocation (intent redirect, implicit intent resolution to unexpected handler) — indirect invocation path is the flow hijack confirmation]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'MobileEDR:telemetry', 'channel': 'application execution triggered with unexpected parent context or via indirect invocation (intent redirection or component hijack)'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'mobile:DynamicAnalysis', 'channel': 'App execution triggered with unexpected parent context or via indirect invocation (intent redirect, implicit intent resolution to unexpected handler) — indirect invocation path is the flow hijack confirmation'}
x_mitre_mutable_elements[1]	{'field': 'AllowedLibraryPaths', 'description': 'Baseline of expected library/resource load paths per application'}	{'field': 'WritablePathList', 'description': '/sdcard/, /data/local/tmp/, /data/data//files/ — directories writable without elevated privilege that are exploitable for library substitution.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': 'application launches or executes code where loaded library or component path does not match application package path or expected signing context'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--235b7491-2d2b-4617-9a52-3c0783680f71', 'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: App loads executable or library from writable external directory (/sdcard/, app cache, /data/local/tmp/) — writable-path library load is exploitable hijack vector'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindow', 'description': 'Correlation window between abnormal resource loading and execution/network activity'}	{'field': 'AppInternalPaths', 'description': 'Expected library load paths per app: /data/app//lib/, /data/dalvik-cache/. Derive from app package manifest and baseline measurement. Any library loaded from outside these paths is anomalous.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--235b7491-2d2b-4617-9a52-3c0783680f71', 'name': 'MobileEDR:telemetry', 'channel': 'application loads executable or library from external or writable directory (e.g., /sdcard/, app cache) prior to execution'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App loads library or executes component'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_mutable_elements	{'field': 'TrustedSignatureList', 'description': 'Trusted signing identities for application components'}
x_mitre_mutable_elements	{'field': 'AllowedAppList', 'description': 'Applications allowed to dynamically load code or use external resources'}

[AN1812] Analytic 1812

Current version: 1.1

	Old Description			New Description
t	1	A defender correlates an application being granted accessibi	t	1	For Android, detect Abuse Accessibility Features by correlat
	>	lity service control with subsequent consumption of high-vol		>	ing analyst-visible device/network evidence and management s
	>	ume accessibility events, interaction with sensitive UI elem		>	tate; use streaming or batched telemetry only where the docu
	>	ents or text-entry fields, optional overlay/window presentat		>	mented collector is deployed. Correlate API Calls via Applic
	>	ion over other applications, and near-term local buffering o		>	ation Vetting / Instrumented Dynamic Analysis [Dynamic API/r
	>	r outbound network transmission, indicating abuse of accessi		>	untime trace: AccessibilityService receiving events from dc(
	>	bility features for input capture, credential theft, or auto		>	source_app) > $AccessibilityTargetThreshold$ distinct apps I
	>	mated interaction.		>	NCLUDING apps IN $TargetAppList$ — broad monitoring across a
				>	pps distinguishes malware from single-purpose assistive tech
				>	]; Network Traffic Content via Enterprise Secure Web Gateway
				>	/ Proxy [DNS/HTTP(S) inspection or proxy transaction metada
				>	ta where enterprise decryption/inspection is deployed]; Perm
				>	issions Request via Android Enterprise DPC / Application Vet
				>	ting [DevicePolicyManager.getPermissionGrantState(); Package
				>	Manager manifest/requested-permission review]. Alert on a se
				>	quence or state change inconsistent with the device/app base
				>	line, approved management policy, or expected user workflow;
				>	do not infer unobserved API calls, file/process activity, o
				>	r payload content from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.379000+00:00	2026-10-13 17:41:31.989000+00:00
description	A defender correlates an application being granted accessibility service control with subsequent consumption of high-volume accessibility events, interaction with sensitive UI elements or text-entry fields, optional overlay/window presentation over other applications, and near-term local buffering or outbound network transmission, indicating abuse of accessibility features for input capture, credential theft, or automated interaction.	For Android, detect Abuse Accessibility Features by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: AccessibilityService receiving events from dc(source_app) > $AccessibilityTargetThreshold$ distinct apps INCLUDING apps IN $TargetAppList$ — broad monitoring across apps distinguishes malware from single-purpose assistive tech]; Network Traffic Content via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed]; Permissions Request via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[3]	{'field': 'OverlayCorrelationWindow', 'description': 'Time window correlating accessibility activity with overlay/window presentation over other apps.'}	{'field': 'AppCDNList', 'description': 'Per-app CDN. Derive by measurement.'}
x_mitre_mutable_elements[1]	{'field': 'AccessibilityEventRateThreshold', 'description': 'Threshold for event volume or sustained event consumption indicating broad UI monitoring rather than limited assistive use.'}	{'field': 'AccessibilityTargetThreshold', 'description': 'Default 5 distinct source apps — monitors broadly vs narrowly.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--56c2b384-77f8-461f-a71a-76f7888ebfb6', 'name': 'MobileEDR:telemetry', 'channel': 'Application remains backgrounded while accessibility service continues to receive events or perform actions across other foreground apps'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: AccessibilityService receiving events from dc(source_app) > $AccessibilityTargetThreshold$ distinct apps INCLUDING apps IN $TargetAppList$ — broad monitoring across apps distinguishes malware from single-purpose assistive tech'}
x_mitre_mutable_elements[0]	{'field': 'AllowedAccessibilityApps', 'description': 'Allow-list of sanctioned accessibility-enabled apps in the environment, such as screen readers or approved assistive tools.'}	{'field': 'AccessibilityAllowList', 'description': 'Approved screen readers, assistive tech. Minimal. Derive from MDM catalog.'}
x_mitre_mutable_elements[2]	{'field': 'SensitiveFieldCorrelationRequired', 'description': 'Determines whether detection should require correlation to text-entry fields, login screens, or password/credential UI contexts.'}	{'field': 'TargetAppList', 'description': 'Banking, auth, enterprise SSO, SMS app packages.'}
x_mitre_mutable_elements[4]	{'field': 'AccessibilityToNetworkWindow', 'description': 'Time window linking accessibility event capture or text change activity to outbound network communication.'}	{'field': 'AccessibilityExfilWindow', 'description': 'Default 300s.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': 'Accessibility framework usage patterns such as event subscription, performAction invocation, node traversal, text change observation, or overlay/window presentation correlated to app identity'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'webproxy:applog', 'channel': 'DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--e2f72131-14d1-411f-8e8c-aa3453dd5456', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_mutable_elements	{'field': 'BackgroundServiceAllowed', 'description': 'Tuning for whether background accessibility service activity is expected for approved assistive tools.'}
x_mitre_mutable_elements	{'field': 'UplinkBytesThreshold', 'description': 'Minimum outbound byte volume or burst count considered suspicious after accessibility event capture.'}

[AN1815] Analytic 1815

Current version: 1.1

	Old Description			New Description
t	1	Correlates (1) continuous or repeated use of motion or inter	t	1	For Android, detect User Evasion from documented management,
	>	action-inference signals that do not require overt user-faci		>	network, or vetting evidence; treat state queries as period
	>	ng privilege prompts, (2) suppression of higher-risk behavio		>	ic observations rather than real-time events. Correlate Appl
	>	r while user presence or active handling is inferred, and (3		>	ication State via Android Enterprise / EMM [Managed package
	>	) resumption of background execution, sensor use, local data		>	inventory/status and package metadata]; OS API Execution via
	>	handling, or network activity only when device interaction		>	Application Vetting / Instrumented Dynamic Analysis [Dynami
	>	falls below a threshold. The defender observes a causal chai		>	c API/runtime trace: App invokes SensorManager.registerListe
	>	n where an application senses user/device interaction state		>	ner() for TYPE_ACCELEROMETER or TYPE_GYROSCOPE NOT IN $Appro
	>	and intentionally gates malicious behavior to user-inactive		>	vedMotionApps$ followed by conditional execution branching c
	>	periods.		>	orrelated with sensor readings — motion sensing followed by
				>	behavioral conditiona]. Alert on a sequence or state change
				>	inconsistent with the device/app baseline, approved manageme
				>	nt policy, or expected user workflow; do not infer unobserve
				>	d API calls, file/process activity, or payload content from
				>	management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.379000+00:00	2026-10-13 17:42:40.930000+00:00
description	Correlates (1) continuous or repeated use of motion or interaction-inference signals that do not require overt user-facing privilege prompts, (2) suppression of higher-risk behavior while user presence or active handling is inferred, and (3) resumption of background execution, sensor use, local data handling, or network activity only when device interaction falls below a threshold. The defender observes a causal chain where an application senses user/device interaction state and intentionally gates malicious behavior to user-inactive periods.	For Android, detect User Evasion from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Application State via Android Enterprise / EMM [Managed package inventory/status and package metadata]; OS API Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: App invokes SensorManager.registerListener() for TYPE_ACCELEROMETER or TYPE_GYROSCOPE NOT IN $ApprovedMotionApps$ followed by conditional execution branching correlated with sensor readings — motion sensing followed by behavioral conditiona]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': 'application invokes motion-sensor or device-activity framework operations followed by conditional execution of sensitive framework activity only after inferred user absence'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'android:EMM', 'channel': 'Managed package inventory/status and package metadata'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'MobileEDR:telemetry', 'channel': 'application reduces or halts operational activity during periods of active user interaction and resumes background execution or periodic work only during low-motion or idle intervals'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes SensorManager.registerListener() for TYPE_ACCELEROMETER or TYPE_GYROSCOPE NOT IN $ApprovedMotionApps$ followed by conditional execution branching correlated with sensor readings — motion sensing followed by behavioral conditiona'}

[AN1816] Analytic 1816

Current version: 1.1

	Old Description			New Description
t	1	The defender correlates repeated inbound retrieval and outbo	t	1	For Android, detect Bidirectional Communication by correlati
	>	und submission activity by the same Android app identity to		>	ng analyst-visible device/network evidence and management st
	>	the same legitimate public web-service class within a short		>	ate; use streaming or batched telemetry only where the docum
	>	operational window, where the two-way exchange is inconsiste		>	ented collector is deployed. Correlate Application Permissio
	>	nt with the app's approved role, interaction model, or backg		>	n via Android Enterprise DPC / Application Vetting [DevicePo
	>	round behavior baseline. The strongest Android evidence is a		>	licyManager.getPermissionGrantState(); PackageManager manife
	>	pp-attributed communication to collaboration, social, cloud		>	st/requested-permission review]; Application State via Andro
	>	storage, code-hosting, messaging, or generic HTTPS platforms		>	id Enterprise / EMM [Managed package inventory/status and pa
	>	where requests that retrieve content are followed by app-at		>	ckage metadata]; File Creation via Application Vetting / For
	>	tributed posts, uploads, document updates, API writes, or re		>	ensic Acquisition [Dynamic filesystem trace or acquired app-
	>	peated small bidirectional exchanges, especially when they o		>	container/filesystem artifacts: Local file write between inb
	>	ccur while the app is backgrounded, while the device is lock		>	ound retrieval]. Alert on a sequence or state change inconsi
	>	ed, without recent user interaction, or shortly after local		>	stent with the device/app baseline, approved management poli
	>	staging or protected-resource access.		>	cy, or expected user workflow; do not infer unobserved API c
				>	alls, file/process activity, or payload content from managem
				>	ent state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.376000+00:00	2026-10-13 17:40:56.193000+00:00
description	The defender correlates repeated inbound retrieval and outbound submission activity by the same Android app identity to the same legitimate public web-service class within a short operational window, where the two-way exchange is inconsistent with the app's approved role, interaction model, or background behavior baseline. The strongest Android evidence is app-attributed communication to collaboration, social, cloud storage, code-hosting, messaging, or generic HTTPS platforms where requests that retrieve content are followed by app-attributed posts, uploads, document updates, API writes, or repeated small bidirectional exchanges, especially when they occur while the app is backgrounded, while the device is locked, without recent user interaction, or shortly after local staging or protected-resource access.	For Android, detect Bidirectional Communication by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; Application State via Android Enterprise / EMM [Managed package inventory/status and package metadata]; File Creation via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: Local file write between inbound retrieval]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[3]	{'field': 'AllowedReadWriteMappings', 'description': 'Defines which apps are expected to both retrieve and submit content to a given public service class.'}	{'field': 'ObservationWindow', 'description': 'Default 3600s.'}
x_mitre_mutable_elements[1]	{'field': 'AllowedAppList', 'description': 'Approved app identities vary by organization, business unit, and device group.'}	{'field': 'BidirectionalCycleWindow', 'description': 'Default 120s between inbound retrieval and outbound write constituting one C2 cycle. Tightening: 30s.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'VPN:MobileProxy', 'channel': 'App-attributed session to public web-service domain included inbound content retrieval followed by outbound POST, PUT, upload, comment, message send, document update, or API write to same service class within TimeWindow'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}
x_mitre_log_source_references[4]	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'MobileEDR:telemetry', 'channel': 'DeviceLockState=locked during inbound retrieval and subsequent outbound write sequence to public web-service platform'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Background scheduler or persistent service triggers retrieve-then-write cycle'}
x_mitre_log_source_references[3]	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'MobileEDR:telemetry', 'channel': 'AppState=background when bidirectional exchange with public web-service domain began and no foreground transition occurred between retrieval and outbound write'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'webproxy:applog', 'channel': 'DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindow', 'description': 'Correlation window between retrieval and outbound write over the same web-service class.'}	{'field': 'ApprovedPlatformApps', 'description': 'Apps approved for bidirectional use of each platform: note-taking app for its own cloud, email app for its service. Non-platform apps doing read-then-write cycles are anomalous.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'VPN:MobileProxy', 'channel': 'Repeated alternating inbound and outbound sessions to same public web-service domain or API endpoint occurred from same app identity with stable recurrence interval'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'android:EMM', 'channel': 'Managed package inventory/status and package metadata'}
x_mitre_mutable_elements[2]	{'field': 'AllowedServiceClasses', 'description': 'Some apps legitimately perform read/write operations against collaboration, storage, or messaging services.'}	{'field': 'CycleCountThreshold', 'description': 'Default 3 retrieve-write cycles within $ObservationWindow$. Single cycle may be legitimate; repeated cycles are C2 pattern.'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'VPN:MobileProxy', 'channel': 'Outbound write operation to public web-service domain occurred after small inbound response retrieval from same domain or service class without preceding user-visible foreground activity'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: Local file write between inbound retrieval'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'MobileEDR:telemetry', 'channel': 'LastUserInteractionDelta exceeded threshold before retrieve-then-write exchange to public web-service domain from same app identity'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'MobileEDR:telemetry', 'channel': 'Burst write to cache, buffer, temp, staging, or export path occurred between inbound retrieval and outbound write to same public web-service class'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': 'Background work scheduler, job execution, foreground-service start, or persistent service activation immediately preceded retrieve-then-write exchange with public web-service platform'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:MDMLog', 'channel': 'App identity performing bidirectional exchange was unmanaged, outside approved app baseline, or not permitted to use detected public web-service class for read/write operations'}
x_mitre_mutable_elements	{'field': 'RecentUserInteractionWindow', 'description': 'Defines how close the bidirectional exchange must be to user activity to be considered expected.'}
x_mitre_mutable_elements	{'field': 'BeaconIntervalTolerance', 'description': 'Allowed recurrence interval for repeated bidirectional exchanges varies by app type.'}
x_mitre_mutable_elements	{'field': 'ForegroundStateRequired', 'description': 'Some apps should only perform read/write web interactions while foregrounded.'}
x_mitre_mutable_elements	{'field': 'InboundOutboundRatioThreshold', 'description': 'Expected ratio of response size to outbound write size varies by legitimate app workflow.'}

[AN1817] Analytic 1817

Current version: 1.1

	Old Description			New Description
t	1	The defender correlates repeated retrieval and outbound subm	t	1	For iOS, detect Bidirectional Communication by correlating a
	>	ission activity from a supervised device or managed iOS app		>	nalyst-visible device/network evidence and management state;
	>	to the same legitimate public web-service class where the tw		>	use streaming or batched telemetry only where the documente
	>	o-way exchange does not fit the bundle's approved role or ex		>	d collector is deployed. Correlate Application Permission vi
	>	pected background-refresh model. The strongest iOS evidence		>	a Application Vetting [Code-signing entitlements and Info.pl
	>	is managed-app or device-attributed communication to collabo		>	ist privacy usage-description keys]; Application State via A
	>	ration, storage, messaging, social, or generic HTTPS platfor		>	pple MDM [InstalledApplicationList / ManagedApplicationList]
	>	ms where inbound content fetches are followed by outbound wr		>	; Network Traffic Content via Enterprise Secure Web Gateway
	>	ites, uploads, updates, or message submissions within a shor		>	/ Proxy [DNS/HTTP(S) inspection or proxy transaction metadat
	>	t window, especially when occurring during background refres		>	a where enterprise decryption/inspection is deployed]. Alert
	>	h, while the device is locked, or without recent user intera		>	on a sequence or state change inconsistent with the device/
	>	ction. Because direct local runtime visibility is weaker tha		>	app baseline, approved management policy, or expected user w
	>	n Android, the primary analytic is anchored on network direc		>	orkflow; do not infer unobserved API calls, file/process act
	>	tionality plus supervised managed-app and device-state conte		>	ivity, or payload content from management state alone.
	>	xt.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.382000+00:00	2026-10-13 17:40:57.126000+00:00
description	The defender correlates repeated retrieval and outbound submission activity from a supervised device or managed iOS app to the same legitimate public web-service class where the two-way exchange does not fit the bundle's approved role or expected background-refresh model. The strongest iOS evidence is managed-app or device-attributed communication to collaboration, storage, messaging, social, or generic HTTPS platforms where inbound content fetches are followed by outbound writes, uploads, updates, or message submissions within a short window, especially when occurring during background refresh, while the device is locked, or without recent user interaction. Because direct local runtime visibility is weaker than Android, the primary analytic is anchored on network directionality plus supervised managed-app and device-state context.	For iOS, detect Bidirectional Communication by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]; Application State via Apple MDM [InstalledApplicationList / ManagedApplicationList]; Network Traffic Content via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[3]	{'field': 'AllowedServiceClasses', 'description': 'Some managed apps legitimately perform bidirectional exchanges with collaboration, storage, or messaging services.'}	{'field': 'ObservationWindow', 'description': 'Default 3600s.'}
x_mitre_mutable_elements[1]	{'field': 'SupervisedRequired', 'description': 'Strongest app-governance and bundle-baseline analytics depend on supervised iOS devices.'}	{'field': 'BidirectionalCycleWindow', 'description': 'Default 120s between inbound retrieval and outbound write constituting one C2 cycle. Tightening: 30s.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'VPN:MobileProxy', 'channel': 'App-attributed session to public web-service domain included inbound content retrieval followed by outbound POST, PUT, upload, comment, message send, document update, or API write to same service class within TimeWindow'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'mobile:ApplicationVetting', 'channel': 'Code-signing entitlements and Info.plist privacy usage-description keys'}
x_mitre_log_source_references[3]	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'MobileEDR:telemetry', 'channel': 'DeviceLockState=locked during inbound retrieval and subsequent outbound write sequence to public web-service platform'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Background task activation immediately before retrieve-then-write cycle on supervised device'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindow', 'description': 'Correlation window between retrieval and outbound write over the same public web-service class.'}	{'field': 'ApprovedPlatformApps', 'description': 'Apps approved for bidirectional use of each platform: note-taking app for its own cloud, email app for its service. Non-platform apps doing read-then-write cycles are anomalous.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'VPN:MobileProxy', 'channel': 'Repeated alternating inbound and outbound sessions to same public web-service domain or API endpoint occurred from same app identity with stable recurrence interval'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'iOS:MDM', 'channel': 'InstalledApplicationList / ManagedApplicationList'}
x_mitre_mutable_elements[2]	{'field': 'AllowedManagedApps', 'description': 'Approved managed bundle identities vary by organization and device profile.'}	{'field': 'CycleCountThreshold', 'description': 'Default 3 retrieve-write cycles within $ObservationWindow$. Single cycle may be legitimate; repeated cycles are C2 pattern.'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'VPN:MobileProxy', 'channel': 'Outbound write operation to public web-service domain occurred after small inbound response retrieval from same domain or service class without preceding user-visible foreground activity'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'webproxy:applog', 'channel': 'DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'MobileEDR:telemetry', 'channel': 'LastUserInteractionDelta exceeded threshold before retrieve-then-write exchange to public web-service domain from same app identity'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'MobileEDR:telemetry', 'channel': 'BackgroundRefresh or background activity was active when retrieve-then-write exchange with public web-service domain occurred'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'iOS:MDMLog', 'channel': 'Bundle performing bidirectional exchange was not present in approved managed-app baseline or was not permitted to use detected public web-service class for read/write operations'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'iOS:unifiedlog', 'channel': 'Background task, networking, or app-activation subsystem event occurred immediately before or during retrieve-then-write exchange with public web-service platform'}
x_mitre_mutable_elements	{'field': 'AllowedReadWriteMappings', 'description': 'Defines which bundles are expected to both retrieve and submit content to a given public service class.'}
x_mitre_mutable_elements	{'field': 'BackgroundRefreshBaseline', 'description': 'Expected background read/write network behavior differs across managed app categories.'}
x_mitre_mutable_elements	{'field': 'RecentUserInteractionWindow', 'description': 'Defines how close the bidirectional exchange must be to user activity to be considered expected.'}
x_mitre_mutable_elements	{'field': 'BeaconIntervalTolerance', 'description': 'Allowed recurrence interval for repeated bidirectional exchanges varies by bundle type.'}

[AN1820] Analytic 1820

Current version: 1.1

	Old Description			New Description
t	1	Defender observes anomalous access to remote device manageme	t	1	For Android, detect Remote Device Management Services by cor
	>	nt or enterprise mobility management control planes followed		>	relating analyst-visible device/network evidence and managem
	>	by device-state queries, location requests, or management a		>	ent state; use streaming or batched telemetry only where the
	>	ctions inconsistent with user role, historical behavior, or		>	documented collector is deployed. Correlate Cloud Service E
	>	device ownership context.		>	numeration via Application Vetting / Cloud Service Audit [In
				>	strumented app API trace and corresponding cloud-service aud
				>	it/API telemetry]; Protected Configuration via Android Enter
				>	prise DPC [DevicePolicyManager policy/compliance/security-st
				>	ate queries and SecurityLog events where supported]; User Ac
				>	count Authentication via Application Vetting / Identity Prov
				>	ider Telemetry [App authentication flow instrumentation or I
				>	dP sign-in/audit events]. Alert on a sequence or state chang
				>	e inconsistent with the device/app baseline, approved manage
				>	ment policy, or expected user workflow; do not infer unobser
				>	ved API calls, file/process activity, or payload content fro
				>	m management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.377000+00:00	2026-10-13 17:41:26.923000+00:00
description	Defender observes anomalous access to remote device management or enterprise mobility management control planes followed by device-state queries, location requests, or management actions inconsistent with user role, historical behavior, or device ownership context.	For Android, detect Remote Device Management Services by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Cloud Service Enumeration via Application Vetting / Cloud Service Audit [Instrumented app API trace and corresponding cloud-service audit/API telemetry]; Protected Configuration via Android Enterprise DPC [DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported]; User Account Authentication via Application Vetting / Identity Provider Telemetry [App authentication flow instrumentation or IdP sign-in/audit events]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[1]	{'field': 'GeoAccessAnomalyThreshold', 'description': 'Baseline deviation tolerance for management console access locations'}	{'field': 'LocationQueryThreshold', 'description': 'Default 10 device queries per session. Single queries are normal; bulk is anomalous.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--a953ca55-921a-44f7-9b8d-3d40141aa17e', 'name': 'saas:MDM', 'channel': 'Authentication events to device management or enterprise mobility management consoles'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--8c826308-2760-492f-9e36-4f0f7e23bcac', 'name': 'cloud:AuditLog', 'channel': 'Instrumented app API trace and corresponding cloud-service audit/API telemetry'}
x_mitre_mutable_elements[0]	{'field': 'RoleDeviationThreshold', 'description': 'Defines acceptable variance between user privileges and management actions'}	{'field': 'AdminAllowedIPs', 'description': 'IT office IPs, VPN egress IPs, known admin workstation IPs. Derive from IT network documentation.'}
x_mitre_mutable_elements[2]	{'field': 'DeviceOwnershipBaseline', 'description': 'Expected mapping of users to managed devices'}	{'field': 'LocationQueryWindow', 'description': 'Default 300s.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--8c826308-2760-492f-9e36-4f0f7e23bcac', 'name': 'saas:MDM', 'channel': 'Device lookup, location query, or remote management operation'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--6c62144a-cd5c-401c-ada9-58c4c74cd9d2', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--a953ca55-921a-44f7-9b8d-3d40141aa17e', 'name': 'idp:AuditLog', 'channel': 'App authentication flow instrumentation or IdP sign-in/audit events'}
x_mitre_mutable_elements		{'field': 'AuthCorrelationWindow', 'description': 'Default 3600s between auth event and location query.'}

[AN1821] Analytic 1821

Current version: 1.1

	Old Description			New Description
t	1	Defender observes anomalous authentication or session activi	t	1	For iOS, detect Remote Device Management Services by correla
	>	ty targeting remote device management services followed by d		>	ting analyst-visible device/network evidence and management
	>	evice-tracking queries, device-state requests, or remote act		>	state; use streaming or batched telemetry only where the doc
	>	ions inconsistent with established user-device relationships		>	umented collector is deployed. Correlate Application State v
	>	or operational patterns.		>	ia Apple MDM [InstalledApplicationList / ManagedApplicationL
				>	ist]; Cloud Service Enumeration via Application Vetting / Cl
				>	oud Service Audit [Instrumented app API trace and correspond
				>	ing cloud-service audit/API telemetry]; User Account Authent
				>	ication via Application Vetting / Identity Provider Telemetr
				>	y [App authentication flow instrumentation or IdP sign-in/au
				>	dit events]. Alert on a sequence or state change inconsisten
				>	t with the device/app baseline, approved management policy,
				>	or expected user workflow; do not infer unobserved API calls
				>	, file/process activity, or payload content from management
				>	state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.378000+00:00	2026-10-13 17:41:27.495000+00:00
description	Defender observes anomalous authentication or session activity targeting remote device management services followed by device-tracking queries, device-state requests, or remote actions inconsistent with established user-device relationships or operational patterns.	For iOS, detect Remote Device Management Services by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application State via Apple MDM [InstalledApplicationList / ManagedApplicationList]; Cloud Service Enumeration via Application Vetting / Cloud Service Audit [Instrumented app API trace and corresponding cloud-service audit/API telemetry]; User Account Authentication via Application Vetting / Identity Provider Telemetry [App authentication flow instrumentation or IdP sign-in/audit events]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[1]	{'field': 'SessionAnomalyThreshold', 'description': 'Baseline deviation tolerance for management sessions'}	{'field': 'LocationQueryWindow', 'description': 'Default 300s.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--a953ca55-921a-44f7-9b8d-3d40141aa17e', 'name': 'saas:MDM', 'channel': 'Authentication events to Apple iCloud or enterprise device management services'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'iOS:MDM', 'channel': 'InstalledApplicationList / ManagedApplicationList'}
x_mitre_mutable_elements[0]	{'field': 'UserDeviceRelationshipDeviation', 'description': 'Defines acceptable deviation from known user-device mappings'}	{'field': 'FindMyQueryThreshold', 'description': 'Default 5 queries per session — legitimate users check location once; adversary polls repeatedly.'}
x_mitre_mutable_elements[2]	{'field': 'QueryFrequencyThreshold', 'description': 'Threshold for excessive device tracking or lookup activity'}	{'field': 'UserKnownDevices', 'description': "User's registered device IPs and user agents from enterprise IdP device registry."}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--8c826308-2760-492f-9e36-4f0f7e23bcac', 'name': 'saas:MDM', 'channel': 'Device lookup, location query, or remote management operation'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--8c826308-2760-492f-9e36-4f0f7e23bcac', 'name': 'cloud:AuditLog', 'channel': 'Instrumented app API trace and corresponding cloud-service audit/API telemetry'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--a953ca55-921a-44f7-9b8d-3d40141aa17e', 'name': 'idp:AuditLog', 'channel': 'App authentication flow instrumentation or IdP sign-in/audit events'}

[AN1822] Analytic 1822

Current version: 1.1

	Old Description			New Description
t	1	The defender correlates call-control capability or telecom r	t	1	For Android, detect Call Control from documented management,
	>	ole state with subsequent unauthorized call initiation, answ		>	network, or vetting evidence; treat state queries as period
	>	er, block, redirect, or concealment behavior by an applicati		>	ic observations rather than real-time events. Correlate Appl
	>	on outside expected telephony workflows. The analytic priori		>	ication Permission via Android Enterprise DPC / Application
	>	tizes Android-observable control-plane effects: dangerous or		>	Vetting [DevicePolicyManager.getPermissionGrantState(); Pack
	>	role-gated call-control permissions, default dialer or Conn		>	ageManager manifest/requested-permission review]; File Modif
	>	ectionService-related role changes, telecom framework invoca		>	ication via Application Vetting / Forensic Acquisition [Dyna
	>	tion for call placement or handling, write activity against		>	mic filesystem trace or acquired app-container/filesystem ar
	>	call-log records, and call-control activity occurring from b		>	tifacts: App inserts, updates, or deletes call log records v
	>	ackground or locked-device context without recent user inter		>	ia CallLog.Calls ContentProvider immediately after call-cont
	>	action.		>	rol action — call log tampering to conceal interception]; OS
				>	API Execution via Application Vetting / Instrumented Dynami
				>	c Analysis [Dynamic API/runtime trace: App invokes TelecomMa
				>	nager.answerCall(), placeCall(), endCall(), or ConnectionSer
				>	vice call-handling operations without corresponding user-ini
				>	tiated call UI interaction]. Alert on a sequence or state ch
				>	ange inconsistent with the device/app baseline, approved man
				>	agement policy, or expected user workflow; do not infer unob
				>	served API calls, file/process activity, or payload content
				>	from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.382000+00:00	2026-10-13 17:42:39.220000+00:00
description	The defender correlates call-control capability or telecom role state with subsequent unauthorized call initiation, answer, block, redirect, or concealment behavior by an application outside expected telephony workflows. The analytic prioritizes Android-observable control-plane effects: dangerous or role-gated call-control permissions, default dialer or ConnectionService-related role changes, telecom framework invocation for call placement or handling, write activity against call-log records, and call-control activity occurring from background or locked-device context without recent user interaction.	For Android, detect Call Control from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; File Modification via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: App inserts, updates, or deletes call log records via CallLog.Calls ContentProvider immediately after call-control action — call log tampering to conceal interception]; OS API Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: App invokes TelecomManager.answerCall(), placeCall(), endCall(), or ConnectionService call-handling operations without corresponding user-initiated call UI interaction]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': 'Application invokes call placement, answer, redirect, block, screening, or ConnectionService call-handling APIs during unauthorized call-control phase'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes TelecomManager.answerCall(), placeCall(), endCall(), or ConnectionService call-handling operations without corresponding user-initiated call UI interaction'}
x_mitre_mutable_elements[1]	{'field': 'AllowedAppList', 'description': 'Apps legitimately expected to initiate or manage calls, such as default dialers, carrier tools, enterprise communications apps, or approved call-screening apps'}	{'field': 'CallInteractionThreshold', 'description': 'Default 10s between incoming call event and app call-answer action without user UI. Silent answer within 10s of ring without user touch is covert.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:MDMLog', 'channel': 'Managed app granted call-control-relevant permissions or telecom role state inconsistent with approved enterprise function before call-control activity'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindow', 'description': 'Correlation window between permission or role state, call-control action, call-log mutation, and follow-on network communication'}	{'field': 'ApprovedTelecomApps', 'description': 'Default dialer, approved VoIP apps, enterprise call manager. Derive from MDM catalog. Tightening: system dialer and MDM-pushed VoIP only.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:MDMLog', 'channel': 'Default phone or telecom-handling role changes to non-baselined application or managed app unexpectedly becomes dialer/call-handling app during call-control phase'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--84572de3-9583-4c73-aabd-06ea88123dd8', 'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: App inserts, updates, or deletes call log records via CallLog.Calls ContentProvider immediately after call-control action — call log tampering to conceal interception'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--84572de3-9583-4c73-aabd-06ea88123dd8', 'name': 'MobileEDR:telemetry', 'channel': 'Application inserts, updates, deletes, or rewrites call-log records immediately after call-control action to conceal, alter, or synthesize call history'}
x_mitre_mutable_elements	{'field': 'AllowedDialerRoles', 'description': 'Approved packages allowed to become default dialer or telecom-managing app on managed devices'}
x_mitre_mutable_elements	{'field': 'AllowedDestinationList', 'description': 'Approved network destinations associated with legitimate VoIP, carrier, or enterprise communications workflows'}
x_mitre_mutable_elements	{'field': 'ForegroundStateRequired', 'description': 'Whether call-control actions should occur only during active user-driven workflows'}
x_mitre_mutable_elements	{'field': 'CallLogModificationThreshold', 'description': 'Number of call-log insert, update, or delete operations within a short interval required before alerting'}
x_mitre_mutable_elements	{'field': 'CallActionRateThreshold', 'description': 'Maximum expected rate of call placement, answer, redirect, or block actions for legitimate app behavior'}
x_mitre_mutable_elements	{'field': 'HighRiskNumberPatterns', 'description': 'Environment-specific list of suspicious, premium-rate, or adversary-known phone-number patterns'}

[AN1823] Analytic 1823

Current version: 1.1

	Old Description			New Description
t	1	A legitimate-seeming application or update is installed thro	t	1	For Android, detect Compromise Software Dependencies and Dev
	>	ugh an expected or previously trusted path, but shortly afte		>	elopment Tools by correlating analyst-visible device/network
	>	r first run or update the application exhibits new runtime b		>	evidence and management state; use streaming or batched tel
	>	ehavior, sensor use, file staging, or network communications		>	emetry only where the documented collector is deployed. Corr
	>	inconsistent with its historical baseline, documented role,		>	elate Application Permission via Android Enterprise DPC / Ap
	>	or prior version. The defender specifically looks for behav		>	plication Vetting [DevicePolicyManager.getPermissionGrantSta
	>	iors commonly introduced by compromised third-party librarie		>	te(); PackageManager manifest/requested-permission review];
	>	s or manipulated build tooling, such as unexpected backgroun		>	Application State via Android Enterprise / EMM [Managed pack
	>	d service activation, first-seen framework use, new permissi		>	age inventory/status and package metadata]; OS API Execution
	>	ons exercised, novel network destinations, or dropped local		>	via Application Vetting / Instrumented Dynamic Analysis [Dy
	>	artifacts not aligned to the app's expected function.		>	namic API/runtime trace: App begins first-seen network conne
				>	ctions to destinations matching known-malicious SDK C2 patte
				>	rns or outside $SDKBaselineEndpoints$ for embedded SDK names
				>	pace]. Alert on a sequence or state change inconsistent with
				>	the device/app baseline, approved management policy, or exp
				>	ected user workflow; do not infer unobserved API calls, file
				>	/process activity, or payload content from management state
				>	alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.384000+00:00	2026-10-13 17:42:24.295000+00:00
description	A legitimate-seeming application or update is installed through an expected or previously trusted path, but shortly after first run or update the application exhibits new runtime behavior, sensor use, file staging, or network communications inconsistent with its historical baseline, documented role, or prior version. The defender specifically looks for behaviors commonly introduced by compromised third-party libraries or manipulated build tooling, such as unexpected background service activation, first-seen framework use, new permissions exercised, novel network destinations, or dropped local artifacts not aligned to the app's expected function.	For Android, detect Compromise Software Dependencies and Development Tools by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; Application State via Android Enterprise / EMM [Managed package inventory/status and package metadata]; OS API Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: App begins first-seen network connections to destinations matching known-malicious SDK C2 patterns or outside $SDKBaselineEndpoints$ for embedded SDK namespace]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[1]	{'field': 'AllowedAppList', 'description': 'Apps legitimately expected to add services, libraries, or destinations because of approved releases.'}	{'field': 'PostInstallWindow', 'description': 'Default 86400s. Same as T1474 parent.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--6c62144a-cd5c-401c-ada9-58c4c74cd9d2', 'name': 'android:MDMLog', 'channel': 'Managed app distribution, enterprise catalog trust, and update policy remain expected while a known package exhibits materially different post-install or post-update behavior'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}
x_mitre_log_source_references[3]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': 'Known application begins first-seen or expanded use of account services, accessibility, content providers, dynamic loading, package services, WebView bridges, crypto/network APIs, or advertising/telemetry-adjacent framework behavior after install or update'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--6c62144a-cd5c-401c-ada9-58c4c74cd9d2', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindow', 'description': 'Maximum span between install/update or first launch and the first suspicious behavior drift.'}	{'field': 'SDKBaselineEndpoints', 'description': 'Known analytics/telemetry endpoints for embedded SDKs (Firebase, Adjust, AppsFlyer, etc.). Derive from SDK vendor documentation. Any SDK endpoint outside this list post-update is anomalous.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:MDMLog', 'channel': 'Known application version declares, gains, or first exercises storage, communications, accessibility, advertising, analytics, overlay, or sensor-adjacent capability inconsistent with prior version baseline or business role'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'android:EMM', 'channel': 'Managed package inventory/status and package metadata'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'android:MDMLog', 'channel': 'Newly installed or updated application launches background service, becomes active without recent user interaction, or executes immediately after update in a pattern inconsistent with baseline'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App begins first-seen network connections to destinations matching known-malicious SDK C2 patterns or outside $SDKBaselineEndpoints$ for embedded SDK namespace'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_mutable_elements	{'field': 'AllowedVersionChangeWindow', 'description': 'Grace period after an approved release during which limited behavior drift may be expected.'}
x_mitre_mutable_elements	{'field': 'CapabilityDriftThreshold', 'description': 'Threshold for how many new permissions or capabilities are tolerated before behavior is considered suspicious.'}
x_mitre_mutable_elements	{'field': 'SensorDriftThreshold', 'description': 'Threshold for newly used sensors or privacy-sensitive resources that are tolerated for a known app.'}
x_mitre_mutable_elements	{'field': 'ForegroundStateRequired', 'description': 'Whether certain framework or sensor behaviors should only be treated as suspicious when they occur without visible user interaction.'}
x_mitre_mutable_elements	{'field': 'RecentUserInteractionWindow', 'description': 'Time threshold for distinguishing autonomous post-update execution from normal first-run user activity.'}
x_mitre_mutable_elements	{'field': 'DestinationAllowList', 'description': 'Expected domains, CDNs, telemetry services, or APIs associated with approved app updates and known SDKs.'}
x_mitre_mutable_elements	{'field': 'BehaviorBaselinePopulation', 'description': 'Devices, versions, or user cohorts used to define normal behavior for the app.'}

[AN1824] Analytic 1824

Current version: 1.1

	Old Description			New Description
t	1	A legitimate-seeming app or update arrives through an expect	t	1	For iOS, detect Compromise Software Dependencies and Develop
	>	ed or trusted distribution path, but the delivered applicati		>	ment Tools from documented management, network, or vetting e
	>	on begins showing new entitlement exercise, background activ		>	vidence; treat state queries as periodic observations rather
	>	ity, framework use, sensor access, or network behavior incon		>	than real-time events. Correlate Application Permission via
	>	sistent with its prior baseline or documented role. Because		>	Application Vetting [Code-signing entitlements and Info.pli
	>	direct inspection of compromised dependencies or developer t		>	st privacy usage-description keys]; Application State via Ap
	>	ooling is weaker on iOS, the defender emphasizes supervised-		>	ple MDM [InstalledApplicationList / ManagedApplicationList];
	>	device app inventory, post-update behavior drift, new first-		>	OS API Execution via Application Vetting / Instrumented Dyn
	>	run or background patterns, and downstream communications th		>	amic Analysis [Dynamic API/runtime trace: Known app begins f
	>	at suggest compromised embedded libraries or manipulated bui		>	irst-seen use of protected categories (analytics, location,
	>	ld outputs.		>	contacts) matching known-SDK behavior patterns post-update].
				>	Alert on a sequence or state change inconsistent with the d
				>	evice/app baseline, approved management policy, or expected
				>	user workflow; do not infer unobserved API calls, file/proce
				>	ss activity, or payload content from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.379000+00:00	2026-10-13 17:42:24.960000+00:00
description	A legitimate-seeming app or update arrives through an expected or trusted distribution path, but the delivered application begins showing new entitlement exercise, background activity, framework use, sensor access, or network behavior inconsistent with its prior baseline or documented role. Because direct inspection of compromised dependencies or developer tooling is weaker on iOS, the defender emphasizes supervised-device app inventory, post-update behavior drift, new first-run or background patterns, and downstream communications that suggest compromised embedded libraries or manipulated build outputs.	For iOS, detect Compromise Software Dependencies and Development Tools from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Application Permission via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]; Application State via Apple MDM [InstalledApplicationList / ManagedApplicationList]; OS API Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: Known app begins first-seen use of protected categories (analytics, location, contacts) matching known-SDK behavior patterns post-update]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[1]	{'field': 'SupervisedOnly', 'description': 'Whether the analytic should only apply to supervised devices with high-confidence managed app telemetry.'}	{'field': 'PostInstallWindow', 'description': 'Default 86400s. Same as T1474 parent.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--6c62144a-cd5c-401c-ada9-58c4c74cd9d2', 'name': 'iOS:MDMLog', 'channel': 'Managed app distribution, supervised install posture, or provisioning trust context remains expected while a known app exhibits materially different behavior after version change'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'mobile:ApplicationVetting', 'channel': 'Code-signing entitlements and Info.plist privacy usage-description keys'}
x_mitre_log_source_references[3]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': 'Known application begins first-seen or expanded use of account services, accessibility, content providers, dynamic loading, package services, WebView bridges, crypto/network APIs, or advertising/telemetry-adjacent framework behavior after install or update'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--6c62144a-cd5c-401c-ada9-58c4c74cd9d2', 'name': 'iOS:MDM', 'channel': 'DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindow', 'description': 'Maximum span between install/version change and first suspicious post-delivery behavior.'}	{'field': 'SDKBaselineEndpoints', 'description': 'Known analytics/telemetry endpoints for embedded SDKs (Firebase, Adjust, AppsFlyer, etc.). Derive from SDK vendor documentation. Any SDK endpoint outside this list post-update is anomalous.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'iOS:MDMLog', 'channel': 'Known application version declares, activates, or exhibits new entitlements, privacy permissions, or capability use inconsistent with prior baseline or business role'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'iOS:MDM', 'channel': 'InstalledApplicationList / ManagedApplicationList'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'MobileEDR:telemetry', 'channel': 'Updated or newly delivered application wakes, foregrounds, refreshes, or becomes active shortly after version change with weak recent user interaction'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Known app begins first-seen use of protected categories (analytics, location, contacts) matching known-SDK behavior patterns post-update'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_mutable_elements	{'field': 'AllowedAppList', 'description': 'Approved apps expected to change capabilities, services, or destinations because of legitimate releases.'}
x_mitre_mutable_elements	{'field': 'AllowedVersionChangeWindow', 'description': 'Grace period after an approved release during which limited behavior drift may be expected.'}
x_mitre_mutable_elements	{'field': 'CapabilityDriftThreshold', 'description': 'Threshold for how much entitlement or capability drift is tolerated for a known app.'}
x_mitre_mutable_elements	{'field': 'SensorDriftThreshold', 'description': 'Threshold for newly used sensors or privacy-sensitive resources tolerated for a known app.'}
x_mitre_mutable_elements	{'field': 'ForegroundStateRequired', 'description': 'Whether certain behaviors should only be treated as suspicious when they occur without visible user interaction.'}
x_mitre_mutable_elements	{'field': 'RecentUserInteractionWindow', 'description': 'Threshold for distinguishing autonomous post-update activity from normal user-driven first-run behavior.'}
x_mitre_mutable_elements	{'field': 'DestinationAllowList', 'description': 'Expected domains, telemetry services, or APIs associated with approved app updates and known SDK behavior.'}

[AN1825] Analytic 1825

Current version: 1.1

	Old Description			New Description
t	1	Defender observes an app gaining input-observation capabilit	t	1	For Android, detect Input Capture by correlating analyst-vis
	>	y (AccessibilityService enablement, default IME set, draw-ov		>	ible device/network evidence and management state; use strea
	>	er-apps permission), then creating an intercept surface (ove		>	ming or batched telemetry only where the documented collecto
	>	rlay window, accessibility event stream consumption or IME k		>	r is deployed. Correlate API Calls via Application Vetting /
	>	eystroke callbacks), followed by persistence (local keylog/c		>	Instrumented Dynamic Analysis [Dynamic API/runtime trace: A
	>	lipboard dump) and/or small, frequent network egress. Chain:		>	ccessibilityEvent.TYPE_VIEW_TEXT_CHANGED received by listene
	>	capability/permission → listener/overlay activation → burst		>	r_app NOT IN $AccessibilityAllowList$]; Network Traffic Flow
	>	y input read events → local write → near-term exfil.		>	via Android Enterprise Network Logging / Enterprise VPN [De
				>	vicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectE
				>	vent; VPN flow metadata]; Permissions Request via Android En
				>	terprise DPC / Application Vetting [DevicePolicyManager.getP
				>	ermissionGrantState(); PackageManager manifest/requested-per
				>	mission review]. Alert on a sequence or state change inconsi
				>	stent with the device/app baseline, approved management poli
				>	cy, or expected user workflow; do not infer unobserved API c
				>	alls, file/process activity, or payload content from managem
				>	ent state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.380000+00:00	2026-10-13 17:41:07.900000+00:00
description	Defender observes an app gaining input-observation capability (AccessibilityService enablement, default IME set, draw-over-apps permission), then creating an intercept surface (overlay window, accessibility event stream consumption or IME keystroke callbacks), followed by persistence (local keylog/clipboard dump) and/or small, frequent network egress. Chain: capability/permission → listener/overlay activation → bursty input read events → local write → near-term exfil.	For Android, detect Input Capture by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: AccessibilityEvent.TYPE_VIEW_TEXT_CHANGED received by listener_app NOT IN $AccessibilityAllowList$]; Network Traffic Flow via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]; Permissions Request via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[3]	{'field': 'PersistPathRegex', 'description': 'Regex for keylog/clipboard dump destinations in app container.'}	{'field': 'InputExfilWindow', 'description': 'Default 300s.'}
x_mitre_mutable_elements[1]	{'field': 'MinInputEventBurst', 'description': 'Minimum count of input events within window to flag harvesting (e.g., ≥5).'}	{'field': 'TargetAppList', 'description': 'Banking, auth, enterprise SSO, email app packages. Derive from MDM app catalog by data tier.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--1887a270-576a-4049-84de-ef746b2572d6', 'name': 'android:logcat', 'channel': 'Grant/activation of BIND_ACCESSIBILITY_SERVICE, BIND_INPUT_METHOD, SYSTEM_ALERT_WINDOW, POST_NOTIFICATIONS for '}	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: AccessibilityEvent.TYPE_VIEW_TEXT_CHANGED received by listener_app NOT IN $AccessibilityAllowList$'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindowSeconds', 'description': 'Max time from input intercept to persist/exfil (e.g., 5–45s).'}	{'field': 'AccessibilityAllowList', 'description': 'Approved assistive tech, screen readers, approved IME apps. Keep minimal. Derive from MDM catalog.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'android:logcat', 'channel': 'AccessibilityService connected\|TYPE_VIEW_TEXT_CHANGED\|TYPE_VIEW_FOCUSED events for other packages'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'android:EnterpriseNetworkLog', 'channel': 'DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata'}
x_mitre_mutable_elements[2]	{'field': 'OverlayRequired', 'description': 'Require overlay creation if Accessibility not present (true/false).'}	{'field': 'KeylogUplinkThreshold', 'description': 'Default 10KB — keystroke logs are small but high-value. Tightening: 1KB.'}
x_mitre_mutable_elements[4]	{'field': 'ExfilDomainAllowlist', 'description': 'Known-good analytics/CDN endpoints to suppress FPs.'}	{'field': 'AppCDNList', 'description': 'Per-app CDN. Derive by measurement.'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'android:logcat', 'channel': 'Default IME changed/active: imeId=, onStartInput/onFinishInput high frequency. TYPE_APPLICATION_OVERLAY\|addView .* showing on top of package '}	{'x_mitre_data_component_ref': 'x-mitre-data-component--e2f72131-14d1-411f-8e8c-aa3453dd5456', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'android:logcat', 'channel': 'CREATE/WRITE paths like /data/data//files/(keys\|inputs)/.*\\\\.db\|\\\\.txt\|\\\\.log'}
x_mitre_mutable_elements	{'field': 'UserContext', 'description': 'Foreground/background/Work Profile or Kiosk policy to scope alerts.'}

[AN1826] Analytic 1826

Current version: 1.1

	Old Description			New Description
t	1	Defender observes an app enabling or using input-capture sur	t	1	For iOS, detect Input Capture by correlating analyst-visible
	>	faces (custom keyboard extension with Full Access, abnormal		>	device/network evidence and management state; use streaming
	>	UI text entry interception, pasteboard polling adjacent to l		>	or batched telemetry only where the documented collector is
	>	ogin screens), then persisting and/or exfiltrating captured		>	deployed. Correlate Application State via Apple MDM [Instal
	>	input. Chain: capability/consent (TCC for keyboard Full Acce		>	ledApplicationList / ManagedApplicationList]; Network Traffi
	>	ss or input privacy domains) → intercept behavior (keyboard		>	c Flow via Apple Network Extension / Enterprise VPN [NEFilte
	>	extension active, repeated text field ‘editingChanged’/secur		>	rFlow / per-app VPN / secure-web-gateway flow metadata]; Per
	>	e entry focus, background pasteboard reads) → local write →		>	missions Request via Application Vetting [Code-signing entit
	>	near-term egress.		>	lements and Info.plist privacy usage-description keys]. Aler
				>	t on a sequence or state change inconsistent with the device
				>	/app baseline, approved management policy, or expected user
				>	workflow; do not infer unobserved API calls, file/process ac
				>	tivity, or payload content from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.378000+00:00	2026-10-13 17:41:08.561000+00:00
description	Defender observes an app enabling or using input-capture surfaces (custom keyboard extension with Full Access, abnormal UI text entry interception, pasteboard polling adjacent to login screens), then persisting and/or exfiltrating captured input. Chain: capability/consent (TCC for keyboard Full Access or input privacy domains) → intercept behavior (keyboard extension active, repeated text field ‘editingChanged’/secure entry focus, background pasteboard reads) → local write → near-term egress.	For iOS, detect Input Capture by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application State via Apple MDM [InstalledApplicationList / ManagedApplicationList]; Network Traffic Flow via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]; Permissions Request via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[3]	{'field': 'PersistPathRegex', 'description': 'Regex for keylog/clipboard dump files.'}	{'field': 'KeylogSessionThreshold', 'description': 'Default 300s sustained — confirms ongoing capture vs one-time sync.'}
x_mitre_mutable_elements[1]	{'field': 'MinKeyEventBurst', 'description': 'Minimum key/commit or editingChanged count to flag harvesting (e.g., ≥10).'}	{'field': 'KeyboardVendorEndpoints', 'description': 'Known cloud sync endpoints for each approved keyboard vendor.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--1887a270-576a-4049-84de-ef746b2572d6', 'name': 'iOS:unifiedlog', 'channel': 'Keyboard extension Full Access change; privacy grant touching input/keyboard categories for '}	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'iOS:MDM', 'channel': 'InstalledApplicationList / ManagedApplicationList'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindowSeconds', 'description': 'Max time from intercept to persist/exfil (e.g., 5–60s).'}	{'field': 'KeyboardAllowList', 'description': 'IT-approved keyboard bundle IDs. Keep minimal.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'iOS:unifiedlog', 'channel': 'UIWindow/UIView events indicating secure text entry focus, editingChanged bursts, unexpected firstResponder cycling'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'iOS:NetworkExtension', 'channel': 'NEFilterFlow / per-app VPN / secure-web-gateway flow metadata'}
x_mitre_mutable_elements[2]	{'field': 'KeyboardFullAccessRequired', 'description': 'Require keyboard Full Access to escalate severity (true/false).'}	{'field': 'KeystrokeFrequencyThreshold', 'description': 'Default 2 packets/sec — matches human average typing rate. Derive from keystroke baseline measurement.'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'iOS:unifiedlog', 'channel': 'CREATE/WRITE clipboard/keylog artifacts (clipboard.db, keys_*.txt) in container'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--e2f72131-14d1-411f-8e8c-aa3453dd5456', 'name': 'mobile:ApplicationVetting', 'channel': 'Code-signing entitlements and Info.plist privacy usage-description keys'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_mutable_elements	{'field': 'ExfilDomainAllowlist', 'description': 'Known-good enterprise/analytics endpoints.'}
x_mitre_mutable_elements	{'field': 'UserContext', 'description': 'Foreground state, Focus modes, MDM policy.'}

[AN1827] Analytic 1827

Current version: 1.1

	Old Description			New Description
t	1	The defender correlates app-attributed outbound sessions whe	t	1	For Android, detect Non-Standard Port by correlating analyst
	>	re protocol indicators such as TLS handshake, HTTP method an		>	-visible device/network evidence and management state; use s
	>	d header patterns, DNS semantics, or other application-layer		>	treaming or batched telemetry only where the documented coll
	>	characteristics are observed over a destination port outsid		>	ector is deployed. Correlate Application Permission via Andr
	>	e the approved baseline for that protocol and app role. The		>	oid Enterprise DPC / Application Vetting [DevicePolicyManage
	>	strongest Android evidence is repeated or persistent app-att		>	r.getPermissionGrantState(); PackageManager manifest/request
	>	ributed traffic using HTTPS-, HTTP-, DNS-, WebSocket-, or ot		>	ed-permission review]; Application State via Android Enterpr
	>	her recognizable application behavior over uncommon destinat		>	ise / EMM [Managed package inventory/status and package meta
	>	ion ports, especially when the app is backgrounded, while th		>	data]; Network Traffic Content via Enterprise Secure Web Gat
	>	e device is locked, without recent user interaction, or when		>	eway / Proxy [DNS/HTTP(S) inspection or proxy transaction me
	>	the app is unmanaged or not approved for that protocol-to-p		>	tadata where enterprise decryption/inspection is deployed].
	>	ort pairing.		>	Alert on a sequence or state change inconsistent with the de
				>	vice/app baseline, approved management policy, or expected u
				>	ser workflow; do not infer unobserved API calls, file/proces
				>	s activity, or payload content from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.381000+00:00	2026-10-13 17:42:28.789000+00:00
description	The defender correlates app-attributed outbound sessions where protocol indicators such as TLS handshake, HTTP method and header patterns, DNS semantics, or other application-layer characteristics are observed over a destination port outside the approved baseline for that protocol and app role. The strongest Android evidence is repeated or persistent app-attributed traffic using HTTPS-, HTTP-, DNS-, WebSocket-, or other recognizable application behavior over uncommon destination ports, especially when the app is backgrounded, while the device is locked, without recent user interaction, or when the app is unmanaged or not approved for that protocol-to-port pairing.	For Android, detect Non-Standard Port by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; Application State via Android Enterprise / EMM [Managed package inventory/status and package metadata]; Network Traffic Content via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[1]	{'field': 'AllowedAppList', 'description': 'Approved app identities vary by organization, role, and device group.'}	{'field': 'ApprovedNetworkApps', 'description': 'Apps approved for non-standard port use (enterprise network tools, VoIP apps with custom ports). Derive from MDM catalog. Tightening: empty — all non-standard port use flagged.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'VPN:MobileProxy', 'channel': 'TLS handshake, HTTP method/header pattern, or WebSocket upgrade was observed on destination port outside approved port set for detected protocol during app-attributed outbound session'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}
x_mitre_log_source_references[3]	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'MobileEDR:telemetry', 'channel': 'AppState=background when non-standard-port session began and no foreground transition occurred during repeated or persistent connection sequence'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Background work scheduler, foreground service, or persistent service activates'}
x_mitre_mutable_elements[0]	{'field': 'AllowedProtocolPortMappings', 'description': 'Approved protocol-to-port pairings vary by app, business workflow, proxy architecture, and enterprise policy.'}	{'field': 'ApprovedPortMap', 'description': 'Protocol-to-port allowlist: HTTPS:443, HTTP:80, DNS:53, SMTP:587, IMAP:993, etc. Derive from enterprise network policy. Any TLS outside 443, 8443 (if approved) is non-standard.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'VPN:MobileProxy', 'channel': 'Repeated app-attributed sessions to same destination or service class used non-standard destination port with stable recurrence interval or persistent connection behavior'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'android:EMM', 'channel': 'Managed package inventory/status and package metadata'}
x_mitre_mutable_elements[2]	{'field': 'AllowedServiceClasses', 'description': 'Expected external service classes differ across app categories and enterprise mobile workflows.'}	{'field': 'InteractionThreshold', 'description': 'Default 300s. Sessions starting >5min after last user interaction with no foreground trigger are background-initiated.'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'VPN:MobileProxy', 'channel': 'Destination port was not in approved protocol-to-port mapping for app identity or service class and session did not match known enterprise proxy, relay, or developer tooling exception'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'webproxy:applog', 'channel': 'DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'MobileEDR:telemetry', 'channel': 'DeviceLockState=locked during outbound session using non-standard protocol-to-port pairing'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'MobileEDR:telemetry', 'channel': 'LastUserInteractionDelta exceeded threshold before app-attributed session using non-standard protocol-to-port pairing'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': 'Background work scheduler, job execution, foreground-service start, or persistent service activation immediately preceded outbound session using non-standard protocol-to-port pairing'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'iOS:MDMLog', 'channel': 'App identity using non-standard protocol-to-port pairing was unmanaged, outside approved app baseline, or not permitted to communicate using detected protocol/service over observed destination port'}
x_mitre_mutable_elements	{'field': 'TimeWindow', 'description': 'Correlation window linking non-standard-port sessions with lifecycle, framework, or local state changes.'}
x_mitre_mutable_elements	{'field': 'RecentUserInteractionWindow', 'description': 'Defines how close a session must be to user activity to be considered expected.'}
x_mitre_mutable_elements	{'field': 'BeaconIntervalTolerance', 'description': 'Allowed recurrence interval for benign polling, sync, or persistent sessions differs by app type.'}
x_mitre_mutable_elements	{'field': 'ForegroundStateRequired', 'description': 'Some apps should only initiate certain outbound communications while foregrounded.'}
x_mitre_mutable_elements	{'field': 'EnterpriseExceptionList', 'description': 'Known developer tools, enterprise proxies, VPNs, relays, and security products may legitimately use uncommon ports.'}

[AN1828] Analytic 1828

Current version: 1.1

	Old Description			New Description
t	1	The defender correlates managed-app or supervised-device out	t	1	For iOS, detect Non-Standard Port by correlating analyst-vis
	>	bound sessions where protocol indicators such as TLS handsha		>	ible device/network evidence and management state; use strea
	>	ke, HTTP semantics, or other application-layer behaviors are		>	ming or batched telemetry only where the documented collecto
	>	observed over destination ports outside the approved baseli		>	r is deployed. Correlate Application Permission via Applicat
	>	ne for that protocol and bundle role. The strongest iOS evid		>	ion Vetting [Code-signing entitlements and Info.plist privac
	>	ence is network telemetry showing repeated or persistent ses		>	y usage-description keys]; Application State via Apple MDM [
	>	sions using recognizable application protocols over uncommon		>	InstalledApplicationList / ManagedApplicationList]; Network
	>	ports, particularly during background refresh, while the de		>	Traffic Content via Enterprise Secure Web Gateway / Proxy [D
	>	vice is locked, or without recent user interaction. Because		>	NS/HTTP(S) inspection or proxy transaction metadata where en
	>	direct local runtime attribution is weaker than Android, the		>	terprise decryption/inspection is deployed]. Alert on a sequ
	>	primary iOS analytic should be anchored on network protocol		>	ence or state change inconsistent with the device/app baseli
	>	-versus-port mismatch plus supervised managed-app context an		>	ne, approved management policy, or expected user workflow; d
	>	d device-state enrichment.		>	o not infer unobserved API calls, file/process activity, or
				>	payload content from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.379000+00:00	2026-10-13 17:42:29.513000+00:00
description	The defender correlates managed-app or supervised-device outbound sessions where protocol indicators such as TLS handshake, HTTP semantics, or other application-layer behaviors are observed over destination ports outside the approved baseline for that protocol and bundle role. The strongest iOS evidence is network telemetry showing repeated or persistent sessions using recognizable application protocols over uncommon ports, particularly during background refresh, while the device is locked, or without recent user interaction. Because direct local runtime attribution is weaker than Android, the primary iOS analytic should be anchored on network protocol-versus-port mismatch plus supervised managed-app context and device-state enrichment.	For iOS, detect Non-Standard Port by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]; Application State via Apple MDM [InstalledApplicationList / ManagedApplicationList]; Network Traffic Content via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[1]	{'field': 'SupervisedRequired', 'description': 'Strongest bundle-governance and protocol-port baseline analytics depend on supervised iOS devices.'}	{'field': 'ApprovedNetworkApps', 'description': 'Apps approved for non-standard port use (enterprise network tools, VoIP apps with custom ports). Derive from MDM catalog. Tightening: empty — all non-standard port use flagged.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'VPN:MobileProxy', 'channel': 'TLS handshake, HTTP method/header pattern, or WebSocket upgrade was observed on destination port outside approved port set for detected protocol during app-attributed outbound session'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'mobile:ApplicationVetting', 'channel': 'Code-signing entitlements and Info.plist privacy usage-description keys'}
x_mitre_log_source_references[3]	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'MobileEDR:telemetry', 'channel': 'DeviceLockState=locked during outbound session using non-standard protocol-to-port pairing'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Background task or persistent networking event activates'}
x_mitre_mutable_elements[0]	{'field': 'AllowedProtocolPortMappings', 'description': 'Approved protocol-to-port pairings vary by bundle, business workflow, proxy architecture, and enterprise policy.'}	{'field': 'ApprovedPortMap', 'description': 'Protocol-to-port allowlist: HTTPS:443, HTTP:80, DNS:53, SMTP:587, IMAP:993, etc. Derive from enterprise network policy. Any TLS outside 443, 8443 (if approved) is non-standard.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'VPN:MobileProxy', 'channel': 'Repeated app-attributed sessions to same destination or service class used non-standard destination port with stable recurrence interval or persistent connection behavior'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'iOS:MDM', 'channel': 'InstalledApplicationList / ManagedApplicationList'}
x_mitre_mutable_elements[2]	{'field': 'AllowedManagedApps', 'description': 'Approved managed bundle identities vary by organization and device profile.'}	{'field': 'InteractionThreshold', 'description': 'Default 300s. Sessions starting >5min after last user interaction with no foreground trigger are background-initiated.'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'VPN:MobileProxy', 'channel': 'Observed protocol-to-port pairing was outside approved mapping for managed bundle or service class and did not match enterprise proxy, relay, or developer tooling exception'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'webproxy:applog', 'channel': 'DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'MobileEDR:telemetry', 'channel': 'LastUserInteractionDelta exceeded threshold before app-attributed session using non-standard protocol-to-port pairing'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'iOS:MDMLog', 'channel': 'App identity using non-standard protocol-to-port pairing was unmanaged, outside approved app baseline, or not permitted to communicate using detected protocol/service over observed destination port'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': 'Background work scheduler, job execution, foreground-service start, or persistent service activation immediately preceded outbound session using non-standard protocol-to-port pairing'}
x_mitre_mutable_elements	{'field': 'AllowedServiceClasses', 'description': 'Expected external service classes differ across managed app categories and enterprise mobile workflows.'}
x_mitre_mutable_elements	{'field': 'TimeWindow', 'description': 'Correlation window linking non-standard-port sessions with lifecycle or local context signals.'}
x_mitre_mutable_elements	{'field': 'RecentUserInteractionWindow', 'description': 'Defines how close a session must be to user activity to be considered expected.'}
x_mitre_mutable_elements	{'field': 'BeaconIntervalTolerance', 'description': 'Allowed recurrence interval for benign polling, sync, or persistent sessions differs by bundle type.'}
x_mitre_mutable_elements	{'field': 'EnterpriseExceptionList', 'description': 'Known enterprise proxies, relays, developer tooling, and security products may legitimately use uncommon ports.'}

[AN1829] Analytic 1829

Current version: 1.1

	Old Description			New Description
t	1	The defender correlates creation or registration of deferred	t	1	For Android, detect Scheduled Task/Job primarily during appl
	>	, repeating, or constraint-based background work with later		>	ication vetting or controlled analysis rather than assuming
	>	task execution in the same app context, especially when the		>	a live device SOC feed. Correlate OS API Execution via Appli
	>	task executes without recent user interaction, from backgrou		>	cation Vetting / Instrumented Dynamic Analysis [Dynamic API/
	>	nd state, or with follow-on file, sensor, or network behavio		>	runtime trace: App enqueues WorkManager work, schedules JobS
	>	r inconsistent with the app's declared role. The analytic pr		>	cheduler job, or sets AlarmManager with repeating interval N
	>	ioritizes Android-observable control-plane effects: WorkMana		>	OT IN $ApprovedSchedulerApps$]; Scheduled Job Creation via A
	>	ger enqueue operations, JobScheduler or AlarmManager schedul		>	pplication Vetting / Forensic Acquisition [Dynamic filesyste
	>	ing, later wake or execution of the scheduled work, and post		>	m trace or acquired app-container/filesystem artifacts: Sche
	>	-trigger activity such as network sessions, local staging, o		>	duled task execution creates file, accesses sensor, or initi
	>	r sensor access.		>	ates network connection immediately after firing, with no re
				>	cent user interaction triggering the task]. Alert on a seque
				>	nce or state change inconsistent with the device/app baselin
				>	e, approved management policy, or expected user workflow; do
				>	not infer unobserved API calls, file/process activity, or p
				>	ayload content from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.375000+00:00	2026-10-13 17:42:37.187000+00:00
description	The defender correlates creation or registration of deferred, repeating, or constraint-based background work with later task execution in the same app context, especially when the task executes without recent user interaction, from background state, or with follow-on file, sensor, or network behavior inconsistent with the app's declared role. The analytic prioritizes Android-observable control-plane effects: WorkManager enqueue operations, JobScheduler or AlarmManager scheduling, later wake or execution of the scheduled work, and post-trigger activity such as network sessions, local staging, or sensor access.	For Android, detect Scheduled Task/Job primarily during application vetting or controlled analysis rather than assuming a live device SOC feed. Correlate OS API Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: App enqueues WorkManager work, schedules JobScheduler job, or sets AlarmManager with repeating interval NOT IN $ApprovedSchedulerApps$]; Scheduled Job Creation via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: Scheduled task execution creates file, accesses sensor, or initiates network connection immediately after firing, with no recent user interaction triggering the task]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': 'Application enqueues WorkManager work request or schedules JobScheduler or AlarmManager task with delay, periodic interval, or execution constraints during the persistence/execution setup phase'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App enqueues WorkManager work, schedules JobScheduler job, or sets AlarmManager with repeating interval NOT IN $ApprovedSchedulerApps$'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindow', 'description': 'Correlation window between task registration and later execution, and between execution and follow-on behavior'}	{'field': 'ApprovedSchedulerApps', 'description': 'Apps with legitimate scheduled background work: MDM agent (policy sync), email clients (push sync), approved enterprise apps. Derive from MDM catalog. Any unapproved app using repeating scheduled tasks is anomalous.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--f42df6f0-6395-4f0c-9376-525a031f00c3', 'name': 'MobiledEDR:telemetry', 'channel': 'Scheduled task execution creates cache, staged payload, local output, or collected data artifact immediately after wake or job trigger'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--f42df6f0-6395-4f0c-9376-525a031f00c3', 'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: Scheduled task execution creates file, accesses sensor, or initiates network connection immediately after firing, with no recent user interaction triggering the task'}
x_mitre_mutable_elements[1]	{'field': 'AllowedAppList', 'description': 'Apps legitimately expected to use WorkManager, JobScheduler, or AlarmManager such as mail, sync, backup, calendar, or enterprise management apps'}	{'field': 'ScheduledIntervalThreshold', 'description': 'Default 900s (15 min) minimum suspicious repeat interval. Shorter intervals indicate high-frequency C2 check-in pattern. Derive from legitimate app scheduler baseline.'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_mutable_elements	{'field': 'AllowedConstraintProfiles', 'description': 'Expected charging, network, idle, or timing constraints for legitimate scheduled work'}
x_mitre_mutable_elements	{'field': 'AllowedScheduleIntervals', 'description': 'Expected delay or periodic interval ranges for legitimate app behavior'}
x_mitre_mutable_elements	{'field': 'ForegroundStateRequired', 'description': 'Whether follow-on activity from a scheduled task should only occur during active user-driven workflows for a given app'}
x_mitre_mutable_elements	{'field': 'TriggerToNetworkWindow', 'description': 'Maximum expected delay between scheduled job trigger and outbound communication'}
x_mitre_mutable_elements	{'field': 'UplinkBytesThreshold', 'description': 'Minimum outbound volume after scheduled execution to treat network behavior as meaningful'}

[AN1830] Analytic 1830

Current version: 1.1

	Old Description			New Description
t	1	The defender correlates creation of background scheduler act	t	1	For iOS, detect Scheduled Task/Job primarily during applicat
	>	ivity with later execution of repeating or deferred work by		>	ion vetting or controlled analysis rather than assuming a li
	>	the same managed app, then raises confidence when the trigge		>	ve device SOC feed. Correlate OS API Execution via Applicati
	>	red activity produces network, local-write, or other app beh		>	on Vetting / Instrumented Dynamic Analysis [Dynamic API/runt
	>	avior that occurs outside expected user context. Because iOS		>	ime trace: Managed app creates NSBackgroundActivityScheduler
	>	exposes weaker direct scheduling observability in many ente		>	activity or registers BGTask with repeating=true or deferre
	>	rprise environments, the analytic anchors first on managed a		>	d interval outside $ApprovedSchedulerApps$ function]; Schedu
	>	pp posture and lifecycle-to-network or lifecycle-to-file eff		>	led Job Creation via Application Vetting / Forensic Acquisit
	>	ects, with NSBackgroundActivityScheduler-related behavior tr		>	ion [Dynamic filesystem trace or acquired app-container/file
	>	eated as strongest when runtime telemetry can observe backgr		>	system artifacts: Scheduled task execution produces network,
	>	ound scheduler usage or execution callbacks.		>	local-write, or sensor artifact while app_state=background
				>	or device_locked=true without user trigger]. Alert on a sequ
				>	ence or state change inconsistent with the device/app baseli
				>	ne, approved management policy, or expected user workflow; d
				>	o not infer unobserved API calls, file/process activity, or
				>	payload content from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.383000+00:00	2026-10-13 17:42:37.873000+00:00
description	The defender correlates creation of background scheduler activity with later execution of repeating or deferred work by the same managed app, then raises confidence when the triggered activity produces network, local-write, or other app behavior that occurs outside expected user context. Because iOS exposes weaker direct scheduling observability in many enterprise environments, the analytic anchors first on managed app posture and lifecycle-to-network or lifecycle-to-file effects, with NSBackgroundActivityScheduler-related behavior treated as strongest when runtime telemetry can observe background scheduler usage or execution callbacks.	For iOS, detect Scheduled Task/Job primarily during application vetting or controlled analysis rather than assuming a live device SOC feed. Correlate OS API Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: Managed app creates NSBackgroundActivityScheduler activity or registers BGTask with repeating=true or deferred interval outside $ApprovedSchedulerApps$ function]; Scheduled Job Creation via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: Scheduled task execution produces network, local-write, or sensor artifact while app_state=background or device_locked=true without user trigger]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--f42df6f0-6395-4f0c-9376-525a031f00c3', 'name': 'MobiledEDR:telemetry', 'channel': 'Scheduled task execution creates cache, staged payload, local output, or collected data artifact immediately after wake or job trigger'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Managed app creates NSBackgroundActivityScheduler activity or registers BGTask with repeating=true or deferred interval outside $ApprovedSchedulerApps$ function'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindow', 'description': 'Correlation window between scheduler creation, later execution, and follow-on file or network behavior'}	{'field': 'ApprovedSchedulerApps', 'description': 'Apps with legitimate scheduled background work: MDM agent (policy sync), email clients (push sync), approved enterprise apps. Derive from MDM catalog. Any unapproved app using repeating scheduled tasks is anomalous.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': 'Application creates or executes NSBackgroundActivityScheduler activity with repeating or deferred invocation semantics during the scheduling and trigger phases'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--f42df6f0-6395-4f0c-9376-525a031f00c3', 'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: Scheduled task execution produces network, local-write, or sensor artifact while app_state=background or device_locked=true without user trigger'}
x_mitre_mutable_elements[1]	{'field': 'AllowedAppList', 'description': 'Managed apps legitimately expected to perform background maintenance or deferred sync behavior'}	{'field': 'ScheduledIntervalThreshold', 'description': 'Default 900s (15 min) minimum suspicious repeat interval. Shorter intervals indicate high-frequency C2 check-in pattern. Derive from legitimate app scheduler baseline.'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_mutable_elements	{'field': 'AllowedExecutionIntervals', 'description': 'Expected repeating interval or defer window for legitimate background activity'}
x_mitre_mutable_elements	{'field': 'ForegroundStateRequired', 'description': 'Whether follow-on behavior from background scheduler execution should require recent user interaction'}
x_mitre_mutable_elements	{'field': 'TriggerToNetworkWindow', 'description': 'Maximum expected delay between scheduled execution and outbound communication'}
x_mitre_mutable_elements	{'field': 'UplinkBytesThreshold', 'description': 'Minimum outbound volume after scheduled execution to treat network behavior as meaningful'}

[AN1831] Analytic 1831

Current version: 1.0

	Old Description			New Description
t	1	Application vetting services could look for usage of the `RE	t	1	For Android, detect Internet Connection Discovery by correla
	>	AD_PRIVILEGED_PHONE_STATE` Android permission. This could in		>	ting analyst-visible device/network evidence and management
	>	dicate that non-system apps are attempting to access informa		>	state; use streaming or batched telemetry only where the doc
	>	tion that they do not have access to.		>	umented collector is deployed. Correlate API Calls via Appli
				>	cation Vetting / Instrumented Dynamic Analysis [Dynamic API/
				>	runtime trace: ConnectivityManager.getActiveNetworkInfo() or
				>	InetAddress.isReachable() called by app NOT IN $Connectivit
				>	yAllowList$ at app launch or on schedule without user action
				>	]; Application State via Android Enterprise / EMM [Managed p
				>	ackage inventory/status and package metadata]; Network Conne
				>	ction Creation via Android Enterprise Network Logging / Ente
				>	rprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEv
				>	ent / ConnectEvent; VPN flow metadata]. Alert on a sequence
				>	or state change inconsistent with the device/app baseline, a
				>	pproved management policy, or expected user workflow; do not
				>	infer unobserved API calls, file/process activity, or paylo
				>	ad content from management state alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ConnectivityAllowList', 'description': 'MDM agent, system services, approved push clients. Minimal.'}, {'field': 'ConnectivityCheckWindow', 'description': 'Default 30s between check and C2.'}, {'field': 'AppCDNList', 'description': 'Per-app CDN. Derive by measurement.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:41:17.819000+00:00
description	Application vetting services could look for usage of the `READ_PRIVILEGED_PHONE_STATE` Android permission. This could indicate that non-system apps are attempting to access information that they do not have access to.	For Android, detect Internet Connection Discovery by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: ConnectivityManager.getActiveNetworkInfo() or InetAddress.isReachable() called by app NOT IN $ConnectivityAllowList$ at app launch or on schedule without user action]; Application State via Android Enterprise / EMM [Managed package inventory/status and package metadata]; Network Connection Creation via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'Application Vetting', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: ConnectivityManager.getActiveNetworkInfo() or InetAddress.isReachable() called by app NOT IN $ConnectivityAllowList$ at app launch or on schedule without user action'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'android:EMM', 'channel': 'Managed package inventory/status and package metadata'}
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba', 'name': 'android:EnterpriseNetworkLog', 'channel': 'DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata'}

[AN1832] Analytic 1832

Current version: 1.0

	Old Description			New Description
t	1	Application vetting services could look for usage of the `RE	t	1	For iOS, detect Internet Connection Discovery by correlating
	>	AD_PRIVILEGED_PHONE_STATE` Android permission. This could in		>	analyst-visible device/network evidence and management stat
	>	dicate that non-system apps are attempting to access informa		>	e; use streaming or batched telemetry only where the documen
	>	tion that they do not have access to.		>	ted collector is deployed. Correlate API Calls via Applicati
				>	on Vetting / Instrumented Dynamic Analysis [Dynamic API/runt
				>	ime trace: NWPathMonitor.start() or SCNetworkReachabilityGet
				>	Flags() called by app NOT IN $ConnectivityAllowList$ at laun
				>	ch or on background schedule]; Application State via Apple M
				>	DM [InstalledApplicationList / ManagedApplicationList]; Netw
				>	ork Connection Creation via Apple Network Extension / Enterp
				>	rise VPN [NEFilterFlow / per-app VPN / secure-web-gateway fl
				>	ow metadata]. Alert on a sequence or state change inconsiste
				>	nt with the device/app baseline, approved management policy,
				>	or expected user workflow; do not infer unobserved API call
				>	s, file/process activity, or payload content from management
				>	state alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ConnectivityAllowList', 'description': 'System framework apps, MDM agent.'}, {'field': 'ConnectivityCheckWindow', 'description': 'Default 30s.'}, {'field': 'AppCDNList', 'description': 'Per-app CDN. Derive by measurement.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:41:18.420000+00:00
description	Application vetting services could look for usage of the `READ_PRIVILEGED_PHONE_STATE` Android permission. This could indicate that non-system apps are attempting to access information that they do not have access to.	For iOS, detect Internet Connection Discovery by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: NWPathMonitor.start() or SCNetworkReachabilityGetFlags() called by app NOT IN $ConnectivityAllowList$ at launch or on background schedule]; Application State via Apple MDM [InstalledApplicationList / ManagedApplicationList]; Network Connection Creation via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'Application Vetting', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: NWPathMonitor.start() or SCNetworkReachabilityGetFlags() called by app NOT IN $ConnectivityAllowList$ at launch or on background schedule'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'iOS:MDM', 'channel': 'InstalledApplicationList / ManagedApplicationList'}
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba', 'name': 'iOS:NetworkExtension', 'channel': 'NEFilterFlow / per-app VPN / secure-web-gateway flow metadata'}

[AN1833] Analytic 1833

Current version: 1.0

	Old Description			New Description
t	1	Application vetting services could look for usage of the `RE	t	1	For Android, detect Wi-Fi Discovery by correlating analyst-v
	>	AD_PRIVILEGED_PHONE_STATE` Android permission. This could in		>	isible device/network evidence and management state; use str
	>	dicate that non-system apps are attempting to access informa		>	eaming or batched telemetry only where the documented collec
	>	tion that they do not have access to.		>	tor is deployed. Correlate API Calls via Application Vetting
				>	/ Instrumented Dynamic Analysis [Dynamic API/runtime trace:
				>	WifiManager.getScanResults()]; Network Traffic Content via
				>	Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspectio
				>	n or proxy transaction metadata where enterprise decryption/
				>	inspection is deployed]; Permissions Request via Android Ent
				>	erprise DPC / Application Vetting [DevicePolicyManager.getPe
				>	rmissionGrantState(); PackageManager manifest/requested-perm
				>	ission review]. Alert on a sequence or state change inconsis
				>	tent with the device/app baseline, approved management polic
				>	y, or expected user workflow; do not infer unobserved API ca
				>	lls, file/process activity, or payload content from manageme
				>	nt state alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'WiFiAllowList', 'description': 'Navigation, enterprise Wi-Fi management apps. Derive from MDM catalog.'}, {'field': 'WiFiScanWindow', 'description': 'Default 30s.'}, {'field': 'AppCDNList', 'description': 'Per-app CDN. Derive by measurement.'}, {'field': 'ExfilWindow', 'description': 'Default 120s.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:41:19.024000+00:00
description	Application vetting services could look for usage of the `READ_PRIVILEGED_PHONE_STATE` Android permission. This could indicate that non-system apps are attempting to access information that they do not have access to.	For Android, detect Wi-Fi Discovery by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: WifiManager.getScanResults()]; Network Traffic Content via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed]; Permissions Request via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'Application Vetting', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: WifiManager.getScanResults()'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'webproxy:applog', 'channel': 'DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed'}
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--e2f72131-14d1-411f-8e8c-aa3453dd5456', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}

[AN1834] Analytic 1834

Current version: 1.0

	Old Description			New Description
t	1	Application vetting services could look for usage of the `RE	t	1	For iOS, detect Wi-Fi Discovery by correlating analyst-visib
	>	AD_PRIVILEGED_PHONE_STATE` Android permission. This could in		>	le device/network evidence and management state; use streami
	>	dicate that non-system apps are attempting to access informa		>	ng or batched telemetry only where the documented collector
	>	tion that they do not have access to.		>	is deployed. Correlate API Calls via Application Vetting / I
				>	nstrumented Dynamic Analysis [Dynamic API/runtime trace: CNC
				>	opyCurrentNetworkInfo() or NEHotspotHelper.register() called
				>	by app NOT IN $WiFiAllowList$]; Network Traffic Content via
				>	Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspecti
				>	on or proxy transaction metadata where enterprise decryption
				>	/inspection is deployed]; Permissions Request via Applicatio
				>	n Vetting [Code-signing entitlements and Info.plist privacy
				>	usage-description keys]. Alert on a sequence or state change
				>	inconsistent with the device/app baseline, approved managem
				>	ent policy, or expected user workflow; do not infer unobserv
				>	ed API calls, file/process activity, or payload content from
				>	management state alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'WiFiAllowList', 'description': 'Enterprise Wi-Fi management, approved hotspot apps. Minimal.'}, {'field': 'AppCDNList', 'description': 'Per-app CDN. Derive by measurement.'}, {'field': 'ExfilWindow', 'description': 'Default 120s.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:41:19.624000+00:00
description	Application vetting services could look for usage of the `READ_PRIVILEGED_PHONE_STATE` Android permission. This could indicate that non-system apps are attempting to access information that they do not have access to.	For iOS, detect Wi-Fi Discovery by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: CNCopyCurrentNetworkInfo() or NEHotspotHelper.register() called by app NOT IN $WiFiAllowList$]; Network Traffic Content via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed]; Permissions Request via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'Application Vetting', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: CNCopyCurrentNetworkInfo() or NEHotspotHelper.register() called by app NOT IN $WiFiAllowList$'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'webproxy:applog', 'channel': 'DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed'}
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--e2f72131-14d1-411f-8e8c-aa3453dd5456', 'name': 'mobile:ApplicationVetting', 'channel': 'Code-signing entitlements and Info.plist privacy usage-description keys'}

[AN1837] Analytic 1837

Current version: 1.1

	Old Description			New Description
t	1	Correlates (1) application registration or activation of bro	t	1	For Android, detect Broadcast Receivers primarily during app
	>	adcast receivers tied to system or app-generated intents, (2		>	lication vetting or controlled analysis rather than assuming
	>	) event-triggered execution while the application is not in		>	a live device SOC feed. Correlate OS API Execution via Appl
	>	the foreground, and (3) immediate follow-on actions such as		>	ication Vetting / Instrumented Dynamic Analysis [Dynamic API
	>	network communication or data access. The defender observes		>	/runtime trace: Application registers BroadcastReceiver via
	>	a causal chain where an external event (e.g., BOOT_COMPLETED		>	registerReceiver() or manifest-declared receiver for sensiti
	>	, SMS_RECEIVED, USER_PRESENT, CONNECTIVITY_CHANGE) triggers		>	ve system intents (BOOT_COMPLETED, SMS_RECEIVED, ACTION_PACK
	>	application execution that bypasses normal user-driven lifec		>	AGE_REPLACED, CONNECTIVITY_CHANGE, USER_PRESENT) NOT IN $App
	>	ycle expectations, followed by background processing or outb		>	rovedReceiverApp]. Alert on a sequence or state change incon
	>	ound activity.		>	sistent with the device/app baseline, approved management po
				>	licy, or expected user workflow; do not infer unobserved API
				>	calls, file/process activity, or payload content from manag
				>	ement state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.384000+00:00	2026-10-13 17:40:57.728000+00:00
description	Correlates (1) application registration or activation of broadcast receivers tied to system or app-generated intents, (2) event-triggered execution while the application is not in the foreground, and (3) immediate follow-on actions such as network communication or data access. The defender observes a causal chain where an external event (e.g., BOOT_COMPLETED, SMS_RECEIVED, USER_PRESENT, CONNECTIVITY_CHANGE) triggers application execution that bypasses normal user-driven lifecycle expectations, followed by background processing or outbound activity.	For Android, detect Broadcast Receivers primarily during application vetting or controlled analysis rather than assuming a live device SOC feed. Correlate OS API Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: Application registers BroadcastReceiver via registerReceiver() or manifest-declared receiver for sensitive system intents (BOOT_COMPLETED, SMS_RECEIVED, ACTION_PACKAGE_REPLACED, CONNECTIVITY_CHANGE, USER_PRESENT) NOT IN $ApprovedReceiverApp]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]['name']	MobileEDR:telemetry	mobile:DynamicAnalysis
x_mitre_log_source_references[0]['channel']	application registers or invokes broadcast receiver via registerReceiver() or manifest-declared receiver + intent filter tied to system or app events	Dynamic API/runtime trace: Application registers BroadcastReceiver via registerReceiver() or manifest-declared receiver for sensitive system intents (BOOT_COMPLETED, SMS_RECEIVED, ACTION_PACKAGE_REPLACED, CONNECTIVITY_CHANGE, USER_PRESENT) NOT IN $ApprovedReceiverApp
x_mitre_mutable_elements[0]	{'field': 'TimeWindow', 'description': 'Time correlation window between broadcast event and subsequent execution or network activity'}	{'field': 'ApprovedReceiverApps', 'description': 'MDM agent (BOOT_COMPLETED for policy enforcement), approved enterprise apps with documented broadcast receiver need. Derive from MDM catalog.'}
x_mitre_mutable_elements[1]	{'field': 'SensitiveIntentList', 'description': 'List of broadcast intents considered high-risk (e.g., BOOT_COMPLETED, SMS_RECEIVED)'}	{'field': 'ReceiverWindow', 'description': 'Default 60s between broadcast receipt and follow-on activity.'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_mutable_elements	{'field': 'AllowedAppList', 'description': 'Baseline of legitimate applications expected to use broadcast receivers for these intents'}
x_mitre_mutable_elements	{'field': 'ForegroundStateRequired', 'description': 'Determines whether execution without foreground presence increases detection confidence'}

[AN1838] Analytic 1838

Current version: 1.0

	Old Description			New Description
t	1	Application vetting services could detect applications tryin	t	1	For Android, detect Compromise Client Software Binary from d
	>	g to modify files in protected parts of the operating system		>	ocumented management, network, or vetting evidence; treat st
	>	. Verified Boot can detect unauthorized modifications to the		>	ate queries as periodic observations rather than real-time e
	>	system partition.(Citation: Android-VerifiedBoot) Android’s		>	vents. Correlate File Metadata via Application Vetting / For
	>	SafetyNet API provides remote attestation capabilities, whi		>	ensic Acquisition [Dynamic filesystem trace or acquired app-
	>	ch could potentially be used to identify and respond to comp		>	container/filesystem artifacts: file hash changes for binary
	>	romised devices. Samsung Knox provides a similar remote atte		>	at $SystemBinaryPaths$ relative to known-good baseline — ha
	>	station capability on supported Samsung devices.		>	sh deviation confirms modification]; File Modification via A
				>	pplication Vetting / Forensic Acquisition [Dynamic filesyste
				>	m trace or acquired app-container/filesystem artifacts: writ
				>	e() to path IN $SystemBinaryPaths$ by process NOT IN $Truste
				>	dUpdateSources$]; Process Creation via Application Vetting /
				>	Managed Device Telemetry [execve() of modified binary (hash
				>	!= baseline) — execution of modified binary is the persiste
				>	nce activation]. Alert on a sequence or state change inconsi
				>	stent with the device/app baseline, approved management poli
				>	cy, or expected user workflow; do not infer unobserved API c
				>	alls, file/process activity, or payload content from managem
				>	ent state alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'SystemBinaryPaths', 'description': '/system/bin/, /system/xbin/, /system/vendor/bin/. Vary by OEM.'}, {'field': 'TrustedUpdateSources', 'description': 'OTA update service, MDM agent. Derive from MDM platform documentation.'}, {'field': 'BinaryHashBaseline', 'description': 'Known-good hash per binary per Android version. Update on each OS release.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:42:05.786000+00:00
description	Application vetting services could detect applications trying to modify files in protected parts of the operating system. Verified Boot can detect unauthorized modifications to the system partition.(Citation: Android-VerifiedBoot) Android’s SafetyNet API provides remote attestation capabilities, which could potentially be used to identify and respond to compromised devices. Samsung Knox provides a similar remote attestation capability on supported Samsung devices.	For Android, detect Compromise Client Software Binary from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate File Metadata via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: file hash changes for binary at $SystemBinaryPaths$ relative to known-good baseline — hash deviation confirms modification]; File Modification via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: write() to path IN $SystemBinaryPaths$ by process NOT IN $TrustedUpdateSources$]; Process Creation via Application Vetting / Managed Device Telemetry [execve() of modified binary (hash != baseline) — execution of modified binary is the persistence activation]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'Application Vetting', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--639e87f3-acb6-448a-9645-258f20da4bc5', 'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: file hash changes for binary at $SystemBinaryPaths$ relative to known-good baseline — hash deviation confirms modification'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--85a533a4-5fa4-4dba-b45d-f0717bedd6e6', 'name': 'Sensor Health', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--84572de3-9583-4c73-aabd-06ea88123dd8', 'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: write() to path IN $SystemBinaryPaths$ by process NOT IN $TrustedUpdateSources$'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'mobile:DynamicAnalysis', 'channel': 'execve() of modified binary (hash != baseline) — execution of modified binary is the persistence activation'}

[AN1839] Analytic 1839

Current version: 1.0

	Old Description			New Description
t	1	Application vetting services could detect applications tryin	t	1	For iOS, detect Compromise Client Software Binary by correla
	>	g to modify files in protected parts of the operating system		>	ting analyst-visible device/network evidence and management
	>	. Verified Boot can detect unauthorized modifications to the		>	state; use streaming or batched telemetry only where the doc
	>	system partition.(Citation: Android-VerifiedBoot) Android’s		>	umented collector is deployed. Correlate File Metadata via A
	>	SafetyNet API provides remote attestation capabilities, whi		>	pplication Vetting / Forensic Acquisition [Dynamic filesyste
	>	ch could potentially be used to identify and respond to comp		>	m trace or acquired app-container/filesystem artifacts: MDM
	>	romised devices. Samsung Knox provides a similar remote atte		>	supervised integrity_check=fail following jailbreak detectio
	>	station capability on supported Samsung devices.		>	n — integrity check failure on supervised Jamf/Intune enroll
				>	ed device indicates filesystem modifications beyond passive
				>	jailbreak presence]; Host Status via Apple MDM [DeviceInform
				>	ation / SecurityInfo / ProfileList / restrictions and compli
				>	ance queries]; Network Traffic Flow via Apple Network Extens
				>	ion / Enterprise VPN [NEFilterFlow / per-app VPN / secure-we
				>	b-gateway flow metadata]. Alert on a sequence or state chang
				>	e inconsistent with the device/app baseline, approved manage
				>	ment policy, or expected user workflow; do not infer unobser
				>	ved API calls, file/process activity, or payload content fro
				>	m management state alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'AppBaselineDomains', 'description': 'Per-device CDN baseline.'}, {'field': 'PostModificationWindow', 'description': 'Default 900s — MDM check-in interval.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:42:06.465000+00:00
description	Application vetting services could detect applications trying to modify files in protected parts of the operating system. Verified Boot can detect unauthorized modifications to the system partition.(Citation: Android-VerifiedBoot) Android’s SafetyNet API provides remote attestation capabilities, which could potentially be used to identify and respond to compromised devices. Samsung Knox provides a similar remote attestation capability on supported Samsung devices.	For iOS, detect Compromise Client Software Binary by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate File Metadata via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: MDM supervised integrity_check=fail following jailbreak detection — integrity check failure on supervised Jamf/Intune enrolled device indicates filesystem modifications beyond passive jailbreak presence]; Host Status via Apple MDM [DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries]; Network Traffic Flow via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'Application Vetting', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--639e87f3-acb6-448a-9645-258f20da4bc5', 'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: MDM supervised integrity_check=fail following jailbreak detection — integrity check failure on supervised Jamf/Intune enrolled device indicates filesystem modifications beyond passive jailbreak presence'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--85a533a4-5fa4-4dba-b45d-f0717bedd6e6', 'name': 'Sensor Health', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--85a533a4-5fa4-4dba-b45d-f0717bedd6e6', 'name': 'iOS:MDM', 'channel': 'DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'iOS:NetworkExtension', 'channel': 'NEFilterFlow / per-app VPN / secure-web-gateway flow metadata'}

[AN1840] Analytic 1840

Current version: 1.1

	Old Description			New Description
t	1	The defender correlates newly granted or recently exercised	t	1	For Android, detect Data from Local System from documented m
	>	storage- or privilege-relevant access with burst reads of lo		>	anagement, network, or vetting evidence; treat state queries
	>	cal files, local databases, or protected records from operat		>	as periodic observations rather than real-time events. Corr
	>	ing-system or external-storage locations, especially when th		>	elate Application Permission via Android Enterprise DPC / Ap
	>	e reads are inconsistent with app role, occur in background		>	plication Vetting [DevicePolicyManager.getPermissionGrantSta
	>	or locked-device context, or are followed by temporary data		>	te(); PackageManager manifest/requested-permission review];
	>	staging or network transmission. The analytic emphasizes And		>	File Access via Application Vetting / Forensic Acquisition [
	>	roid-specific observables such as external storage access, a		>	Dynamic filesystem trace or acquired app-container/filesyste
	>	pp-private database reads where visible to the sensor, and r		>	m artifacts: App reads files across $MinDirectoryCount$+ dis
	>	epeated enumeration/read activity against local paths associ		>	tinct parent directories with file_read_count > $FileReadRat
	>	ated with media, tokens, caches, or exported application dat		>	eThreshold$ within $DataCollectionWindow$ in background or l
	>	a.		>	ow-interaction state — bulk cross-directory read is the coll
				>	ection signal]; OS API Execution via Application Vetting / I
				>	nstrumented Dynamic Analysis [Dynamic API/runtime trace: App
				>	invokes ContentResolver or SAF (Storage Access Framework) q
				>	ueries across multiple user-data paths outside its own sandb
				>	ox in background state]. Alert on a sequence or state change
				>	inconsistent with the device/app baseline, approved managem
				>	ent policy, or expected user workflow; do not infer unobserv
				>	ed API calls, file/process activity, or payload content from
				>	management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.380000+00:00	2026-10-13 17:42:32.334000+00:00
description	The defender correlates newly granted or recently exercised storage- or privilege-relevant access with burst reads of local files, local databases, or protected records from operating-system or external-storage locations, especially when the reads are inconsistent with app role, occur in background or locked-device context, or are followed by temporary data staging or network transmission. The analytic emphasizes Android-specific observables such as external storage access, app-private database reads where visible to the sensor, and repeated enumeration/read activity against local paths associated with media, tokens, caches, or exported application data.	For Android, detect Data from Local System from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; File Access via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: App reads files across $MinDirectoryCount$+ distinct parent directories with file_read_count > $FileReadRateThreshold$ within $DataCollectionWindow$ in background or low-interaction state — bulk cross-directory read is the collection signal]; OS API Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: App invokes ContentResolver or SAF (Storage Access Framework) queries across multiple user-data paths outside its own sandbox in background state]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[3]	{'field': 'ForegroundStateRequired', 'description': 'Whether sensitive local data access should happen only during active user-driven workflows'}	{'field': 'DataCollectionWindow', 'description': 'Default 60s observation window.'}
x_mitre_mutable_elements[1]	{'field': 'AllowedAppList', 'description': 'Apps legitimately expected to read local files or databases such as backup, sync, file manager, security, or media management apps'}	{'field': 'FileReadRateThreshold', 'description': 'Default 50 file reads within window across 3+ directories. Derive from approved backup app baseline. Tightening: 10 reads — catches targeted collection.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:MDMLog', 'channel': 'Managed app granted or retaining storage-related or elevated access inconsistent with declared function prior to local data access activity'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindow', 'description': 'Correlation window between permission state, local data reads, optional staging, and outbound transfer'}	{'field': 'ApprovedDataCollectionApps', 'description': 'Approved backup, sync, file manager, and media apps. Derive from MDM catalog. Tightening: strict list — any unapproved app with broad file access is flagged.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': "Application queries or opens multiple local SQLite or app-associated database stores containing records unrelated to the app's declared function during the collection phase"}	{'x_mitre_data_component_ref': 'x-mitre-data-component--235b7491-2d2b-4617-9a52-3c0783680f71', 'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: App reads files across $MinDirectoryCount$+ distinct parent directories with file_read_count > $FileReadRateThreshold$ within $DataCollectionWindow$ in background or low-interaction state — bulk cross-directory read is the collection signal'}
x_mitre_mutable_elements[2]	{'field': 'AllowedPathList', 'description': 'Expected local paths, storage roots, and database locations for legitimate app behavior'}	{'field': 'MinDirectoryCount', 'description': 'Default 3 distinct parent directories. Single-directory reads may be legitimate (photo editor); cross-directory reads indicate collection sweep.'}
x_mitre_mutable_elements[4]	{'field': 'BurstReadThreshold', 'description': 'Minimum number of file or record reads within a short interval required to indicate suspicious collection'}	{'field': 'AppCDNList', 'description': 'Per-app CDN baseline.'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--235b7491-2d2b-4617-9a52-3c0783680f71', 'name': 'MobileEDR:telemetry', 'channel': 'Application performs burst reads across local system paths, external storage, media directories, cache locations, or local database files within a short interval as the primary collection phase'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes ContentResolver or SAF (Storage Access Framework) queries across multiple user-data paths outside its own sandbox in background state'}
x_mitre_mutable_elements[5]	{'field': 'SensitivePathPatterns', 'description': 'Environment-specific list of high-value local paths such as external media roots, app export folders, token stores, or browser data locations'}	{'field': 'ExfilWindow', 'description': 'Default 120s between staging and upload.'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_mutable_elements	{'field': 'UplinkBytesThreshold', 'description': 'Minimum upload size expected if collection is followed by exfiltration'}

[AN1841] Analytic 1841

Current version: 1.1

	Old Description			New Description
t	1	The defender correlates supervised-device app posture and li	t	1	For iOS, detect Data from Local System primarily during appl
	>	fecycle context with repeated local file or local-database a		>	ication vetting or controlled analysis rather than assuming
	>	ccess effects, especially when a managed app reads browser,		>	a live device SOC feed. Correlate Application Permission via
	>	messaging, keychain-adjacent, or application-container data		>	Application Vetting [Code-signing entitlements and Info.pli
	>	outside its expected role and then stages or uploads the res		>	st privacy usage-description keys]; File Access via Applicat
	>	ult. Because direct low-level local system access visibility		>	ion Vetting / Forensic Acquisition [Dynamic filesystem trace
	>	is weaker on iOS, the primary analytic is effect-based: man		>	or acquired app-container/filesystem artifacts: App reads m
	>	aged app identity, file/database access where visible to the		>	ultiple files from Photos library, Files provider, or iCloud
	>	mobile sensor, background execution context, and near-term		>	Drive in background or lock-adjacent state exceeding $FileR
	>	outbound communication.		>	eadRateThreshold$ within $DataCollectionWindow$]; OS API Exe
				>	cution via Application Vetting / Instrumented Dynamic Analys
				>	is [Dynamic API/runtime trace: Managed app accesses broad lo
				>	cal data scope without user-initiated document picker intera
				>	ction on supervised device]. Alert on a sequence or state ch
				>	ange inconsistent with the device/app baseline, approved man
				>	agement policy, or expected user workflow; do not infer unob
				>	served API calls, file/process activity, or payload content
				>	from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.381000+00:00	2026-10-13 17:42:33.001000+00:00
description	The defender correlates supervised-device app posture and lifecycle context with repeated local file or local-database access effects, especially when a managed app reads browser, messaging, keychain-adjacent, or application-container data outside its expected role and then stages or uploads the result. Because direct low-level local system access visibility is weaker on iOS, the primary analytic is effect-based: managed app identity, file/database access where visible to the mobile sensor, background execution context, and near-term outbound communication.	For iOS, detect Data from Local System primarily during application vetting or controlled analysis rather than assuming a live device SOC feed. Correlate Application Permission via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]; File Access via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: App reads multiple files from Photos library, Files provider, or iCloud Drive in background or lock-adjacent state exceeding $FileReadRateThreshold$ within $DataCollectionWindow$]; OS API Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: Managed app accesses broad local data scope without user-initiated document picker interaction on supervised device]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[3]	{'field': 'ForegroundStateRequired', 'description': 'Whether local record access should happen only during active user interaction'}	{'field': 'DataCollectionWindow', 'description': 'Default 60s observation window.'}
x_mitre_mutable_elements[1]	{'field': 'AllowedAppList', 'description': 'Managed apps expected to access local records such as enterprise sync, backup, or approved investigation tools'}	{'field': 'FileReadRateThreshold', 'description': 'Default 50 file reads within window across 3+ directories. Derive from approved backup app baseline. Tightening: 10 reads — catches targeted collection.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'iOS:MDMLog', 'channel': 'Supervised managed app without expected local export, sync, or forensic role accesses or stages local records inconsistent with policy baseline'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'mobile:ApplicationVetting', 'channel': 'Code-signing entitlements and Info.plist privacy usage-description keys'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindow', 'description': 'Correlation window between managed app posture, local access activity, optional staging, and upload'}	{'field': 'ApprovedDataCollectionApps', 'description': 'Approved backup, sync, file manager, and media apps. Derive from MDM catalog. Tightening: strict list — any unapproved app with broad file access is flagged.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': 'Application performs repeated record access, container traversal, or local data extraction processing against local stores before staging or transmission'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--235b7491-2d2b-4617-9a52-3c0783680f71', 'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: App reads multiple files from Photos library, Files provider, or iCloud Drive in background or lock-adjacent state exceeding $FileReadRateThreshold$ within $DataCollectionWindow$'}
x_mitre_mutable_elements[2]	{'field': 'AllowedContainerPatterns', 'description': 'Expected app-container or local artifact locations for legitimate workflows'}	{'field': 'MinDirectoryCount', 'description': 'Default 3 distinct parent directories. Single-directory reads may be legitimate (photo editor); cross-directory reads indicate collection sweep.'}
x_mitre_mutable_elements[4]	{'field': 'BurstReadThreshold', 'description': 'Minimum number of local file or record reads in a short interval required for alerting'}	{'field': 'AppCDNList', 'description': 'Per-app CDN baseline.'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--235b7491-2d2b-4617-9a52-3c0783680f71', 'name': 'MobileEDR:telemetry', 'channel': 'Application reads multiple local container files, browser-history artifacts, messaging artifacts, or local records in rapid sequence during the collection phase'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Managed app accesses broad local data scope without user-initiated document picker interaction on supervised device'}
x_mitre_mutable_elements[5]	{'field': 'SensitiveArtifactPatterns', 'description': 'Environment-specific list of high-value browser, messaging, token, or local record artifacts'}	{'field': 'ExfilWindow', 'description': 'Default 120s between staging and upload.'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_mutable_elements	{'field': 'UplinkBytesThreshold', 'description': 'Minimum outbound volume consistent with recent local data collection'}

[AN1842] Analytic 1842

Current version: 1.1

	Old Description			New Description
t	1	Correlates (1) suppression or disablement of launcher-visibl	t	1	For Android, detect Suppress Application Icon from documente
	>	e application components or effective reduction of user-faci		>	d management, network, or vetting evidence; treat state quer
	>	ng launcher presence, (2) persistence of installed applicati		>	ies as periodic observations rather than real-time events. C
	>	on state after icon suppression, and (3) continued runtime a		>	orrelate Application Permission via Android Enterprise DPC /
	>	ctivity such as background execution, framework use, sensor		>	Application Vetting [DevicePolicyManager.getPermissionGrant
	>	access, or network communication after the icon becomes unav		>	State(); PackageManager manifest/requested-permission review
	>	ailable or is replaced by reduced-discoverability launcher b		>	]; OS API Execution via Application Vetting / Instrumented D
	>	ehavior. The defender observes a causal chain where an app r		>	ynamic Analysis [Dynamic API/runtime trace: App invokes Pack
	>	emoves or reduces its launcher visibility while remaining op		>	ageManager.setComponentEnabledSetting() to COMPONENT_ENABLED
	>	erational and continuing meaningful activity.		>	_STATE_DISABLED on its own LAUNCHER activity while continuin
				>	g active background or foreground-service execution]. Alert
				>	on a sequence or state change inconsistent with the device/a
				>	pp baseline, approved management policy, or expected user wo
				>	rkflow; do not infer unobserved API calls, file/process acti
				>	vity, or payload content from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.380000+00:00	2026-10-13 17:40:58.272000+00:00
description	Correlates (1) suppression or disablement of launcher-visible application components or effective reduction of user-facing launcher presence, (2) persistence of installed application state after icon suppression, and (3) continued runtime activity such as background execution, framework use, sensor access, or network communication after the icon becomes unavailable or is replaced by reduced-discoverability launcher behavior. The defender observes a causal chain where an app removes or reduces its launcher visibility while remaining operational and continuing meaningful activity.	For Android, detect Suppress Application Icon from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; OS API Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: App invokes PackageManager.setComponentEnabledSetting() to COMPONENT_ENABLED_STATE_DISABLED on its own LAUNCHER activity while continuing active background or foreground-service execution]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:MDMLog', 'channel': 'installed application remains present while launcher-visible activity or component discoverability changes to hidden, disabled, or synthesized-settings-entry state prior to later runtime activity'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindow', 'description': 'Correlation window between icon suppression and later runtime activity'}	{'field': 'KnownHeadlessApps', 'description': 'Enterprise apps legitimately designed without launcher icons (MDM agent, background sync daemons). Derive from MDM catalog. Tightening: empty — all icon suppression during active execution is flagged.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': 'application invokes package or component state changes affecting launcher-facing activity availability and subsequently continues operational framework activity after icon suppression'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes PackageManager.setComponentEnabledSetting() to COMPONENT_ENABLED_STATE_DISABLED on its own LAUNCHER activity while continuing active background or foreground-service execution'}
x_mitre_mutable_elements[1]	{'field': 'AllowedAppList', 'description': 'Baseline of legitimate apps permitted to reduce launcher visibility, such as managed agents, work-profile utilities, or system applications'}	{'field': 'ApprovedMediaApps', 'description': 'Media editing, backup, and secure note apps with legitimate need to manage media file visibility. Derive from MDM catalog. Tightening: empty — any app hiding multimedia files post-collection is anomalous.'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_mutable_elements	{'field': 'ForegroundStateRequired', 'description': 'Whether post-suppression behavior is only suspicious when no recent foreground interaction is present'}
x_mitre_mutable_elements	{'field': 'SuppressionMode', 'description': 'Environment-specific handling of hidden, disabled, or synthesized launcher behavior depending on Android version and management posture'}
x_mitre_mutable_elements	{'field': 'UplinkBytesThreshold', 'description': 'Minimum outbound traffic volume used to distinguish meaningful hidden operation from benign background maintenance'}
x_mitre_mutable_elements	{'field': 'SensorAfterSuppressionThreshold', 'description': 'Threshold for sensor access frequency after launcher visibility is reduced'}

[AN1843] Analytic 1843

Current version: 1.0

	Old Description			New Description
t	1	Unexpected behavior from an application could be an indicato	t	1	For Android, detect Masquerading from documented management,
	>	r of masquerading. Application vetting services may potentia		>	network, or vetting evidence; treat state queries as period
	>	lly determine if an application contains suspicious code and		>	ic observations rather than real-time events. Correlate Appl
	>	/or metadata.		>	ication Permission via Android Enterprise DPC / Application
				>	Vetting [DevicePolicyManager.getPermissionGrantState(); Pack
				>	ageManager manifest/requested-permission review]; File Creat
				>	ion via Application Vetting / Forensic Acquisition [Dynamic
				>	filesystem trace or acquired app-container/filesystem artifa
				>	cts: app binary written to device storage as part of install
				>	— confirms impersonating app is being persisted]; File Meta
				>	data via Application Vetting / Forensic Acquisition [Dynamic
				>	filesystem trace or acquired app-container/filesystem artif
				>	acts: installed app package_name Levenshtein distance <= $Na
				>	meDistanceThreshold$ to entry in $KnownAppCatalog$]. Alert o
				>	n a sequence or state change inconsistent with the device/ap
				>	p baseline, approved management policy, or expected user wor
				>	kflow; do not infer unobserved API calls, file/process activ
				>	ity, or payload content from management state alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'NameDistanceThreshold', 'description': 'Default Levenshtein distance 2. Tightening: 1 — only single-char variants. Loosening: 3 — more coverage, more FP.'}, {'field': 'KnownAppCatalog', 'description': 'MDM-approved catalog plus Play Store reference catalog with cert fingerprints. Update with each new enterprise app deployment.'}, {'field': 'IconHashThreshold', 'description': 'Default perceptual hash distance < 10. Derive from baseline icon hash comparison.'}, {'field': 'MDMApprovedCatalog', 'description': 'MDM-managed app list.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:42:07.118000+00:00
description	Unexpected behavior from an application could be an indicator of masquerading. Application vetting services may potentially determine if an application contains suspicious code and/or metadata.	For Android, detect Masquerading from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; File Creation via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: app binary written to device storage as part of install — confirms impersonating app is being persisted]; File Metadata via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: installed app package_name Levenshtein distance <= $NameDistanceThreshold$ to entry in $KnownAppCatalog$]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--bf0ff551-a5a7-40e5-bff9-f9405011b1f4', 'name': 'User Interface', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'Application Vetting', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: app binary written to device storage as part of install — confirms impersonating app is being persisted'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--639e87f3-acb6-448a-9645-258f20da4bc5', 'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: installed app package_name Levenshtein distance <= $NameDistanceThreshold$ to entry in $KnownAppCatalog$'}

[AN1844] Analytic 1844

Current version: 1.0

	Old Description			New Description
t	1	Unexpected behavior from an application could be an indicato	t	1	For iOS, detect Masquerading by correlating analyst-visible
	>	r of masquerading. Application vetting services may potentia		>	device/network evidence and management state; use streaming
	>	lly determine if an application contains suspicious code and		>	or batched telemetry only where the documented collector is
	>	/or metadata.		>	deployed. Correlate Application Permission via Application V
				>	etting [Code-signing entitlements and Info.plist privacy usa
				>	ge-description keys]; File Metadata via Application Vetting
				>	/ Forensic Acquisition [Dynamic filesystem trace or acquired
				>	app-container/filesystem artifacts: bundle_id LIKE $KnownSy
				>	stemNamespace$]; Network Traffic Flow via Apple Network Exte
				>	nsion / Enterprise VPN [NEFilterFlow / per-app VPN / secure-
				>	web-gateway flow metadata]. Alert on a sequence or state cha
				>	nge inconsistent with the device/app baseline, approved mana
				>	gement policy, or expected user workflow; do not infer unobs
				>	erved API calls, file/process activity, or payload content f
				>	rom management state alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'KnownSystemNamespace', 'description': 'com.apple., org.whispersystems., com.google.* — reserved/well-known namespaces.'}, {'field': 'MDMApprovedCatalog', 'description': 'MDM-managed app list.'}, {'field': 'ImpersonatedAppPermissionProfile', 'description': 'Permission set of each known-good app that could be impersonated. Derive from MDM app catalog audit.'}, {'field': 'ImpersonatedAppCDN', 'description': 'Known network destinations for each enterprise app that could be impersonated.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:42:07.768000+00:00
description	Unexpected behavior from an application could be an indicator of masquerading. Application vetting services may potentially determine if an application contains suspicious code and/or metadata.	For iOS, detect Masquerading by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]; File Metadata via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: bundle_id LIKE $KnownSystemNamespace$]; Network Traffic Flow via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--bf0ff551-a5a7-40e5-bff9-f9405011b1f4', 'name': 'User Interface', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'mobile:ApplicationVetting', 'channel': 'Code-signing entitlements and Info.plist privacy usage-description keys'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'Application Vetting', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--639e87f3-acb6-448a-9645-258f20da4bc5', 'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: bundle_id LIKE $KnownSystemNamespace$'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'iOS:NetworkExtension', 'channel': 'NEFilterFlow / per-app VPN / secure-web-gateway flow metadata'}

[AN1845] Analytic 1845

Current version: 1.0

+For Android, detect Linked Devices by correlating analyst-vi
->
+sible device/network evidence and management state; use stre
+aming or batched telemetry only where the documented collect
+or is deployed. Correlate API Calls via Application Vetting
+/ Instrumented Dynamic Analysis [Dynamic API/runtime trace:
+camera activated within app IN $MessagingAppList$ — QR scan
+requires camera access; activation in messaging app context
+is the trigger signal]; Network Connection Creation via Andr
+oid Enterprise Network Logging / Enterprise VPN [DevicePolic
+yManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN
+ flow metadata]; Network Traffic Content via Enterprise Secu
+re Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy tran
+saction metadata where enterprise decryption/inspection is d
+eployed]. Alert on a sequence or state change inconsistent w
+ith the device/app baseline, approved management policy, or
+expected user workflow; do not infer unobserved API calls, f
+ile/process activity, or payload content from management sta
+te alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'MessagingAppList', 'description': 'org.thoughtcrime.securesms (Signal), com.whatsapp, com.whatsapp.w4b.'}, {'field': 'DeviceLinkAPIEndpoints', 'description': '/v1/devices, /v1/provisioning, /linked — Signal and WhatsApp device registration URI patterns.'}, {'field': 'QRLinkWindow', 'description': 'Default 30s between camera activation and device link PUT — QR scan to registration is near-instantaneous.'}, {'field': 'SyncVolumeThreshold', 'description': 'Default 5MB — message history sync is significantly larger than normal registration.'}, {'field': 'SyncWindow', 'description': 'Default 120s after device link PUT.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:42:18.267000+00:00
description	The OS may show a notification to the user that the Signal or WhatsApp account has been linked to a new device.	For Android, detect Linked Devices by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: camera activated within app IN $MessagingAppList$ — QR scan requires camera access; activation in messaging app context is the trigger signal]; Network Connection Creation via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]; Network Traffic Content via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--bf0ff551-a5a7-40e5-bff9-f9405011b1f4', 'name': 'User Interface', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: camera activated within app IN $MessagingAppList$ — QR scan requires camera access; activation in messaging app context is the trigger signal'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba', 'name': 'android:EnterpriseNetworkLog', 'channel': 'DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata'}
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'webproxy:applog', 'channel': 'DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed'}

[AN1846] Analytic 1846

Current version: 1.0

+For iOS, detect Linked Devices by correlating analyst-visibl
->
+e device/network evidence and management state; use streamin
+g or batched telemetry only where the documented collector i
+s deployed. Correlate Network Connection Creation via Apple
+Network Extension / Enterprise VPN [NEFilterFlow / per-app V
+PN / secure-web-gateway flow metadata]; Network Traffic Cont
+ent via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) i
+nspection or proxy transaction metadata where enterprise dec
+ryption/inspection is deployed]; Permissions Request via App
+lication Vetting [Code-signing entitlements and Info.plist p
+rivacy usage-description keys]. Alert on a sequence or state
+ change inconsistent with the device/app baseline, approved
+management policy, or expected user workflow; do not infer u
+nobserved API calls, file/process activity, or payload conte
+nt from management state alone.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'MessagingBundleIDs', 'description': 'org.whispersystems.signal, net.whatsapp.WhatsApp.'}, {'field': 'DeviceLinkAPIEndpoints', 'description': '/v1/devices, /v1/provisioning URI patterns for Signal and WhatsApp. Update from platform API documentation.'}, {'field': 'QRLinkWindow', 'description': 'Default 30s between camera activation and device-link PUT — human QR scan-to-submit timing. Tightening: 15s.'}, {'field': 'SyncVolumeThreshold', 'description': 'Default 5MB — message history sync is large relative to registration overhead.'}, {'field': 'SyncWindow', 'description': 'Default 120s after device-link PUT.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:42:18.934000+00:00
description	The OS may show a notification to the user that the Signal or WhatsApp account has been linked to a new device.	For iOS, detect Linked Devices by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Network Connection Creation via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]; Network Traffic Content via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed]; Permissions Request via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--bf0ff551-a5a7-40e5-bff9-f9405011b1f4', 'name': 'User Interface', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba', 'name': 'iOS:NetworkExtension', 'channel': 'NEFilterFlow / per-app VPN / secure-web-gateway flow metadata'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'webproxy:applog', 'channel': 'DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed'}
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--e2f72131-14d1-411f-8e8c-aa3453dd5456', 'name': 'mobile:ApplicationVetting', 'channel': 'Code-signing entitlements and Info.plist privacy usage-description keys'}

[AN1847] Analytic 1847

Current version: 1.1

	Old Description			New Description
t	1	The defender correlates application loading or invoking nati	t	1	For Android, detect Native API from documented management, n
	>	ve libraries through JNI or NDK-backed execution paths with		>	etwork, or vetting evidence; treat state queries as periodic
	>	subsequent lower-level activity such as native thread creati		>	observations rather than real-time events. Correlate Applic
	>	on, sensor access, file operations, or outbound network comm		>	ation Permission via Android Enterprise DPC / Application Ve
	>	unication that is inconsistent with the app's declared role		>	tting [DevicePolicyManager.getPermissionGrantState(); Packag
	>	or recent user interaction. The analytic prioritizes defende		>	eManager manifest/requested-permission review]; Application
	>	r-observable control-plane effects: native library load or J		>	State via Android Enterprise / EMM [Managed package inventor
	>	NI bridge use, transition into native execution context, and		>	y/status and package metadata]; OS API Execution via Applica
	>	immediate post-load behavior occurring from background stat		>	tion Vetting / Instrumented Dynamic Analysis [Dynamic API/ru
	>	e, locked-device state, or non-baselined app categories.		>	ntime trace: App loads native library (.so) or resolves JNI
				>	bridge NOT IN $ApprovedNativeLibraries$ immediately before s
				>	uspicious lower-level activity (sensor access, file write, n
				>	etwork connection) — native code loading before anomalous ac
				>	tivity is the]. Alert on a sequence or state change inconsis
				>	tent with the device/app baseline, approved management polic
				>	y, or expected user workflow; do not infer unobserved API ca
				>	lls, file/process activity, or payload content from manageme
				>	nt state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.377000+00:00	2026-10-13 17:42:35.808000+00:00
description	The defender correlates application loading or invoking native libraries through JNI or NDK-backed execution paths with subsequent lower-level activity such as native thread creation, sensor access, file operations, or outbound network communication that is inconsistent with the app's declared role or recent user interaction. The analytic prioritizes defender-observable control-plane effects: native library load or JNI bridge use, transition into native execution context, and immediate post-load behavior occurring from background state, locked-device state, or non-baselined app categories.	For Android, detect Native API from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; Application State via Android Enterprise / EMM [Managed package inventory/status and package metadata]; OS API Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: App loads native library (.so) or resolves JNI bridge NOT IN $ApprovedNativeLibraries$ immediately before suspicious lower-level activity (sensor access, file write, network connection) — native code loading before anomalous activity is the]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[1]	{'field': 'AllowedAppList', 'description': 'Apps legitimately expected to use native code, such as games, media, enterprise VPN, security tools, or performance-intensive apps'}	{'field': 'NativeActivityWindow', 'description': 'Default 30s between native library load and anomalous activity. Native code executes synchronously after load.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': 'Application loads or resolves native shared library (.so) or JNI bridge immediately before suspicious native execution phase'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}
x_mitre_log_source_references[3]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:MDMLog', 'channel': 'Managed application without approved native-code role or expected high-performance/native dependency exhibits native execution behavior inconsistent with enterprise policy baseline'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App transitions from managed-code execution into JNI/native function context or attaches native thread,'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindow', 'description': 'Correlation window between native library load, JNI/native execution, and follow-on behavior'}	{'field': 'ApprovedNativeLibraries', 'description': 'Expected native libraries for each app (game engines: Unity/libil2cpp, Unreal; media: libffmpeg; React Native: libreactnative). Derive from app package manifest and vendor documentation. Tightening: strict per-app allowlist.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': 'Application transitions from managed code into JNI/native function execution or attaches native thread to runtime during the execution phase'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'android:EMM', 'channel': 'Managed package inventory/status and package metadata'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'MobileEDR:telemetry', 'channel': 'Native library load or JNI-backed execution occurs while app_state=background or device_locked=true or recent_user_interaction=false during the execution phase'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App loads native library (.so) or resolves JNI bridge NOT IN $ApprovedNativeLibraries$ immediately before suspicious lower-level activity (sensor access, file write, network connection) — native code loading before anomalous activity is the'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_mutable_elements	{'field': 'AllowedLibraryPatterns', 'description': 'Expected native library names, paths, signing attributes, or packaging patterns for approved applications'}
x_mitre_mutable_elements	{'field': 'ForegroundStateRequired', 'description': 'Whether native execution should only occur during active user-driven workflows for a given app role'}
x_mitre_mutable_elements	{'field': 'LibraryPathPatterns', 'description': 'Environment-specific list of suspicious temporary, extracted, or dynamically staged native library locations'}
x_mitre_mutable_elements	{'field': 'PostLoadBehaviorThreshold', 'description': 'Minimum number or severity of suspicious actions after native load required to elevate confidence'}
x_mitre_mutable_elements	{'field': 'UplinkBytesThreshold', 'description': 'Minimum outbound volume after native execution to treat network activity as meaningful follow-on behavior'}

[AN1848] Analytic 1848

Current version: 1.1

	Old Description			New Description
t	1	The defender correlates an application establishing outbound	t	1	For Android, detect Ingress Tool Transfer by correlating ana
	>	retrieval to a non-baselined external source with immediate		>	lyst-visible device/network evidence and management state; u
	>	local creation of a new executable, module, staged payload,		>	se streaming or batched telemetry only where the documented
	>	overlay asset, or secondary file in app-controlled or share		>	collector is deployed. Correlate Application Permission via
	>	d storage, followed by optional load, invocation, handoff, o		>	Android Enterprise DPC / Application Vetting [DevicePolicyMa
	>	r repeat retrieval behavior. The analytic prioritizes Androi		>	nager.getPermissionGrantState(); PackageManager manifest/req
	>	d-observable effects: network download activity, DownloadMan		>	uested-permission review]; Application State via Android Ent
	>	ager or direct HTTP retrieval, file creation in package-spec		>	erprise / EMM [Managed package inventory/status and package
	>	ific or external paths, and execution context inconsistent w		>	metadata]; File Creation via Application Vetting / Forensic
	>	ith recent user interaction or the app’s declared role.		>	Acquisition [Dynamic filesystem trace or acquired app-contai
				>	ner/filesystem artifacts: App writes newly retrieved binary,
				>	archive, native library (.so), DEX, or script to /data/data
				>	/<app>/files/, cache, or shared storage within $IngressWrite
				>	Window$ of network retrieval from non-CDN source]. Alert on
				>	a sequence or state change inconsistent with the device/app
				>	baseline, approved management policy, or expected user workf
				>	low; do not infer unobserved API calls, file/process activit
				>	y, or payload content from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.379000+00:00	2026-10-13 17:42:34.367000+00:00
description	The defender correlates an application establishing outbound retrieval to a non-baselined external source with immediate local creation of a new executable, module, staged payload, overlay asset, or secondary file in app-controlled or shared storage, followed by optional load, invocation, handoff, or repeat retrieval behavior. The analytic prioritizes Android-observable effects: network download activity, DownloadManager or direct HTTP retrieval, file creation in package-specific or external paths, and execution context inconsistent with recent user interaction or the app’s declared role.	For Android, detect Ingress Tool Transfer by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; Application State via Android Enterprise / EMM [Managed package inventory/status and package metadata]; File Creation via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: App writes newly retrieved binary, archive, native library (.so), DEX, or script to /data/data//files/, cache, or shared storage within $IngressWriteWindow$ of network retrieval from non-CDN source]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[3]	{'field': 'AllowedPathList', 'description': 'Expected local download, cache, and update paths for legitimate app behavior'}	{'field': 'IngressExecWindow', 'description': 'Default 120s between local file write and exec invocation. Tightening: 30s — immediate load after write.'}
x_mitre_mutable_elements[1]	{'field': 'AllowedAppList', 'description': 'Apps legitimately expected to download files such as browsers, enterprise app stores, backup/sync tools, or content delivery apps'}	{'field': 'ApprovedDownloadApps', 'description': 'Browser, MDM agent, enterprise content apps approved for remote retrieval. Derive from MDM catalog.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'NSM:Flow', 'channel': 'Application retrieves remote content from non-baselined domain or IP and the transfer direction is inbound to device during the file acquisition phase'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}
x_mitre_log_source_references[4]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:MDMLog', 'channel': 'Managed app without approved content-download, update, browser, or file-sync role performs remote payload retrieval and local tool staging'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App invokes DownloadManager, URLConnection, or OkHttp download to write retrieved content to app-controlled path outside original APK scope — programmatic download of executable artifact'}
x_mitre_log_source_references[3]	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'MobileEDR:telemetry', 'channel': 'Ingress transfer and local file creation occur while app_state=background or device_locked=true or recent_user_interaction=false during the acquisition phase'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'webproxy:applog', 'channel': 'DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindow', 'description': 'Correlation window between remote retrieval, local write, and any follow-on load or transfer completion'}	{'field': 'AppCDNList', 'description': '30-day per-app network destination baseline. Any download from outside this list is anomalous.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': 'Application invokes direct file retrieval, DownloadManager usage, or streaming write from network response to local storage immediately after remote session establishment'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'android:EMM', 'channel': 'Managed package inventory/status and package metadata'}
x_mitre_mutable_elements[2]	{'field': 'AllowedDestinationList', 'description': 'Approved software distribution, CDN, MDM, and enterprise update endpoints'}	{'field': 'IngressWriteWindow', 'description': 'Default 60s between network retrieval and local file write. Tightening: 15s — synchronous download-write.'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'MobileEDR:telemetry', 'channel': 'Application writes newly retrieved binary, archive, script-like asset, overlay content, library, or opaque payload to app-private, cache, temp, or shared external path as the primary local effect of transfer'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: App writes newly retrieved binary, archive, native library (.so), DEX, or script to /data/data//files/, cache, or shared storage within $IngressWriteWindow$ of network retrieval from non-CDN source'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_mutable_elements	{'field': 'IngressBytesThreshold', 'description': 'Minimum inbound transfer size consistent with a staged secondary tool or payload'}
x_mitre_mutable_elements	{'field': 'ForegroundStateRequired', 'description': 'Whether file retrieval should occur only during active user-driven workflows'}
x_mitre_mutable_elements	{'field': 'FileTypeRiskPatterns', 'description': 'Environment-specific set of retrieved file classes considered suspicious such as apk, dex, jar, so, zip, html overlay, or opaque blob'}

[AN1849] Analytic 1849

Current version: 1.1

	Old Description			New Description
t	1	The defender correlates managed-app network retrieval from a	t	1	For iOS, detect Ingress Tool Transfer by correlating analyst
	>	non-baselined external source with immediate creation of a		>	-visible device/network evidence and management state; use s
	>	new local artifact, staged resource, module-like file, or op		>	treaming or batched telemetry only where the documented coll
	>	aque payload inside the app container, followed by optional		>	ector is deployed. Correlate Application Permission via Appl
	>	dynamic loading, handoff, or repeat retrieval behavior. Beca		>	ication Vetting [Code-signing entitlements and Info.plist pr
	>	use iOS offers weaker direct visibility into tool staging in		>	ivacy usage-description keys]; Application State via Apple M
	>	ternals than Android in many environments, the analytic anch		>	DM [InstalledApplicationList / ManagedApplicationList]; File
	>	ors first on network acquisition plus managed app identity a		>	Creation via Application Vetting / Forensic Acquisition [Dy
	>	nd then strengthens confidence with file creation or process		>	namic filesystem trace or acquired app-container/filesystem
	>	-activity effects where mobile telemetry is available.		>	artifacts: Managed app writes newly retrieved container-loca
				>	l file, dylib-like resource, or opaque payload after downloa
				>	d from non-CDN source]. Alert on a sequence or state change
				>	inconsistent with the device/app baseline, approved manageme
				>	nt policy, or expected user workflow; do not infer unobserve
				>	d API calls, file/process activity, or payload content from
				>	management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.382000+00:00	2026-10-13 17:42:35.098000+00:00
description	The defender correlates managed-app network retrieval from a non-baselined external source with immediate creation of a new local artifact, staged resource, module-like file, or opaque payload inside the app container, followed by optional dynamic loading, handoff, or repeat retrieval behavior. Because iOS offers weaker direct visibility into tool staging internals than Android in many environments, the analytic anchors first on network acquisition plus managed app identity and then strengthens confidence with file creation or process-activity effects where mobile telemetry is available.	For iOS, detect Ingress Tool Transfer by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]; Application State via Apple MDM [InstalledApplicationList / ManagedApplicationList]; File Creation via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: Managed app writes newly retrieved container-local file, dylib-like resource, or opaque payload after download from non-CDN source]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[3]	{'field': 'AllowedContainerPatterns', 'description': 'Expected app-container paths for legitimate downloaded assets'}	{'field': 'IngressExecWindow', 'description': 'Default 120s between local file write and exec invocation. Tightening: 30s — immediate load after write.'}
x_mitre_mutable_elements[1]	{'field': 'AllowedAppList', 'description': 'Managed apps legitimately expected to download secondary content or updates'}	{'field': 'ApprovedDownloadApps', 'description': 'Browser, MDM agent, enterprise content apps approved for remote retrieval. Derive from MDM catalog.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'NSM:Flow', 'channel': 'Managed iOS app retrieves remote content from non-baselined domain or IP with inbound payload transfer during the acquisition phase'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'mobile:ApplicationVetting', 'channel': 'Code-signing entitlements and Info.plist privacy usage-description keys'}
x_mitre_log_source_references[4]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'iOS:MDMLog', 'channel': 'Supervised managed app without approved update, browser, sync, or enterprise-content role retrieves and stages secondary content inconsistent with policy baseline'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Managed app performs post-download processing, dynamic resource handling, or module preparation immediately after retrieval from non-CDN source on supervised device'}
x_mitre_log_source_references[3]	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'MobileEDR:telemetry', 'channel': 'Ingress retrieval and staging occur while app_state=background or device_locked=true or recent_user_interaction=false during the acquisition phase'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'webproxy:applog', 'channel': 'DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindow', 'description': 'Correlation window between remote retrieval, local staging, and any follow-on file handling'}	{'field': 'AppCDNList', 'description': '30-day per-app network destination baseline. Any download from outside this list is anomalous.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'MobileEDR:telemetry', 'channel': 'Managed app writes newly retrieved container-local asset, dylib-like resource, archive, or opaque payload shortly after remote retrieval as the strongest local effect'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'iOS:MDM', 'channel': 'InstalledApplicationList / ManagedApplicationList'}
x_mitre_mutable_elements[2]	{'field': 'AllowedDestinationList', 'description': 'Approved content, MDM, enterprise, and application-update endpoints'}	{'field': 'IngressWriteWindow', 'description': 'Default 60s between network retrieval and local file write. Tightening: 15s — synchronous download-write.'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': 'Managed app performs post-download unpacking, dynamic resource handling, or module preparation immediately after local payload creation'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: Managed app writes newly retrieved container-local file, dylib-like resource, or opaque payload after download from non-CDN source'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_mutable_elements	{'field': 'IngressBytesThreshold', 'description': 'Minimum inbound transfer volume consistent with secondary tool or payload retrieval'}
x_mitre_mutable_elements	{'field': 'ForegroundStateRequired', 'description': 'Whether retrieval should happen only in active user-driven workflows'}
x_mitre_mutable_elements	{'field': 'ArtifactRiskPatterns', 'description': 'Environment-specific file or content patterns considered suspicious such as staged dylib-like resources, html overlays, archives, or opaque blobs'}

[AN1850] Analytic 1850

Current version: 1.1

	Old Description			New Description
t	1	Correlates (1) device posture changes indicating root or ele	t	1	For Android, detect Hooking from documented management, netw
	>	vated privilege state, (2) runtime framework manipulation or		>	ork, or vetting evidence; treat state queries as periodic ob
	>	injection into application processes, and (3) anomalous API		>	servations rather than real-time events. Correlate Applicati
	>	behavior or suppressed security signals. The defender obser		>	on Permission via Android Enterprise DPC / Application Vetti
	>	ves a causal chain where an application gains privileged exe		>	ng [DevicePolicyManager.getPermissionGrantState(); PackageMa
	>	cution context, interacts with system frameworks (e.g., ART/		>	nager manifest/requested-permission review]; OS API Executio
	>	Zygote), and modifies expected API outputs or suppresses sec		>	n via Application Vetting / Instrumented Dynamic Analysis [D
	>	urity-relevant signals such as permission checks, sensor acc		>	ynamic API/runtime trace: App process loads external code mo
	>	ess reporting, or process visibility.		>	dule or native library from non-system path injected into zy
				>	gote or app_process runtime — abnormal library injection pat
				>	h is the hooking mechanism indicator]. Alert on a sequence o
				>	r state change inconsistent with the device/app baseline, ap
				>	proved management policy, or expected user workflow; do not
				>	infer unobserved API calls, file/process activity, or payloa
				>	d content from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.382000+00:00	2026-10-13 17:42:40.218000+00:00
description	Correlates (1) device posture changes indicating root or elevated privilege state, (2) runtime framework manipulation or injection into application processes, and (3) anomalous API behavior or suppressed security signals. The defender observes a causal chain where an application gains privileged execution context, interacts with system frameworks (e.g., ART/Zygote), and modifies expected API outputs or suppresses security-relevant signals such as permission checks, sensor access reporting, or process visibility.	For Android, detect Hooking from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; OS API Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: App process loads external code module or native library from non-system path injected into zygote or app_process runtime — abnormal library injection path is the hooking mechanism indicator]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:MDMLog', 'channel': 'device transitions to non-compliant state + root detected or integrity attestation failure (SafetyNet/Play Integrity)'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindow', 'description': 'Defines correlation window between root detection, runtime manipulation, and anomalous API behavior'}	{'field': 'RootStatusChangeWindow', 'description': 'Default 3600s — hooking framework deployment may lag root acquisition. Root detection is the gate; hooking evidence narrows within the window.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': 'application process loads external code modules or injects into runtime (zygote/app_process) + abnormal library loading or method interception behavior'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: App process loads external code module or native library from non-system path injected into zygote or app_process runtime — abnormal library injection path is the hooking mechanism indicator'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_mutable_elements	{'field': 'AllowedAppList', 'description': 'Baseline of known applications that legitimately use instrumentation or debugging frameworks'}
x_mitre_mutable_elements	{'field': 'ForegroundStateRequired', 'description': 'Determines whether suspicious API manipulation must occur in background to increase fidelity'}
x_mitre_mutable_elements	{'field': 'IntegritySignalSource', 'description': 'Defines which attestation signals (Play Integrity, OEM attestation) are trusted in the environment'}

[AN1851] Analytic 1851

Current version: 1.1

	Old Description			New Description
t	1	Defender correlates a sandboxed app writing high-entropy or	t	1	For Android, detect Obfuscated Files or Information by corre
	>	encoded artifacts (often in app-private or shared storage),		>	lating analyst-visible device/network evidence and managemen
	>	performing decode/decompress/reassembly, then dynamically lo		>	t state; use streaming or batched telemetry only where the d
	>	ading/execing the resulting code (DexClassLoader/JNI dlopen)		>	ocumented collector is deployed. Correlate File Creation via
	>	or spawning a helper process. Sequence: high-entropy file w		>	Application Vetting / Forensic Acquisition [Dynamic filesys
	>	rites → decode/unpack bursts → new .dex/.so/.jar creation in		>	tem trace or acquired app-container/filesystem artifacts: op
	>	temp/obfuscated paths → dynamic load or shell spawn within		>	en() with O_CREAT on path LIKE '/data/data/%/files/%' for bi
	>	a tight window.		>	nary or dex content by app_package NOT IN $LegitDynamicLoade
				>	rs$]; Module Load via Application Vetting / Instrumented Dyn
				>	amic Analysis [Dynamic API/runtime trace: DexClassLoader() o
				>	r dlopen() called with path argument matching file written i
				>	n preceding $DecryptExecWindow$]; Network Connection Creatio
				>	n via Android Enterprise Network Logging / Enterprise VPN [D
				>	evicePolicyManager.retrieveNetworkLogs(): DnsEvent / Connect
				>	Event; VPN flow metadata]. Alert on a sequence or state chan
				>	ge inconsistent with the device/app baseline, approved manag
				>	ement policy, or expected user workflow; do not infer unobse
				>	rved API calls, file/process activity, or payload content fr
				>	om management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.378000+00:00	2026-10-13 17:41:01.268000+00:00
description	Defender correlates a sandboxed app writing high-entropy or encoded artifacts (often in app-private or shared storage), performing decode/decompress/reassembly, then dynamically loading/execing the resulting code (DexClassLoader/JNI dlopen) or spawning a helper process. Sequence: high-entropy file writes → decode/unpack bursts → new .dex/.so/.jar creation in temp/obfuscated paths → dynamic load or shell spawn within a tight window.	For Android, detect Obfuscated Files or Information by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate File Creation via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: open() with O_CREAT on path LIKE '/data/data/%/files/%' for binary or dex content by app_package NOT IN $LegitDynamicLoaders$]; Module Load via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: DexClassLoader() or dlopen() called with path argument matching file written in preceding $DecryptExecWindow$]; Network Connection Creation via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[3]	{'field': 'ChunkCountThreshold', 'description': 'Minimum count of small sequential writes (split payload reassembly).'}	{'field': 'PostLoadWindow', 'description': 'Default 120s between module load and novel network connection.'}
x_mitre_mutable_elements[1]	{'field': 'PayloadEntropyThreshold', 'description': 'Shannon entropy threshold to flag likely obfuscated blobs (e.g., ≥ 7.2).'}	{'field': 'DecryptExecWindow', 'description': 'Default 60s between file write and module load. Tightening: 10s — synchronous decrypt-load pattern.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'android:logcat', 'channel': 'App UID writes new file with suspicious extension/location (.tmp, .dat, .enc, /data/data//files/, /sdcard/Download/) and high estimated entropy'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'mobile:ForensicArtifacts', 'channel': "Dynamic filesystem trace or acquired app-container/filesystem artifacts: open() with O_CREAT on path LIKE '/data/data/%/files/%' for binary or dex content by app_package NOT IN $LegitDynamicLoaders$"}
x_mitre_mutable_elements[0]	{'field': 'TimeWindowSeconds', 'description': 'Max interval to correlate write→decode→load stages (e.g., 5–60s depending on device performance).'}	{'field': 'LegitDynamicLoaders', 'description': 'React Native, Unity, Xamarin runtime packages — legitimate apps that use dynamic code loading. Tightening: empty list (all dynamic loading flagged). Loosening: broad list reduces FP for game engines. Derive from MDM-approved app catalog.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--c0a4a086-cc20-4e1e-b7cb-29d99dfa3fb1', 'name': 'android:logcat', 'channel': 'DexClassLoader/PathClassLoader load attempt from non-standard path or recently created file'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--c0a4a086-cc20-4e1e-b7cb-29d99dfa3fb1', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: DexClassLoader() or dlopen() called with path argument matching file written in preceding $DecryptExecWindow$'}
x_mitre_mutable_elements[2]	{'field': 'SuspiciousWriteDirs', 'description': 'Directories to monitor (e.g., app /files, cache, /sdcard/Download). OEMs vary.'}	{'field': 'AppCDNList', 'description': 'Per-app known CDN/update endpoints from 30-day network baseline. Derive by measurement.'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--c0a4a086-cc20-4e1e-b7cb-29d99dfa3fb1', 'name': 'android:logcat', 'channel': 'Short burst of file I/O followed by JNI/dlopen of a newly created .so'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba', 'name': 'android:EnterpriseNetworkLog', 'channel': 'DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962', 'name': 'android:logcat', 'channel': 'SELinux AVC related to execute_no_trans/execmem after decode/unpack activity by the same app UID'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'NSM:Flow', 'channel': 'TLS/HTTP download with atypical MIME (application/octet-stream, application/x-zip, application/x-gzip) followed by local decode/write'}
x_mitre_mutable_elements	{'field': 'NetworkCDNAllowlist', 'description': 'Benign CDNs/hosts for large opaque downloads to reduce FPs.'}
x_mitre_mutable_elements	{'field': 'ExecPathRegex', 'description': 'Regex for newly loaded .dex/.so/.jar/temp artifacts.'}
x_mitre_mutable_elements	{'field': 'UserContext', 'description': 'Foreground/background or developer mode context to suppress test noise.'}

[AN1852] Analytic 1852

Current version: 1.1

	Old Description			New Description
t	1	Defender correlates a sandboxed app downloading or receiving	t	1	For iOS, detect Obfuscated Files or Information by correlati
	>	opaque/encoded blobs, writing high-entropy content into con		>	ng analyst-visible device/network evidence and management st
	>	tainer/tmp, performing decode/decompress/reassembly, and the		>	ate; use streaming or batched telemetry only where the docum
	>	n executing/loaded as Mach-O or bundle (dlopen) or leveragin		>	ented collector is deployed. Correlate Application Permissio
	>	g JIT/RWX pages to run the decoded payload. Sequence: opaque		>	n via Application Vetting [Code-signing entitlements and Inf
	>	download or IPC → high-entropy writes/split-file bursts → d		>	o.plist privacy usage-description keys]; Network Traffic Con
	>	ecode/unarchive → new Mach-O/bundle in tmp → dlopen/posix_sp		>	tent via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S)
	>	awn or RWX region activity.		>	inspection or proxy transaction metadata where enterprise de
				>	cryption/inspection is deployed]; Network Traffic Flow via A
				>	pple Network Extension / Enterprise VPN [NEFilterFlow / per-
				>	app VPN / secure-web-gateway flow metadata]. Alert on a sequ
				>	ence or state change inconsistent with the device/app baseli
				>	ne, approved management policy, or expected user workflow; d
				>	o not infer unobserved API calls, file/process activity, or
				>	payload content from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.378000+00:00	2026-10-13 17:41:01.860000+00:00
description	Defender correlates a sandboxed app downloading or receiving opaque/encoded blobs, writing high-entropy content into container/tmp, performing decode/decompress/reassembly, and then executing/loaded as Mach-O or bundle (dlopen) or leveraging JIT/RWX pages to run the decoded payload. Sequence: opaque download or IPC → high-entropy writes/split-file bursts → decode/unarchive → new Mach-O/bundle in tmp → dlopen/posix_spawn or RWX region activity.	For iOS, detect Obfuscated Files or Information by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]; Network Traffic Content via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed]; Network Traffic Flow via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_mutable_elements[3]	{'field': 'AppContainerPaths', 'description': 'Container subpaths to monitor (tmp, Library/Caches, Documents) vary by policy.'}	{'field': 'MinPayloadSize', 'description': 'Default 1024 bytes — exclude trivial config responses.'}
x_mitre_mutable_elements[1]	{'field': 'PayloadEntropyThreshold', 'description': 'Entropy threshold to consider a file obfuscated/packed (e.g., ≥ 7.3).'}	{'field': 'AppBaselineDomains', 'description': 'Full per-app network destination baseline, 30-day.'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'iOS:unifiedlog', 'channel': 'NSFileHandle/NSFileManager writes creating high-entropy files within app container (/var/mobile/Containers/Data/Application//tmp\|Library/Caches)'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'mobile:ApplicationVetting', 'channel': 'Code-signing entitlements and Info.plist privacy usage-description keys'}
x_mitre_mutable_elements[0]	{'field': 'TimeWindowSeconds', 'description': 'Max interval to link write→decode→load/exec (e.g., 5–45s depending on device and iOS version).'}	{'field': 'AppCDNList', 'description': 'Per-app declared CDN/update endpoints from 30-day baseline.'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--1887a270-576a-4049-84de-ef746b2572d6', 'name': 'iOS:unifiedlog', 'channel': 'Code signing validation events referencing newly written local Mach-O/bundle prior to exec or dlopen'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'webproxy:applog', 'channel': 'DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed'}
x_mitre_mutable_elements[2]	{'field': 'SplitWriteBurstMin', 'description': 'Minimum count of small sequential writes to flag reassembly behaviors.'}	{'field': 'ContentEntropyThreshold', 'description': 'Default 7.0 bits Shannon entropy. Calibrate against known-good app responses.'}
x_mitre_mutable_elements[4]	{'field': 'KnownGoodBundles', 'description': 'Allowlist of legitimate dynamically loaded bundles/plugins to reduce FPs.'}	{'field': 'BehavioralForkWindow', 'description': 'Default 120s between download and new destination first seen.'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--c0a4a086-cc20-4e1e-b7cb-29d99dfa3fb1', 'name': 'iOS:unifiedlog', 'channel': 'dyld: dlopen/dyld_cache load from non-standard app-writable path'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'iOS:NetworkExtension', 'channel': 'NEFilterFlow / per-app VPN / secure-web-gateway flow metadata'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'iOS:unifiedlog', 'channel': 'Per-app VPN flow logging indicating opaque/archived payload transfer preceding local decode'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'iOS:unifiedlog', 'channel': 'mmap/mprotect transitions to PROT_EXEC for pages associated with recently written files'}
x_mitre_mutable_elements	{'field': 'PerAppVPNAllowlist', 'description': 'Known enterprise services carrying opaque archives to avoid false alerts.'}

[AN1853] Analytic 1853

Current version: 1.1

	Old Description			New Description
t	1	The defender correlates the arrival, installation, or update	t	1	For Android, detect Compromise Software Supply Chain from do
	>	of a trusted or expected application with a subsequent devi		>	cumented management, network, or vetting evidence; treat sta
	>	ation in package trust characteristics, permission posture,		>	te queries as periodic observations rather than real-time ev
	>	protected-resource use, framework behavior, or network commu		>	ents. Correlate Application Permission via Android Enterpris
	>	nication that is inconsistent with the known-good role of th		>	e DPC / Application Vetting [DevicePolicyManager.getPermissi
	>	at app. The strongest Android evidence is a managed or trust		>	onGrantState(); PackageManager manifest/requested-permission
	>	ed package whose first-run or post-update behavior introduce		>	review]; Application State via Android Enterprise / EMM [Ma
	>	s unexpected special access, sensitive sensor use, unusual b		>	naged package inventory/status and package metadata]; File C
	>	ackground execution, privileged framework interaction, or ou		>	reation via Application Vetting / Forensic Acquisition [Dyna
	>	tbound communication to destinations outside the app's basel		>	mic filesystem trace or acquired app-container/filesystem ar
	>	ine shortly after installation or update.		>	tifacts: Compromised app writes staging, cache, or export ar
				>	tifacts inconsistent with its declared function within $Post
				>	InstallWindow$]. Alert on a sequence or state change inconsi
				>	stent with the device/app baseline, approved management poli
				>	cy, or expected user workflow; do not infer unobserved API c
				>	alls, file/process activity, or payload content from managem
				>	ent state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.381000+00:00	2026-10-13 17:42:25.629000+00:00
description	The defender correlates the arrival, installation, or update of a trusted or expected application with a subsequent deviation in package trust characteristics, permission posture, protected-resource use, framework behavior, or network communication that is inconsistent with the known-good role of that app. The strongest Android evidence is a managed or trusted package whose first-run or post-update behavior introduces unexpected special access, sensitive sensor use, unusual background execution, privileged framework interaction, or outbound communication to destinations outside the app's baseline shortly after installation or update.	For Android, detect Compromise Software Supply Chain from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; Application State via Android Enterprise / EMM [Managed package inventory/status and package metadata]; File Creation via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: Compromised app writes staging, cache, or export artifacts inconsistent with its declared function within $PostInstallWindow$]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:MDMLog', 'channel': 'Managed or trusted app is newly installed or updated and presents changed package identity, signing relationship, version lineage, installer source, or permission posture inconsistent with approved baseline'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'android:DevicePolicyManager', 'channel': 'DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review'}
x_mitre_log_source_references[3]	{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'MobileEDR:telemetry', 'channel': 'Recently installed or updated trusted app writes staging, cache, buffer, or export artifacts inconsistent with its approved function, especially when temporally adjacent to sensitive resource access or outbound transfer'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Recently updated trusted app invokes special-access paths, account services, or accessibility not present in prior version baseline'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'MobileEDR:telemetry', 'channel': 'Recently installed or updated trusted app begins background execution, persistent service activity, overlay-like behavior, or lock-state activity inconsistent with its historical baseline or expected first-run sequence'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'android:EMM', 'channel': 'Managed package inventory/status and package metadata'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'MobileEDR:telemetry', 'channel': 'Recently installed or updated trusted app invokes Android framework paths or special access patterns inconsistent with its role, including accessibility-like behavior, overlay behavior, package visibility expansion, protected settings access, device policy interaction, or unusual IPC/provider access'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'mobile:ForensicArtifacts', 'channel': 'Dynamic filesystem trace or acquired app-container/filesystem artifacts: Compromised app writes staging, cache, or export artifacts inconsistent with its declared function within $PostInstallWindow$'}

[AN1854] Analytic 1854

Current version: 1.1

	Old Description			New Description
t	1	Anchor on supervised managed-app install/update or version d	t	1	For iOS, detect Compromise Software Supply Chain from docume
	>	rift, then correlate with unexpected background activity, ma		>	nted management, network, or vetting evidence; treat state q
	>	naged-app state changes, or egress inconsistent with the app		>	ueries as periodic observations rather than real-time events
	>	's historical and policy baseline.		>	. Correlate Application Permission via Application Vetting [
				>	Code-signing entitlements and Info.plist privacy usage-descr
				>	iption keys]; Application State via Apple MDM [InstalledAppl
				>	icationList / ManagedApplicationList]; OS API Execution via
				>	Application Vetting / Instrumented Dynamic Analysis [Dynamic
				>	API/runtime trace: Launch services, extension-handling, or
				>	framework subsystem anomalies occur near install or first la
				>	unch of recently updated trusted app on supervised device].
				>	Alert on a sequence or state change inconsistent with the de
				>	vice/app baseline, approved management policy, or expected u
				>	ser workflow; do not infer unobserved API calls, file/proces
				>	s activity, or payload content from management state alone.

Details

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.382000+00:00	2026-10-13 17:42:26.332000+00:00
description	Anchor on supervised managed-app install/update or version drift, then correlate with unexpected background activity, managed-app state changes, or egress inconsistent with the app's historical and policy baseline.	For iOS, detect Compromise Software Supply Chain from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Application Permission via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]; Application State via Apple MDM [InstalledApplicationList / ManagedApplicationList]; OS API Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: Launch services, extension-handling, or framework subsystem anomalies occur near install or first launch of recently updated trusted app on supervised device]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'iOS:MDMLog', 'channel': 'Supervised managed app is newly installed or updated and presents unexpected version transition, inventory drift, managed-state change, or app attribute mismatch against approved procurement and release baseline'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43', 'name': 'mobile:ApplicationVetting', 'channel': 'Code-signing entitlements and Info.plist privacy usage-description keys'}
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'MobileEDR:telemetry', 'channel': 'Recently installed or updated managed app begins background activity, persistent refresh, or lock-state-adjacent activity inconsistent with expected first-run behavior, user interaction timing, or historical baseline'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9', 'name': 'iOS:MDM', 'channel': 'InstalledApplicationList / ManagedApplicationList'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'iOS:unifiedlog', 'channel': 'Supplemental managed app or system subsystem anomalies near install/update, launch services, extension handling, app activation, or background execution temporally adjacent to suspicious network or lifecycle behavior'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'mobile:DynamicAnalysis', 'channel': 'Dynamic API/runtime trace: Launch services, extension-handling, or framework subsystem anomalies occur near install or first launch of recently updated trusted app on supervised device'}

Description:

Real-time monitoring identifies network traffic to Industrial Control System (ICS) Application Programming Interface (API) ports such as 4840 used in the Open Platform Communications (OPC) Unified Architecture (UA) or vendor-specific API ports from source Internet Protocol (IP) addresses not in the approved application client list, where the traffic pattern is consistent with write/control method invocations rather than subscription/read traffic. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Patches

[AN1855] Analytic 1855

Current version: 1.0

	Old Description			New Description
t	1	Monitor for API calls that can be used to install a hook pro	t	1	Real-time monitoring identifies an unsigned or unexpected pr
	>	cedure, such as the SetWindowsHookEx and SetWinEventHook fun		>	ocess calling Windows hooking Application Programming Interf
	>	ctions.(Citation: Microsoft Hook Overview)(Citation: Volatil		>	aces (APIs) (SetWindowsHookEx, SetWinEventHook) targeting an
	>	ity Detecting Hooks Sept 2012) Also consider analyzing hook		>	Industrial Control System (ICS) engineering or Human-Machin
	>	chains (which hold pointers to hook procedures for each type		>	e Interface (HMI) process, immediately followed by that targ
	>	of hook) using tools(Citation: Volatility Detecting Hooks S		>	et process loading a Dynamic Link Library (DLL) not present
	>	ept 2012)(Citation: PreKageo Winhook Jul 2011)(Citation: Jay		>	in the vendor's signed module baseline. Confirmed in the wil
	>	GetHooks Sept 2011) or by programmatically examining intern		>	d: Stuxnet replaced Siemens' s7otbxdx.dll on engineering wor
	>	al kernel structures.(Citation: Zairon Hooking Dec 2006)(Cit		>	kstations to intercept and falsify Programmable Logic Contro
	>	ation: EyeofRa Detecting Hooking June 2017) Verify integrity		>	ller (PLC) read/write calls between WinCC/STEP7 and the cont
	>	of live processes by comparing code in memory to that of co		>	roller. OT operational-fidelity gate: Alert only when execut
	>	rresponding static binaries, specifically checking for jumps		>	ion violates an approved signer/hash/path/parent/process or
	>	and other instructions that redirect code flow.		>	tool allowlist, or originates from an unauthorized user/tool
				>	, and is tied to an OT asset or follow-on OT-relevant action
				>	. Suppress vendor-signed software, approved engineering util
				>	ities, diagnostics, patching, backup, and documented mainten
				>	ance.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ApprovedICSVendorProcessList', 'description': 'Allowlist of processes permitted to install window/event hooks on ICS engineering and HMI hosts.'}, {'field': 'ICSServiceBinaryList', 'description': 'List of binary paths for ICS gateway, OPC, and historian services on Linux assets that should never be launched with LD_PRELOAD set.'}, {'field': 'VendorPackageManifest', 'description': 'Package manager manifest cross-reference confirming a shared library belongs to an installed, signed package.'}, {'field': 'VendorSignedDLLHashBaseline', 'description': 'Cryptographic hash inventory of all vendor-signed ICS communication DLLs, refreshed on every legitimate vendor patch cycle.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:45:23.517000+00:00
description	Monitor for API calls that can be used to install a hook procedure, such as the SetWindowsHookEx and SetWinEventHook functions.(Citation: Microsoft Hook Overview)(Citation: Volatility Detecting Hooks Sept 2012) Also consider analyzing hook chains (which hold pointers to hook procedures for each type of hook) using tools(Citation: Volatility Detecting Hooks Sept 2012)(Citation: PreKageo Winhook Jul 2011)(Citation: Jay GetHooks Sept 2011) or by programmatically examining internal kernel structures.(Citation: Zairon Hooking Dec 2006)(Citation: EyeofRa Detecting Hooking June 2017) Verify integrity of live processes by comparing code in memory to that of corresponding static binaries, specifically checking for jumps and other instructions that redirect code flow.	Real-time monitoring identifies an unsigned or unexpected process calling Windows hooking Application Programming Interfaces (APIs) (SetWindowsHookEx, SetWinEventHook) targeting an Industrial Control System (ICS) engineering or Human-Machine Interface (HMI) process, immediately followed by that target process loading a Dynamic Link Library (DLL) not present in the vendor's signed module baseline. Confirmed in the wild: Stuxnet replaced Siemens' s7otbxdx.dll on engineering workstations to intercept and falsify Programmable Logic Controller (PLC) read/write calls between WinCC/STEP7 and the controller. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'Process', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--ee575f4a-2d4f-48f6-b18b-89067760adc1', 'name': 'edr:ProcessIntegrity', 'channel': 'Process integrity/hash mismatch detected on Industrial Control Systems (ICS) communication process post-hook-install event'}
x_mitre_platforms[0]	None	Windows
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--ee575f4a-2d4f-48f6-b18b-89067760adc1', 'name': 'Process', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--c0a4a086-cc20-4e1e-b7cb-29d99dfa3fb1', 'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=7 of Industrial Control Systems (ICS) vendor communication Dynamic Link Library (DLL) with hash not in signed baseline'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--1887a270-576a-4049-84de-ef746b2572d6', 'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=10 where SourceImage outside the approved ICS vendor/process baseline accesses TargetImage associated with an ICS application or service'}

[AN1856] Analytic 1856

Current version: 1.0

	Old Description			New Description
t	1	Monitor and analyze traffic patterns and packet inspection a	t	1	Real-time network monitoring identifies a sustained spike in
	>	ssociated to protocol(s) that do not follow the expected pro		>	malformed or high-volume Industrial Control System (ICS) pr
	>	tocol standards and traffic flows (e.g., extraneous packets		>	otocol traffic directed at a single field device from a sour
	>	that do not belong to established flows, gratuitous or anoma		>	ce not in the approved control server list, immediately foll
	>	lous traffic patterns, anomalous syntax, or structure). Cons		>	owed by that device dropping out of the supervisory poll cyc
	>	ider correlation with process monitoring and command line to		>	le. Documented precedent: Sandworm's Industroyer malware sen
	>	detect anomalous processes execution and command line argum		>	t a crafted 18-byte proprietary User Datagram Protocol (UDP)
	>	ents associated to traffic patterns (e.g., monitor anomalies		>	packet to port 50000 on Siemens Protection Technology (SIPR
	>	in use of files that do not normally initiate connections f		>	OTEC) relays (CVE-2015-5374), causing the device to hang and
	>	or respective protocol(s)). Monitor network data for uncommo		>	require a manual reboot. OT operational-fidelity gate: Aler
	>	n data flows. Processes utilizing the network that do not no		>	t only when a device-specific traffic/resource threshold is
	>	rmally have network communication or have never been seen be		>	exceeded and the same window shows service degradation, fail
	>	fore are suspicious. Monitor for application logging, messag		>	ed polling, device alarm/restart, resource exhaustion, or ma
	>	ing, and/or other artifacts that may result from Denial of		>	lformed/out-of-spec protocol behavior. Suppress planned load
	>	Service (DoS) attacks which degrade or block the availabilit		>	tests, maintenance, network convergence/failover, and known
	>	y of services to users. In addition to network level detecti		>	equipment faults after operator confirmation.
	>	ons, endpoint logging and instrumentation can be useful for
	>	detection. Monitor operational data for indicators of tempor
	>	ary data loss which may indicate a Denial of Service. This w
	>	ill not directly detect the technique’s execution, but inste
	>	ad may provide additional evidence that the technique has be
	>	en used and may complement other detections.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'CPUUtilizationThreshold', 'description': 'Network device CPU utilization percentage above which sustained load suggests packet-processing strain from flood traffic.'}, {'field': 'DoSConnectionThreshold', 'description': "Connections-per-minute threshold exceeding normal SCADA polling cadence, derived from the device's actual configured scan rate."}, {'field': 'DoSDetectionWindow', 'description': 'Time window over which flood rate and subsequent device silence are correlated, typically 1-5 minutes.'}, {'field': 'ExpectedPollInterval', 'description': 'Device-specific supervisory poll interval used to determine what counts as a process historian gap.'}, {'field': 'InterfaceErrorThreshold', 'description': 'Deviation from baseline interface error/discard rate, tuned against historical interface health data.'}, {'field': 'MalformedPacketThreshold', 'description': "Number of malformed/out-of-spec PDUs within the detection window constituting a flood, set above the device's documented error-tolerance baseline."}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:45:29.258000+00:00
description	Monitor and analyze traffic patterns and packet inspection associated to protocol(s) that do not follow the expected protocol standards and traffic flows (e.g., extraneous packets that do not belong to established flows, gratuitous or anomalous traffic patterns, anomalous syntax, or structure). Consider correlation with process monitoring and command line to detect anomalous processes execution and command line arguments associated to traffic patterns (e.g., monitor anomalies in use of files that do not normally initiate connections for respective protocol(s)). Monitor network data for uncommon data flows. Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Monitor for application logging, messaging, and/or other artifacts that may result from Denial of Service (DoS) attacks which degrade or block the availability of services to users. In addition to network level detections, endpoint logging and instrumentation can be useful for detection. Monitor operational data for indicators of temporary data loss which may indicate a Denial of Service. This will not directly detect the technique’s execution, but instead may provide additional evidence that the technique has been used and may complement other detections.	Real-time network monitoring identifies a sustained spike in malformed or high-volume Industrial Control System (ICS) protocol traffic directed at a single field device from a source not in the approved control server list, immediately followed by that device dropping out of the supervisory poll cycle. Documented precedent: Sandworm's Industroyer malware sent a crafted 18-byte proprietary User Datagram Protocol (UDP) packet to port 50000 on Siemens Protection Technology (SIPROTEC) relays (CVE-2015-5374), causing the device to hang and require a manual reboot. OT operational-fidelity gate: Alert only when a device-specific traffic/resource threshold is exceeded and the same window shows service degradation, failed polling, device alarm/restart, resource exhaustion, or malformed/out-of-spec protocol behavior. Suppress planned load tests, maintenance, network convergence/failover, and known equipment faults after operator confirmation.
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'Application Log', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'NSM:Content', 'channel': 'malformed Protocol Data Unit (PDU) rate to device_ip exceeds threshold within detection window from source not in approved Supervisory Control and Data Acquisition (SCADA) server list'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'Network Traffic', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): connection rate to device_ip exceeds Denial of Service (DoS) threshold per minute from single or distributed sources'}
x_mitre_log_source_references[3]	{'x_mitre_data_component_ref': 'x-mitre-data-component--931b3fc6-ad68-42a8-9018-e98515eedc95', 'name': 'Operational Databases', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'scada:applog', 'channel': 'device communication-loss alarm generated within detection window of a corresponding network flood alert'}
x_mitre_platforms[0]	None	Embedded
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'Network Traffic', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--931b3fc6-ad68-42a8-9018-e98515eedc95', 'name': 'operationaldb:ProcessHistory', 'channel': 'no new process value recorded for device_ip within 1.5x expected poll interval immediately following a flood alert'}

[AN1857] Analytic 1857

Current version: 1.0

	Old Description			New Description
t	1	Monitor for an authentication attempt by a user that may obt	t	1	Real-time monitoring identifies an Industrial Control System
	>	ain and abuse credentials of existing accounts as a means of		>	(ICS)-role account authenticating via interactive or remote
	>	gaining Initial Access, Persistence, Privilege Escalation,		>	logon from a workstation not in the approved host inventory
	>	or Defense Evasion. Monitor for logon behavior that may abus		>	, or outside the account's established usage pattern, immedi
	>	e credentials of existing accounts as a means of gaining Lat		>	ately followed within a short window by that session connect
	>	eral Movement or Persistence. Correlate other security syste		>	ing to the field device network or ICS application. OT opera
	>	ms with login information (e.g., a user has an active login		>	tional-fidelity gate: Alert only when the account/device/ses
	>	session but has not entered the building or does not have VP		>	sion violates the approved identity + source host/jump path/
	>	N access). Monitor for suspicious account behavior across s		>	zone policy and is corroborated by access to a protected OT
	>	ystems that share accounts, either user, admin, or service a		>	asset, execution, configuration change, or another security-
	>	ccounts. Examples: one account logged into multiple systems		>	relevant follow-on event. Suppress approved shift activity,
	>	simultaneously; multiple accounts logged into the same machi		>	vendor support, break-glass use, commissioning, and document
	>	ne simultaneously; accounts logged in at odd times or outsid		>	ed remote-access windows.
	>	e of business hours. Activity may be from interactive login
	>	sessions or process ownership from accounts being used to ex
	>	ecute binaries on a remote system as a particular account.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ApprovedAdminCIDR', 'description': 'IP ranges from which SSH administrative access to ICS Linux assets is authorized.'}, {'field': 'ApprovedHostList', 'description': 'Inventory of workstations/jump hosts from which ICS-role accounts are authorized to authenticate.'}, {'field': 'ApprovedNMSCIDR', 'description': 'IP ranges from which network device administrative access is authorized.'}, {'field': 'AuthToDeviceWindow', 'description': 'Time window after anomalous logon within which device-subnet connection is considered correlated, typically 5-15 minutes.'}, {'field': 'ICSRoleAccountPatterns', 'description': 'Naming convention or group-membership pattern identifying accounts with engineering, operator, or ICS service roles.'}, {'field': 'OfficeHoursWindow', 'description': 'Defined normal working hours for interactive ICS engineering activity, widened for 24/7 shift-based operations.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:47:23.108000+00:00
description	Monitor for an authentication attempt by a user that may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Monitor for logon behavior that may abuse credentials of existing accounts as a means of gaining Lateral Movement or Persistence. Correlate other security systems with login information (e.g., a user has an active login session but has not entered the building or does not have VPN access). Monitor for suspicious account behavior across systems that share accounts, either user, admin, or service accounts. Examples: one account logged into multiple systems simultaneously; multiple accounts logged into the same machine simultaneously; accounts logged in at odd times or outside of business hours. Activity may be from interactive login sessions or process ownership from accounts being used to execute binaries on a remote system as a particular account.	Real-time monitoring identifies an Industrial Control System (ICS)-role account authenticating via interactive or remote logon from a workstation not in the approved host inventory, or outside the account's established usage pattern, immediately followed within a short window by that session connecting to the field device network or ICS application. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--a953ca55-921a-44f7-9b8d-3d40141aa17e', 'name': 'User Account', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9ce98c86-8d30-4043-ba54-0784d478d0b5', 'name': 'WinEventLog:Security', 'channel': 'Windows Security Event ID 4624/4625: EventCode=4624 for Industrial Control Systems (ICS)-role account from workstation not in approved host list or outside office hours window'}
x_mitre_platforms[0]	None	Windows
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9ce98c86-8d30-4043-ba54-0784d478d0b5', 'name': 'Logon Session', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--39b9db72-8b48-4595-a18d-db5bbba3091b', 'name': 'WinEventLog:Security', 'channel': 'Windows Security Event ID 4624/4625: EventCode=4672 for Industrial Control Systems (ICS)-role account from anomalous session'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--39b9db72-8b48-4595-a18d-db5bbba3091b', 'name': 'Logon Session', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--a953ca55-921a-44f7-9b8d-3d40141aa17e', 'name': 'WinEventLog:Security', 'channel': 'Windows Security Event ID 4624/4625: EventCode=4648 for Industrial Control Systems (ICS)-role account from process outside approved ICS vendor process list'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba', 'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=3 to device subnet within auth-to-device window of the anomalous logon'}

[AN1858] Analytic 1858

Current version: 1.0

	Old Description			New Description
t	1	Monitor for newly constructed services/daemons that may atte	t	1	Real-time monitoring identifies a process or scheduled task
	>	mpt to manipulate features of their artifacts to make them a		>	whose displayed name matches a known Industrial Control Syst
	>	ppear legitimate or benign to users and/or security tools. M		>	em (ICS) vendor application but whose on-disk binary hash or
	>	onitor for changes made to files outside of an update or pat		>	file path does not match the vendor-signed baseline. The mi
	>	ch that may attempt to manipulate features of their artifact		>	smatch -- name says one thing, binary integrity says another
	>	s to make them appear legitimate or benign to users and/or s		>	-- is the defining signal. OT operational-fidelity gate: Al
	>	ecurity tools. Monitor for file names that are mismatched be		>	ert only when execution violates an approved signer/hash/pat
	>	tween the file name on disk and that of the binary's metadat		>	h/parent/process or tool allowlist, or originates from an un
	>	a. This is a likely indicator that a binary was renamed afte		>	authorized user/tool, and is tied to an OT asset or follow-o
	>	r it was compiled. For added context on adversary procedures		>	n OT-relevant action. Suppress vendor-signed software, appro
	>	and background see [Masquerading](https://attack.mitre.org/		>	ved engineering utilities, diagnostics, patching, backup, an
	>	techniques/T1036) and applicable sub-techniques. Monitor exe		>	d documented maintenance.
	>	cuted commands and arguments that may attempt to manipulate
	>	features of their artifacts to make them appear legitimate o
	>	r benign to users and/or security tools.(Citation: Twitter I
	>	tsReallyNick Masquerading Update) Monitor for changes made t
	>	o scheduled jobs that may attempt to manipulate features of
	>	their artifacts to make them appear legitimate or benign to
	>	users and/or security tools. Monitor for changes made to ser
	>	vices that may attempt to manipulate features of their artif
	>	acts to make them appear legitimate or benign to users and/o
	>	r security tools. Collect file hashes. Monitor for file name
	>	s that do not match their expected hash. Perform file monito
	>	ring. Files with known names but in unusual locations are su
	>	spect. Look for indications of common characters that may i
	>	ndicate an attempt to trick users into misidentifying the fi
	>	le type, such as a space as the last character of a file nam
	>	e or the right-to-left override characters"\u202E", "[U+202E
	>	]", and "%E2%80%AE". For added context on adversary procedur
	>	es and background see [Masquerading](https://attack.mitre.or
	>	g/techniques/T1036) and applicable sub-techniques. Monitor f
	>	or newly constructed scheduled jobs that may attempt to mani
	>	pulate features of their artifacts to make them appear legit
	>	imate or benign to users and/or security tools.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'AssetInventoryDeviceTypes', 'description': 'Maintained inventory of expected vendor/product identity strings per enrolled device IP.'}, {'field': 'ICSDaemonNames', 'description': 'List of expected Linux ICS service daemon process names.'}, {'field': 'ICSVendorProcessNames', 'description': 'List of known ICS vendor executable names used as the masquerade-target watchlist.'}, {'field': 'VendorHashBaseline', 'description': 'Cryptographic hash inventory for all legitimate versions of vendor ICS binaries, updated on every patch cycle.'}, {'field': 'VendorInstallPaths', 'description': 'Authorized installation directories for each ICS vendor application.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:47:23.840000+00:00
description	Monitor for newly constructed services/daemons that may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Monitor for changes made to files outside of an update or patch that may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Monitor for file names that are mismatched between the file name on disk and that of the binary's metadata. This is a likely indicator that a binary was renamed after it was compiled. For added context on adversary procedures and background see [Masquerading](https://attack.mitre.org/techniques/T1036) and applicable sub-techniques. Monitor executed commands and arguments that may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools.(Citation: Twitter ItsReallyNick Masquerading Update) Monitor for changes made to scheduled jobs that may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Monitor for changes made to services that may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Collect file hashes. Monitor for file names that do not match their expected hash. Perform file monitoring. Files with known names but in unusual locations are suspect. Look for indications of common characters that may indicate an attempt to trick users into misidentifying the file type, such as a space as the last character of a file name or the right-to-left override characters"\u202E", "[U+202E]", and "%E2%80%AE". For added context on adversary procedures and background see [Masquerading](https://attack.mitre.org/techniques/T1036) and applicable sub-techniques. Monitor for newly constructed scheduled jobs that may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools.	Real-time monitoring identifies a process or scheduled task whose displayed name matches a known Industrial Control System (ICS) vendor application but whose on-disk binary hash or file path does not match the vendor-signed baseline. The mismatch -- name says one thing, binary integrity says another -- is the defining signal. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--ee575f4a-2d4f-48f6-b18b-89067760adc1', 'name': 'Process', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--ee575f4a-2d4f-48f6-b18b-89067760adc1', 'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 where image filename matches Industrial Control Systems (ICS) vendor process names but hash not in vendor hash baseline or current directory outside vendor install paths'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--5297a638-1382-4f0c-8472-0d21830bf705', 'name': 'Service', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--f42df6f0-6395-4f0c-9376-525a031f00c3', 'name': 'WinEventLog:Security', 'channel': 'Windows Security Event ID 4698/4702: EventCode=4698 referencing Industrial Control Systems (ICS) vendor binary name from unauthorized process'}
x_mitre_log_source_references[3]	{'x_mitre_data_component_ref': 'x-mitre-data-component--685f917a-e95e-4ba0-ade1-c7d354dae6e0', 'name': 'Command', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--5297a638-1382-4f0c-8472-0d21830bf705', 'name': 'WinEventLog:System', 'channel': 'EventCode=7045 where ServiceName/ImagePath references Industrial Control Systems (ICS) vendor application with hash/path mismatch'}
x_mitre_platforms[0]	None	Windows
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--84572de3-9583-4c73-aabd-06ea88123dd8', 'name': 'File', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--639e87f3-acb6-448a-9645-258f20da4bc5', 'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=11 matching Industrial Control Systems (ICS) vendor binary name in a path outside vendor install paths'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--faa34cf6-cf32-4dc9-bd6a-8f7a606ff65b', 'name': 'Scheduled Job', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--66531bc6-a509-4868-8314-4d599e91d222', 'name': 'Service', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--639e87f3-acb6-448a-9645-258f20da4bc5', 'name': 'File', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--f42df6f0-6395-4f0c-9376-525a031f00c3', 'name': 'Scheduled Job', 'channel': 'None'}

[AN1859] Analytic 1859

Current version: 1.0

	Old Description			New Description
t	1	Monitor login sessions for new or unexpected devices or sess	t	1	Real-time monitoring identifies a previously unseen wireless
	>	ions on wireless networks. Monitor application logs for new		>	device identity joining or authenticating to an ICS wireles
	>	or unexpected devices or sessions on wireless networks. New		>	s segment—such as Wi-Fi/802.1X, WirelessHART, ISA100.11a, or
	>	or irregular network traffic flows may indicate potentially		>	a vendor radio mesh—when its MAC/EUI, certificate, or devic
	>	unwanted devices or sessions on wireless networks. In Wi-Fi		>	e identifier is absent from the approved wireless asset inve
	>	networks monitor for changes such as rogue access points or		>	ntory. OT operational-fidelity gate: Alert only when the acc
	>	low signal strength, indicating a device is further away fro		>	ount/device/session violates the approved identity + source
	>	m the access point then expected and changes in the physical		>	host/jump path/zone policy and is corroborated by access to
	>	layer signal.(Citation: Nzyme Alerts Intro) (Citation: Wire		>	a protected OT asset, execution, configuration change, or an
	>	less Intrusion Detection) Network traffic content will provi		>	other security-relevant follow-on event. Suppress approved s
	>	de important context, such as hardware (e.g., MAC) addresses		>	hift activity, vendor support, break-glass use, commissionin
	>	, user accounts, and types of messages sent.		>	g, and documented remote-access windows.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ApprovedWirelessDeviceInventory', 'description': 'MAC/certificate inventory of devices authorized to associate with ICS wireless infrastructure.'}, {'field': 'DesignatedWirelessManagementStations', 'description': 'Hosts authorized to legitimately enable wireless monitor mode for diagnostics.'}, {'field': 'WirelessOnboardWindow', 'description': 'Time window after wireless association within which ICS-directed traffic is considered part of the same onboarding event.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:45:31.039000+00:00
description	Monitor login sessions for new or unexpected devices or sessions on wireless networks. Monitor application logs for new or unexpected devices or sessions on wireless networks. New or irregular network traffic flows may indicate potentially unwanted devices or sessions on wireless networks. In Wi-Fi networks monitor for changes such as rogue access points or low signal strength, indicating a device is further away from the access point then expected and changes in the physical layer signal.(Citation: Nzyme Alerts Intro) (Citation: Wireless Intrusion Detection) Network traffic content will provide important context, such as hardware (e.g., MAC) addresses, user accounts, and types of messages sent.	Real-time monitoring identifies a previously unseen wireless device identity joining or authenticating to an ICS wireless segment—such as Wi-Fi/802.1X, WirelessHART, ISA100.11a, or a vendor radio mesh—when its MAC/EUI, certificate, or device identifier is absent from the approved wireless asset inventory. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9ce98c86-8d30-4043-ba54-0784d478d0b5', 'name': 'Logon Session', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): traffic from newly-authenticated device to Industrial Control System (ICS) application server within onboard window of association'}
x_mitre_platforms[0]	None	Embedded
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'Application Log', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9ce98c86-8d30-4043-ba54-0784d478d0b5', 'name': 'wireless:radius', 'channel': 'Extensible Authentication Protocol (EAP) authentication success for device Media Access Control (MAC)/certificate not in approved wireless device inventory'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'Network Traffic', 'channel': 'None'}

[AN1860] Analytic 1860

Current version: 1.0

	Old Description			New Description
t	1	Monitor ICS automation network protocols for functions relat	t	1	Real-time network monitoring identifies a source issuing rea
	>	ed to reading an operational process state (e.g., “Read” fun		>	d-only Industrial Control System (ICS) protocol requests to
	>	ction codes in protocols like DNP3 or Modbus). In some cases		>	multiple field devices at a polling rate exceeding the legit
	>	, there may be multiple ways to monitor an operational proce		>	imate Supervisory Control and Data Acquisition (SCADA) basel
	>	ss’ state, one of which is typically used in the operational		>	ine, from a source not in the approved control server allowl
	>	environment. Monitor for the operating mode being checked i		>	ist. Because the action is read-only, source-identity and ra
	>	n unexpected ways. Monitor applications logs for any access		>	te deviation are the only available distinguishing signals.
	>	attempts to operational databases (e.g., historians) or othe		>	OT operational-fidelity gate: Do not alert on novelty, scan/
	>	r sources of operational data within the ICS environment. Th		>	read volume, or enumeration alone. Alert when the source rol
	>	ese devices should be monitored for adversary collection usi		>	e is not authorized for discovery/polling and the target sco
	>	ng techniques relevant to the underlying technologies (e.g.,		>	pe, address/tag range, protocol, or rate deviates from the e
	>	Windows, Linux).		>	stablished operational baseline. Suppress normal SCADA/HMI/h
				>	istorian polling, commissioning, asset inventory, backup, di
				>	agnostics, and approved engineering activity.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ApprovedOPCClients', 'description': 'Allowlist of OPC client application identities authorized to connect.'}, {'field': 'ApprovedSCADAServers', 'description': 'IP allowlist of legitimate SCADA/HMI/historian servers authorized to poll field devices.'}, {'field': 'BaselinePollRate', 'description': 'Measured normal polling frequency per device, derived from actual baseline traffic capture.'}, {'field': 'KnownTagAddressRanges', 'description': 'Documented register/tag address ranges that legitimate SCADA polling actually queries.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:46:11.613000+00:00
description	Monitor ICS automation network protocols for functions related to reading an operational process state (e.g., “Read” function codes in protocols like DNP3 or Modbus). In some cases, there may be multiple ways to monitor an operational process’ state, one of which is typically used in the operational environment. Monitor for the operating mode being checked in unexpected ways. Monitor applications logs for any access attempts to operational databases (e.g., historians) or other sources of operational data within the ICS environment. These devices should be monitored for adversary collection using techniques relevant to the underlying technologies (e.g., Windows, Linux).	Real-time network monitoring identifies a source issuing read-only Industrial Control System (ICS) protocol requests to multiple field devices at a polling rate exceeding the legitimate Supervisory Control and Data Acquisition (SCADA) baseline, from a source not in the approved control server allowlist. Because the action is read-only, source-identity and rate deviation are the only available distinguishing signals. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'Network Traffic', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'opc:applog', 'channel': 'client_id not in approved Open Platform Communications (OPC) clients issuing high-volume read requests'}
x_mitre_platforms[0]	None	Embedded
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'Application Log', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'NSM:Content', 'channel': 'read-only function codes from source not in approved Supervisory Control and Data Acquisition (SCADA) servers at rate exceeding baseline poll rate or covering address ranges outside known tag ranges'}

[AN1861] Analytic 1861

Current version: 1.0

	Old Description			New Description
t	1	Monitor for loss of network traffic which could indicate ala	t	1	Real-time monitoring of the alarm and process historian laye
	>	rms are being suppressed. A loss of expected communications		>	r identifies an alarm status transitioning to suppressed, sh
	>	associated with network protocols used to communicate alarm		>	elved, disabled, or acknowledged without a corresponding ope
	>	events or process data could indicate this technique is bein		>	rator action recorded within a grace period, correlated with
	>	g used. This will not directly detect the technique’s execut		>	Industrial Control System (ICS) protocol write traffic to a
	>	ion, but instead may provide additional evidence that the te		>	larm configuration or threshold registers arriving in the sa
	>	chnique has been used and may complement other detections. M		>	me window from a source not in the approved engineering list
	>	onitor for loss of operational process data which could indi		>	. OT operational-fidelity gate: Alert only when the action i
	>	cate alarms are being suppressed. This will not directly det		>	s not attributable to an authorized operator/engineering sou
	>	ect the technique’s execution, but instead may provide addit		>	rce for the specific target and function, and it is either o
	>	ional evidence that the technique has been used and may comp		>	utside an approved change/maintenance window or lacks matchi
	>	lement other detections. Monitor for loss of expected device		>	ng change-control context; where telemetry permits, require
	>	alarms which could indicate alarms are being suppressed. As		>	corroborating device, configuration, or process-state effect
	>	noted in the technique description, there may be multiple s		>	. Suppress activity that fully matches approved maintenance,
	>	ources of alarms in an ICS environment. Discrepancies betwee		>	commissioning, failover, recovery, or tested control proced
	>	n alarms may indicate the adversary is suppressing some but		>	ures.
	>	not all the alarms in the environment. This will not directl
	>	y detect the technique’s execution, but instead may provide
	>	additional evidence that the technique has been used and may
	>	complement other detections. Monitor for loss of expected o
	>	perational process alarms which could indicate alarms are be
	>	ing suppressed. As noted in the technique description, there
	>	may be multiple sources of alarms in an ICS environment. Di
	>	screpancies between alarms may indicate the adversary is sup
	>	pressing some but not all the alarms in the environment. Th
	>	is will not directly detect the technique’s execution, but i
	>	nstead may provide additional evidence that the technique ha
	>	s been used and may complement other detections.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'AlarmConfigAddressRange', 'description': 'Protocol register/address ranges corresponding to alarm threshold and configuration values per device type.'}, {'field': 'AlarmConfigPaths', 'description': 'File system paths for alarm configuration files/databases on Windows alarm servers.'}, {'field': 'ApprovedWriteSources', 'description': 'IP allowlist of sources authorized to write to ICS devices, including alarm configuration.'}, {'field': 'HMIAlarmParentAllowlist', 'description': 'Allowlist of recognized HMI/alarm management application processes authorized to modify alarm configuration.'}, {'field': 'SuppressGracePeriod', 'description': 'Time window within which a legitimate operator acknowledgment is expected following an alarm status change, typically 10-30 seconds.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:46:19.686000+00:00
description	Monitor for loss of network traffic which could indicate alarms are being suppressed. A loss of expected communications associated with network protocols used to communicate alarm events or process data could indicate this technique is being used. This will not directly detect the technique’s execution, but instead may provide additional evidence that the technique has been used and may complement other detections. Monitor for loss of operational process data which could indicate alarms are being suppressed. This will not directly detect the technique’s execution, but instead may provide additional evidence that the technique has been used and may complement other detections. Monitor for loss of expected device alarms which could indicate alarms are being suppressed. As noted in the technique description, there may be multiple sources of alarms in an ICS environment. Discrepancies between alarms may indicate the adversary is suppressing some but not all the alarms in the environment. This will not directly detect the technique’s execution, but instead may provide additional evidence that the technique has been used and may complement other detections. Monitor for loss of expected operational process alarms which could indicate alarms are being suppressed. As noted in the technique description, there may be multiple sources of alarms in an ICS environment. Discrepancies between alarms may indicate the adversary is suppressing some but not all the alarms in the environment. This will not directly detect the technique’s execution, but instead may provide additional evidence that the technique has been used and may complement other detections.	Real-time monitoring of the alarm and process historian layer identifies an alarm status transitioning to suppressed, shelved, disabled, or acknowledged without a corresponding operator action recorded within a grace period, correlated with Industrial Control System (ICS) protocol write traffic to alarm configuration or threshold registers arriving in the same window from a source not in the approved engineering list. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9d56be63-3501-4dd3-bb5f-63c580833298', 'name': 'Operational Databases', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'NSM:Content', 'channel': 'Generic Object Oriented Substation Event (GOOSE) dataset stNum value decreases (replay indicator) or test-mode bit asserted on protection relay without scheduled maintenance'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'Network Traffic', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--4c12c1c8-bcef-4daf-8e5b-fca235f71d9e', 'name': 'operationaldb:AlarmEvent', 'channel': 'alarm status transitions to suppressed/shelved/disabled/acknowledged without matching operator_id entry within suppress grace period'}
x_mitre_log_source_references[3]	{'x_mitre_data_component_ref': 'x-mitre-data-component--4c12c1c8-bcef-4daf-8e5b-fca235f71d9e', 'name': 'Operational Databases', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'NSM:Content', 'channel': 'write function code targeting alarm config address range from source not in approved write sources within suppress grace period of the alarm status change'}
x_mitre_platforms[0]	None	Embedded
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--931b3fc6-ad68-42a8-9018-e98515eedc95', 'name': 'Operational Databases', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--931b3fc6-ad68-42a8-9018-e98515eedc95', 'name': 'operationaldb:ProcessHistory', 'channel': 'process value crosses known alarm threshold but no corresponding alarm event recorded within expected latency window'}

[AN1863] Analytic 1863

Current version: 1.0

	Old Description			New Description
t	1	Use verification of distributed binaries through hash checki	t	1	Real-time monitoring identifies a vendor-distributed softwar
	>	ng or other integrity checking mechanisms. Scan downloads fo		>	e update package that, upon execution, exhibits behavior inc
	>	r malicious signatures.		>	onsistent with the vendor's documented installation profile:
				>	spawning unexpected child processes, writing files outside
				>	the vendor's standard manifest, or loading unsigned Dynamic
				>	Link Libraries (DLLs). OT operational-fidelity gate: Alert o
				>	nly when execution violates an approved signer/hash/path/par
				>	ent/process or tool allowlist, or originates from an unautho
				>	rized user/tool, and is tied to an OT asset or follow-on OT-
				>	relevant action. Suppress vendor-signed software, approved e
				>	ngineering utilities, diagnostics, patching, backup, and doc
				>	umented maintenance.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'VendorInstallManifest', 'description': 'Documented list of files/registry keys a legitimate vendor installer is expected to create.'}, {'field': 'VendorInstallProfile', 'description': 'Documented expected process behavior for a legitimate vendor installer, established through lab testing.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:45:26.988000+00:00
description	Use verification of distributed binaries through hash checking or other integrity checking mechanisms. Scan downloads for malicious signatures.	Real-time monitoring identifies a vendor-distributed software update package that, upon execution, exhibits behavior inconsistent with the vendor's documented installation profile: spawning unexpected child processes, writing files outside the vendor's standard manifest, or loading unsigned Dynamic Link Libraries (DLLs). OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--639e87f3-acb6-448a-9645-258f20da4bc5', 'name': 'File', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--639e87f3-acb6-448a-9645-258f20da4bc5', 'name': 'fim:hashcompare', 'channel': 'installed binary hash does not match vendor-published checksum for claimed version'}
x_mitre_platforms[0]	None	Windows

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--639e87f3-acb6-448a-9645-258f20da4bc5', 'name': 'WinEventLog:Sysmon', 'channel': 'Microsoft-Windows-Sysmon/Operational Event ID 11 FileCreate/overwrite or Event ID 2 FileCreateTime, as applicable: Process creation and file creation correlation: vendor installer creates files outside vendor install manifest or spawns undocumented child process'}

[AN1864] Analytic 1864

Current version: 1.1

	Old Description			New Description
t	1	Monitor for firmware changes which may be observable via ope	t	1	Real-time monitoring identifies a field device entering firm
	>	rational alarms from devices. Monitor device application log		>	ware update mode and receiving a large data transfer on its
	>	s for firmware changes, although not all devices will produc		>	firmware-capable protocol port from a source not in the appr
	>	e such logs. Monitor firmware for unexpected changes. Asset		>	oved engineering workstation list, followed by a device rebo
	>	management systems should be consulted to understand known-g		>	ot, with post-reboot firmware hash not matching the authoriz
	>	ood firmware versions. Dump and inspect BIOS images on vulne		>	ed inventory. OT operational-fidelity gate: Alert only when
	>	rable systems and compare against known good images.(Citatio		>	the action is not attributable to an authorized operator/eng
	>	n: MITRE Copernicus) Analyze differences to determine if mal		>	ineering source for the specific target and function, and it
	>	icious changes have occurred. Log attempts to read/write to		>	is either outside an approved change/maintenance window or
	>	BIOS and compare against known patching behavior. Likewise,		>	lacks matching change-control context; where telemetry permi
	>	EFI modules can be collected and compared against a known-cl		>	ts, require corroborating device, configuration, or process-
	>	ean list of EFI executable binaries to detect potentially ma		>	state effect. Suppress activity that fully matches approved
	>	licious modules. The CHIPSEC framework can be used for analy		>	maintenance, commissioning, failover, recovery, or tested co
	>	sis to determine if firmware modifications have been perform		>	ntrol procedures.
	>	ed.(Citation: McAfee CHIPSEC Blog)(Citation: Github CHIPSEC)
	>	(Citation: Intel HackingTeam UEFI Rootkit) Monitor ICS manag
	>	ement protocols / file transfer protocols for protocol funct
	>	ions related to firmware changes.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'AuthorizedFirmwareInventory', 'description': 'Cryptographic hash inventory of authorized firmware versions per device model.'}, {'field': 'AuthorizedFirmwareManagers', 'description': 'Accounts authorized to perform firmware update operations.'}, {'field': 'ChangeControlWindow', 'description': 'Scheduled maintenance periods during which firmware updates are authorized.'}, {'field': 'EngineeringWorkstationList', 'description': 'IP allowlist of workstations authorized to perform firmware updates.'}, {'field': 'FirmwareSessionSizeThreshold', 'description': 'Minimum byte count for a session to be considered a firmware transfer rather than routine configuration traffic, derived from known firmware image sizes.'}, {'field': 'FirmwareUpdateWindow', 'description': 'Time window within which a device reboot following a large session is considered part of the same firmware update event.'}, {'field': 'MaintenanceWindowSchedule', 'description': 'Recurring scheduled periods when firmware updates are expected to occur.'}]

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.377000+00:00	2026-10-13 17:44:00.393000+00:00
description	Monitor for firmware changes which may be observable via operational alarms from devices. Monitor device application logs for firmware changes, although not all devices will produce such logs. Monitor firmware for unexpected changes. Asset management systems should be consulted to understand known-good firmware versions. Dump and inspect BIOS images on vulnerable systems and compare against known good images.(Citation: MITRE Copernicus) Analyze differences to determine if malicious changes have occurred. Log attempts to read/write to BIOS and compare against known patching behavior. Likewise, EFI modules can be collected and compared against a known-clean list of EFI executable binaries to detect potentially malicious modules. The CHIPSEC framework can be used for analysis to determine if firmware modifications have been performed.(Citation: McAfee CHIPSEC Blog)(Citation: Github CHIPSEC)(Citation: Intel HackingTeam UEFI Rootkit) Monitor ICS management protocols / file transfer protocols for protocol functions related to firmware changes.	Real-time monitoring identifies a field device entering firmware update mode and receiving a large data transfer on its firmware-capable protocol port from a source not in the approved engineering workstation list, followed by a device reboot, with post-reboot firmware hash not matching the authorized inventory. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b9d031bb-d150-4fc6-8025-688201bf3ffd', 'name': 'Firmware', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'NSM:Content', 'channel': 'session on firmware-capable port exceeds session size threshold from source not in engineering workstation list outside change control window'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9d56be63-3501-4dd3-bb5f-63c580833298', 'name': 'Operational Databases', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b9d031bb-d150-4fc6-8025-688201bf3ffd', 'name': 'assetinventory:FirmwareHash', 'channel': 'reported firmware hash post-reboot not in authorized firmware inventory'}
x_mitre_log_source_references[3]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'Network Traffic', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'engineeringworkstation:ApplicationLog', 'channel': 'firmware write session initiated without corresponding change ticket reference'}
x_mitre_platforms[0]	None	Embedded
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'Application Log', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9d56be63-3501-4dd3-bb5f-63c580833298', 'name': 'operationaldb:AlarmEvent', 'channel': 'device reboot/restart alarm within firmware update window of the flagged transfer session'}

[AN1866] Analytic 1866

Current version: 1.0

	Old Description			New Description
t	1	Monitor for newly executed processes that execute from remov	t	1	Real-time monitoring identifies a Universal Serial Bus (USB)
	>	able media after it is mounted or when initiated by a user.		>	storage device insertion event on an Industrial Control Sys
	>	If a remote access tool is used in this manner to move later		>	tem (ICS) engineering or Human-Machine Interface (HMI) works
	>	ally, then additional actions are likely to occur after exec		>	tation where the device's hardware identifier (ID) is not in
	>	ution, such as opening network connections for Command and C		>	the authorized USB allowlist, immediately followed by proce
	>	ontrol and system and network information Discovery. Monito		>	ss execution from the removable drive's path. Documented as
	>	r for newly constructed files copied to or from removable me		>	the primary infection vector for Stuxnet, which specifically
	>	dia. Monitor for newly constructed drive letters or mount po		>	targeted air-gapped Siemens engineering environments via in
	>	ints to removable media. Monitor for files accessed on remov		>	fected USB drives. OT operational-fidelity gate: Alert only
	>	able media, particularly those with executable content.		>	when the account/device/session violates the approved identi
				>	ty + source host/jump path/zone policy and is corroborated b
				>	y access to a protected OT asset, execution, configuration c
				>	hange, or another security-relevant follow-on event. Suppres
				>	s approved shift activity, vendor support, break-glass use,
				>	commissioning, and documented remote-access windows.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'AuthorizedUSBAllowlist', 'description': 'Hardware ID inventory of USB storage devices authorized for use on ICS engineering and HMI workstations.'}, {'field': 'EngineeringWorkstationList', 'description': 'IP allowlist of workstations authorized to perform file transfers to field devices.'}, {'field': 'USBExecutionWindow', 'description': 'Time window after device insertion/mount within which process execution is considered directly connected to the insertion event.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:47:38.213000+00:00
description	Monitor for newly executed processes that execute from removable media after it is mounted or when initiated by a user. If a remote access tool is used in this manner to move laterally, then additional actions are likely to occur after execution, such as opening network connections for Command and Control and system and network information Discovery. Monitor for newly constructed files copied to or from removable media. Monitor for newly constructed drive letters or mount points to removable media. Monitor for files accessed on removable media, particularly those with executable content.	Real-time monitoring identifies a Universal Serial Bus (USB) storage device insertion event on an Industrial Control System (ICS) engineering or Human-Machine Interface (HMI) workstation where the device's hardware identifier (ID) is not in the authorized USB allowlist, immediately followed by process execution from the removable drive's path. Documented as the primary infection vector for Stuxnet, which specifically targeted air-gapped Siemens engineering environments via infected USB drives. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'Process', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=11 from removable media path to Industrial Control Systems (ICS) engineering working directory'}
x_mitre_platforms[0]	None	Windows
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'File', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 with image path on removable drive letter within Universal Serial Bus (USB) execution window of insertion event'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d6e6b3b-4aa8-40e1-8c47-91db0f313d9f', 'name': 'Drive', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d6e6b3b-4aa8-40e1-8c47-91db0f313d9f', 'name': 'WinEventLog:System', 'channel': 'EventCode=20001, 2003 not in authorized Universal Serial Bus (USB) allowlist on Industrial Control Systems (ICS) host'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--235b7491-2d2b-4617-9a52-3c0783680f71', 'name': 'File', 'channel': 'None'}

[AN1867] Analytic 1867

Current version: 1.0

	Old Description			New Description
t	1	Monitor for any suspicious attempts to enable script executi	t	1	Real-time network monitoring identifies a source issuing sys
	>	on on a system. If scripts are not commonly used on a system		>	tematic, sequential Industrial Control System (ICS) protocol
	>	, but enabled, scripts running out of cycle from patching or		>	reads sweeping the full register/address range across multi
	>	other administrator functions are suspicious. Scripts shoul		>	ple field devices within a short time window, from a source
	>	d be captured from the file system when possible, to determi		>	not in the approved control server list. OT operational-fide
	>	ne their actions and intent. Monitor executed commands and a		>	lity gate: Do not alert on novelty, scan/read volume, or enu
	>	rguments for actions that could be taken to collect internal		>	meration alone. Alert when the source role is not authorized
	>	data. Monitor for unexpected files (e.g., .pdf, .docx, .jpg		>	for discovery/polling and the target scope, address/tag ran
	>	) viewed for collecting internal data. Monitor for informati		>	ge, protocol, or rate deviates from the established operatio
	>	on collection on assets that may indicate deviations from st		>	nal baseline. Suppress normal SCADA/HMI/historian polling, c
	>	andard operational tools. Examples include unexpected indust		>	ommissioning, asset inventory, backup, diagnostics, and appr
	>	rial automation protocol functions, new high volume communic		>	oved engineering activity.
	>	ation sessions, or broad collection across many hosts within
	>	the network.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ApprovedHistorianClients', 'description': 'Allowlist of applications/accounts authorized to perform bulk historian queries.'}, {'field': 'ApprovedSCADAServers', 'description': 'IP allowlist of legitimate SCADA/historian servers.'}, {'field': 'AutoCollectionTimeWindow', 'description': 'Time window within which sequential reads across multiple devices are considered part of a single automated collection event.'}, {'field': 'BulkQueryThreshold', 'description': 'Record count threshold above which a historian query is considered a bulk export rather than a routine query.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:45:28.497000+00:00
description	Monitor for any suspicious attempts to enable script execution on a system. If scripts are not commonly used on a system, but enabled, scripts running out of cycle from patching or other administrator functions are suspicious. Scripts should be captured from the file system when possible, to determine their actions and intent. Monitor executed commands and arguments for actions that could be taken to collect internal data. Monitor for unexpected files (e.g., .pdf, .docx, .jpg) viewed for collecting internal data. Monitor for information collection on assets that may indicate deviations from standard operational tools. Examples include unexpected industrial automation protocol functions, new high volume communication sessions, or broad collection across many hosts within the network.	Real-time network monitoring identifies a source issuing systematic, sequential Industrial Control System (ICS) protocol reads sweeping the full register/address range across multiple field devices within a short time window, from a source not in the approved control server list. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9f387817-df83-432a-b56b-a8fb7f71eedd', 'name': 'Script', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--685f917a-e95e-4ba0-ade1-c7d354dae6e0', 'name': 'historian:applog', 'channel': 'bulk export query returning above bulk query threshold records from account not in approved historian clients'}
x_mitre_platforms[0]	None	Embedded
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--685f917a-e95e-4ba0-ade1-c7d354dae6e0', 'name': 'Command', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'NSM:Content', 'channel': 'source not in approved Supervisory Control and Data Acquisition (SCADA) servers issuing reads covering sequential address ranges across multiple device Internet Protocol (IP) addresses within auto collection time window'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--235b7491-2d2b-4617-9a52-3c0783680f71', 'name': 'File', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'Network Traffic', 'channel': 'None'}

[AN1869] Analytic 1869

Current version: 1.0

	Old Description			New Description
t	1	Analyze network data for uncommon data flows (e.g., new prot	t	1	Real-time monitoring identifies an Industrial Control System
	>	ocols in use between hosts, unexpected ports in use). Proces		>	(ICS) host or server establishing outbound connections on a
	>	ses utilizing the network that do not normally have network		>	commonly-allowed port (e.g., 443, 80, 8080, 53, etc.) to a
	>	communication or have never been seen before are suspicious.		>	destination not in the approved vendor/business domain list,
	>	Monitor for mismatches between protocols and their expecte		>	where that host's documented network role does not require
	>	d ports (e.g., non-HTTP traffic on tcp:80). Analyze packet c		>	external connectivity. Documented real-world use: Sandworm's
	>	ontents to detect communications that do not follow the expe		>	2015 Ukraine power grid attack used port 443 for Command an
	>	cted protocol behavior for the port that is being used.(Cita		>	d Control (C2) communications. OT operational-fidelity gate:
	>	tion: University of Birmingham C2)		>	Alert only when the asset's documented role does not permit
				>	the connection and the destination/proxy/service is outside
				>	the approved communications profile, with process/service i
				>	dentity used as corroboration where available. Suppress appr
				>	oved vendor support, update repositories, remote operations,
				>	failover paths, and documented temporary connectivity. SNI
				>	and certificate attributes are TLS/session metadata; do not
				>	treat them as decrypted payload content. Encrypted applicati
				>	on content requires a separate inspection point.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ApprovedVendorDomains', 'description': 'Allowlist of legitimate vendor domains for software updates, licensing, or remote support.'}, {'field': 'NoExternalConnectivityRoleList', 'description': 'Inventory of ICS hosts whose documented function never requires outbound internet connectivity.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:45:33.391000+00:00
external_references[1]['description']	Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.	Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved September 3, 2026.
external_references[1]['url']	https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf	https://arxiv.org/pdf/1408.1136
description	Analyze network data for uncommon data flows (e.g., new protocols in use between hosts, unexpected ports in use). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Monitor for mismatches between protocols and their expected ports (e.g., non-HTTP traffic on tcp:80). Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used.(Citation: University of Birmingham C2)	Real-time monitoring identifies an Industrial Control System (ICS) host or server establishing outbound connections on a commonly-allowed port (e.g., 443, 80, 8080, 53, etc.) to a destination not in the approved vendor/business domain list, where that host's documented network role does not require external connectivity. Documented real-world use: Sandworm's 2015 Ukraine power grid attack used port 443 for Command and Control (C2) communications. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity. SNI and certificate attributes are TLS/session metadata; do not treat them as decrypted payload content. Encrypted application content requires a separate inspection point.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'Network Traffic', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): egress flow on port 443/80/8080/53 from Industrial Control Systems (ICS) host in no-external-connectivity role list to destination not in approved vendor domains'}
x_mitre_platforms[0]	None	Network Devices
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'Network Traffic', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'zeek:ssl', 'channel': 'Transport Layer Security (TLS) Server Name Indication (SNI) or certificate issuer does not match approved vendor domains or recognized Content Delivery Network (CDN) serving vendor content'}

[AN1870] Analytic 1870

Current version: 1.0

	Old Description			New Description
t	1	Monitor operational process data for write commands for an e	t	1	Real-time network monitoring identifies a source issuing wri
	>	xcessive number of I/O points or manipulating a single value		>	te commands to the same Input/Output (I/O) point or register
	>	an excessive number of times. This will not directly detect		>	address at a rate significantly exceeding the device's conf
	>	the technique’s execution, but instead may provide addition		>	igured scan cycle. The write rate itself is the signature, w
	>	al evidence that the technique has been used and may complem		>	ith source identity retained as corroborating context; treat
	>	ent other detections. Some asset application logs may provid		>	the rate deviation as suspicious only after excluding tunin
	>	e information on I/O points related to write commands. Monit		>	g, commissioning, failover, and fault-recovery activity. OT
	>	or for write commands for an excessive number of I/O points		>	operational-fidelity gate: Alert only when the action is not
	>	or manipulating a single value an excessive number of times.		>	attributable to an authorized operator/engineering source f
	>	Monitor network traffic for ICS functions related to write		>	or the specific target and function, and it is either outsid
	>	commands for an excessive number of I/O points or manipulati		>	e an approved change/maintenance window or lacks matching ch
	>	ng a single value an excessive number of times.		>	ange-control context; where telemetry permits, require corro
				>	borating device, configuration, or process-state effect. Sup
				>	press activity that fully matches approved maintenance, comm
				>	issioning, failover, recovery, or tested control procedures.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'BruteForceDetectionWindow', 'description': 'Time window over which write rate is measured for threshold comparison.'}, {'field': 'MaxNormalStateChangeRate', 'description': 'Maximum rate at which the physical process value is expected to legitimately change state.'}, {'field': 'MaxWriteQueueDepth', 'description': 'Maximum legitimate write queue depth for SCADA/DCS write operations to a single point.'}, {'field': 'MaxWriteRatePerPoint', 'description': "Maximum legitimate write rate to a single I/O point, derived from the device's configured scan cycle and physical process response time."}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:46:27.401000+00:00
description	Monitor operational process data for write commands for an excessive number of I/O points or manipulating a single value an excessive number of times. This will not directly detect the technique’s execution, but instead may provide additional evidence that the technique has been used and may complement other detections. Some asset application logs may provide information on I/O points related to write commands. Monitor for write commands for an excessive number of I/O points or manipulating a single value an excessive number of times. Monitor network traffic for ICS functions related to write commands for an excessive number of I/O points or manipulating a single value an excessive number of times.	Real-time network monitoring identifies a source issuing write commands to the same Input/Output (I/O) point or register address at a rate significantly exceeding the device's configured scan cycle. The write rate itself is the signature, with source identity retained as corroborating context; treat the rate deviation as suspicious only after excluding tuning, commissioning, failover, and fault-recovery activity. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--931b3fc6-ad68-42a8-9018-e98515eedc95', 'name': 'Operational Databases', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--931b3fc6-ad68-42a8-9018-e98515eedc95', 'name': 'operationaldb:ProcessHistory', 'channel': 'I/O point value oscillates or changes state at frequency exceeding max normal state change rate, inconsistent with physical process response time'}
x_mitre_platforms[0]	None	Embedded
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'Application Log', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'NSM:Content', 'channel': 'write function code to same register address at rate exceeding max write rate per point within brute force detection window'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'Network Traffic', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'scada:applog', 'channel': 'write Application Programming Interface (API) call queue depth or throughput to a single point exceeds max write queue depth'}

[AN1871] Analytic 1871

Current version: 1.0

	Old Description			New Description
t	1	Detecting software exploitation may be difficult depending o	t	1	Real-time monitoring identifies Industrial Control System (I
	>	n the tools available. Software exploits may not always succ		>	CS) protocol commands succeeding against protected device fu
	>	eed or may cause the exploited process to become unstable or		>	nctions from a source or session context that the device's d
	>	crash.		>	ocumented access control model should reject, indicating exp
				>	loitation of a vulnerability to bypass the device's privileg
				>	e model. Documented as the core mechanism of the Triton atta
				>	ck, which exploited a zero-day in Triconex firmware while in
				>	PROGRAM mode. OT operational-fidelity gate: Alert only when
				>	execution violates an approved signer/hash/path/parent/proc
				>	ess or tool allowlist, or originates from an unauthorized us
				>	er/tool, and is tied to an OT asset or follow-on OT-relevant
				>	action. Suppress vendor-signed software, approved engineeri
				>	ng utilities, diagnostics, patching, backup, and documented
				>	maintenance.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ExploitCrashCorrelationWindow', 'description': 'Time window within which a device/process crash and subsequent privileged action are considered correlated.'}, {'field': 'KnownVulnerableDriverSignatures', 'description': 'Documented hash/name signatures of known vulnerable drivers exploitable for privilege escalation (BYOVD technique).'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:46:37.455000+00:00
description	Detecting software exploitation may be difficult depending on the tools available. Software exploits may not always succeed or may cause the exploited process to become unstable or crash.	Real-time monitoring identifies Industrial Control System (ICS) protocol commands succeeding against protected device functions from a source or session context that the device's documented access control model should reject, indicating exploitation of a vulnerability to bypass the device's privilege model. Documented as the core mechanism of the Triton attack, which exploited a zero-day in Triconex firmware while in PROGRAM mode. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'Application Log', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba', 'name': 'NSM:Connections', 'channel': 'device process crash or unexpected restart immediately followed by privileged protocol command succeeding from same source session'}
x_mitre_platforms[0]	None	Embedded

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'device:VendorLog', 'channel': 'protected function (firmware write, memory protection mode change) succeeds for a session that did not complete the documented authentication/privilege-elevation sequence'}

[AN1872] Analytic 1872

Current version: 1.0

	Old Description			New Description
t	1	Monitor for files (such as /etc/hosts) being accessed that m	t	1	Real-time monitoring identifies execution of network discove
	>	ay attempt to get a listing of other systems by IP address,		>	ry tools (nmap, PLCScan, redpoint NSE scripts) or Industrial
	>	hostname, or other logical identifier on a network that may		>	Control System (ICS)-specific scanners from an Industrial C
	>	be used for Lateral Movement from the current system. Monito		>	ontrol System (ICS) Windows host, from a process not associa
	>	r for newly executed processes that can be used to discover		>	ted with a recognized network management or engineering tool
	>	remote systems, such as ping.exe and tracert.exe , especial		>	. OT operational-fidelity gate: Do not alert on novelty, sca
	>	ly when executed in quick succession.(Citation: Elastic - Ko		>	n/read volume, or enumeration alone. Alert when the source r
	>	adiac Detection with EQL) Consider monitoring for new proces		>	ole is not authorized for discovery/polling and the target s
	>	ses engaging in scanning activity or connecting to multiple		>	cope, address/tag range, protocol, or rate deviates from the
	>	systems by correlating process creation network data. Monito		>	established operational baseline. Suppress normal SCADA/HMI
	>	r for anomalies related to discovery related ICS functions,		>	/historian polling, commissioning, asset inventory, backup,
	>	including devices that have not previously used these functi		>	diagnostics, and approved engineering activity.
	>	ons or for functions being sent to many outstations. Note th
	>	at some ICS protocols use broadcast or multicast functionali
	>	ty, which may produce false positives. Also monitor for host
	>	s enumerating network connected resources using non-ICS ente
	>	rprise protocols. Monitor for new ICS protocol connections t
	>	o existing assets or for device scanning (i.e., a host conne
	>	cting to many devices) over ICS and enterprise protocols (e.
	>	g., ICMP, DCOM, WinRM). For added context on adversary enter
	>	prise procedures and background see [Remote System Discovery
	>	](https://attack.mitre.org/techniques/T1018).

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ApprovedSCADAServers', 'description': 'IP allowlist of legitimate engineering and SCADA systems.'}, {'field': 'AuthorizedNetworkTools', 'description': 'Allowlist of network management/diagnostic tools authorized for use on ICS hosts.'}, {'field': 'DiscoveryTimeWindow', 'description': 'Time window within which sequential connections across the address range are considered a single discovery sweep event.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:47:40.667000+00:00
description	Monitor for files (such as /etc/hosts) being accessed that may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Monitor for newly executed processes that can be used to discover remote systems, such as ping.exe and tracert.exe , especially when executed in quick succession.(Citation: Elastic - Koadiac Detection with EQL) Consider monitoring for new processes engaging in scanning activity or connecting to multiple systems by correlating process creation network data. Monitor for anomalies related to discovery related ICS functions, including devices that have not previously used these functions or for functions being sent to many outstations. Note that some ICS protocols use broadcast or multicast functionality, which may produce false positives. Also monitor for hosts enumerating network connected resources using non-ICS enterprise protocols. Monitor for new ICS protocol connections to existing assets or for device scanning (i.e., a host connecting to many devices) over ICS and enterprise protocols (e.g., ICMP, DCOM, WinRM). For added context on adversary enterprise procedures and background see [Remote System Discovery](https://attack.mitre.org/techniques/T1018).	Real-time monitoring identifies execution of network discovery tools (nmap, PLCScan, redpoint NSE scripts) or Industrial Control System (ICS)-specific scanners from an Industrial Control System (ICS) Windows host, from a process not associated with a recognized network management or engineering tool. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--235b7491-2d2b-4617-9a52-3c0783680f71', 'name': 'File', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 of network discovery tool (nmap, PLCScan) from process not in authorized network tools list'}
x_mitre_platforms[0]	None	Windows

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'Process', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'Network Traffic', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'Network Traffic', 'channel': 'None'}

[AN1873] Analytic 1873

Current version: 1.0

	Old Description			New Description
t	1	Detecting software exploitation may be difficult depending o	t	1	Real-time monitoring identifies an internet-facing Industria
	>	n the tools available. Software exploits may not always succ		>	l Control System (ICS) application server, web Human-Machine
	>	eed or may cause the exploited process to become unstable or		>	Interface (HMI), historian web interface, vendor remote acc
	>	crash. Web Application Firewalls may detect improper inputs		>	ess portal) process spawning an unexpected child process imm
	>	attempting exploitation. Use deep packet inspection to look		>	ediately following an inbound web request containing exploit
	>	for artifacts of common exploit traffic, such as known payl		>	-pattern content. Documented across multiple incidents invol
	>	oads.		>	ving internet-exposed ICS web interfaces. OT operational-fid
				>	elity gate: Alert only when execution violates an approved s
				>	igner/hash/path/parent/process or tool allowlist, or origina
				>	tes from an unauthorized user/tool, and is tied to an OT ass
				>	et or follow-on OT-relevant action. Suppress vendor-signed s
				>	oftware, approved engineering utilities, diagnostics, patchi
				>	ng, backup, and documented maintenance. Analyst implementati
				>	on must limit predicates to fields actually retained by the
				>	web server/WAF (for example URI/path/query/header/status/sou
				>	rce); request-body or payload signatures require WAF/DPI or
				>	request-body logging and must not be inferred from a basic a
				>	ccess log.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ApprovedClientCIDR', 'description': 'IP ranges from which legitimate access to the ICS web interface is expected.'}, {'field': 'ExploitPatternSignatures', 'description': 'Regex/signature set for known exploit payload patterns and published CVE-specific payload signatures for in-use ICS web products.'}, {'field': 'ExploitToShellWindow', 'description': 'Time window within which a child shell process spawned from the web server is considered connected to a preceding exploit-pattern request.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:47:21.575000+00:00
description	Detecting software exploitation may be difficult depending on the tools available. Software exploits may not always succeed or may cause the exploited process to become unstable or crash. Web Application Firewalls may detect improper inputs attempting exploitation. Use deep packet inspection to look for artifacts of common exploit traffic, such as known payloads.	Real-time monitoring identifies an internet-facing Industrial Control System (ICS) application server, web Human-Machine Interface (HMI), historian web interface, vendor remote access portal) process spawning an unexpected child process immediately following an inbound web request containing exploit-pattern content. Documented across multiple incidents involving internet-exposed ICS web interfaces. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance. Analyst implementation must limit predicates to fields actually retained by the web server/WAF (for example URI/path/query/header/status/source); request-body or payload signatures require WAF/DPI or request-body logging and must not be inferred from a basic access log.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'Application Log', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'webserver:applog', 'channel': 'Web server/WAF access or request log: exploit-relevant URI/path/query/header/status pattern against ICS web interface from unapproved source; request-body claims require WAF/DPI logging'}
x_mitre_platforms[0]	None	Windows
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'Network Traffic', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 with parent matching web/application server process and image matching shell/script interpreter within exploit-to-shell window of anomalous request'}

[AN1874] Analytic 1874

Current version: 1.0

	Old Description			New Description
t	1	Monitor asset application logs for information that indicate	t	1	Real-time monitoring identifies an Industrial Control System
	>	task parameters have changed. Monitor device alarms that in		>	(ICS) protocol write to a controller's task/organization-bl
	>	dicate controller task parameters have changed, although not		>	ock configuration from a source not in the approved engineer
	>	all devices produce such alarms. [Program Download](https		>	ing workstation list, correlated against post-modification c
	>	://attack.mitre.org/techniques/T0843) may be used to enable		>	ycle timing deviation. Documented precedent: Stuxnet infecte
	>	this technique. Monitor for program downloads which may be n		>	d Siemens OB1 (main execution cycle block) so its malicious
	>	oticeable via operational alarms. Asset management systems s		>	payload ran every cycle, and infected OB35 (watchdog/interru
	>	hould be consulted to understand expected program versions.		>	pt block) to suppress error reporting. OT operational-fideli
	>	Engineering and asset management software will often maintai		>	ty gate: Alert only when the action is not attributable to a
	>	n a copy of the expected program loaded on a controller and		>	n authorized operator/engineering source for the specific ta
	>	may also record any changes made to controller programs and		>	rget and function, and it is either outside an approved chan
	>	tasks. Data from these platforms can be used to identify mod		>	ge/maintenance window or lacks matching change-control conte
	>	ified controller tasking.		>	xt; where telemetry permits, require corroborating device, c
				>	onfiguration, or process-state effect. Suppress activity tha
				>	t fully matches approved maintenance, commissioning, failove
				>	r, recovery, or tested control procedures.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'BaselineCycleTime', 'description': 'Measured normal scan cycle time for the specific controller and program.'}, {'field': 'ChangeControlWindow', 'description': 'Scheduled maintenance periods during which task reconfiguration is authorized.'}, {'field': 'CycleTimingDeviationThreshold', 'description': 'Percentage or absolute deviation from baseline cycle time indicating a task reassignment.'}, {'field': 'EngineeringWorkstationList', 'description': 'IP allowlist of workstations authorized to modify controller task configuration.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:44:04.902000+00:00
description	Monitor asset application logs for information that indicate task parameters have changed. Monitor device alarms that indicate controller task parameters have changed, although not all devices produce such alarms. [Program Download](https://attack.mitre.org/techniques/T0843) may be used to enable this technique. Monitor for program downloads which may be noticeable via operational alarms. Asset management systems should be consulted to understand expected program versions. Engineering and asset management software will often maintain a copy of the expected program loaded on a controller and may also record any changes made to controller programs and tasks. Data from these platforms can be used to identify modified controller tasking.	Real-time monitoring identifies an Industrial Control System (ICS) protocol write to a controller's task/organization-block configuration from a source not in the approved engineering workstation list, correlated against post-modification cycle timing deviation. Documented precedent: Stuxnet infected Siemens OB1 (main execution cycle block) so its malicious payload ran every cycle, and infected OB35 (watchdog/interrupt block) to suppress error reporting. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'Application Log', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--8ed4e6d0-56d7-4e6b-8fa6-41f41631f30d', 'name': 'assetinventory:ProgramDiff', 'channel': 'current task-to-block assignment table differs from last known-good baseline without corresponding change ticket'}
x_mitre_platforms[0]	None	Embedded
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9d56be63-3501-4dd3-bb5f-63c580833298', 'name': 'Operational Databases', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'NSM:Content', 'channel': 'task/organization-block modification service from source not in engineering workstation list outside change control window'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--8ed4e6d0-56d7-4e6b-8fa6-41f41631f30d', 'name': 'Asset', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9d56be63-3501-4dd3-bb5f-63c580833298', 'name': 'device:VendorLog', 'channel': 'measured scan cycle time or interrupt response latency deviates from baseline cycle time by more than cycle timing deviation threshold following a task configuration change'}

[AN1875] Analytic 1875

Current version: 1.0

	Old Description			New Description
t	1	Devices that provide user access to the underlying operating	t	1	Real-time monitoring identifies an unrecognized process on a
	>	system may allow the installation of custom software to mon		>	n ICS Linux host loading an ICS/vendor shared library that i
	>	itor OS API execution. Monitoring API calls may generate a s		>	s normally restricted to approved control or engineering app
	>	ignificant amount of data and may not be useful for defense		>	lications. OT operational-fidelity gate: Alert only when exe
	>	unless collected under specific circumstances, since benign		>	cution violates an approved signer/hash/path/parent/process
	>	use of API functions are common and may be difficult to dist		>	or tool allowlist, or originates from an unauthorized user/t
	>	inguish from malicious behavior. Correlation of other events		>	ool, and is tied to an OT asset or follow-on OT-relevant act
	>	with behavior surrounding API function calls using API moni		>	ion. Suppress vendor-signed software, approved engineering u
	>	toring will provide additional context to an event that may		>	tilities, diagnostics, patching, backup, and documented main
	>	assist in determining if it is due to malicious behavior.		>	tenance.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ApprovedApplicationList', 'description': 'Allowlist of application identities authorized to issue OPC UA or IEC 61850 write/control service requests.'}, {'field': 'ApprovedOPCClients', 'description': 'Allowlist of OPC client application identities authorized to invoke write/control methods.'}, {'field': 'AuthorizedICSApplications', 'description': 'Allowlist of process executables permitted to load ICS vendor automation API libraries.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:44:39.237000+00:00
description	Devices that provide user access to the underlying operating system may allow the installation of custom software to monitor OS API execution. Monitoring API calls may generate a significant amount of data and may not be useful for defense unless collected under specific circumstances, since benign use of API functions are common and may be difficult to distinguish from malicious behavior. Correlation of other events with behavior surrounding API function calls using API monitoring will provide additional context to an event that may assist in determining if it is due to malicious behavior.	Real-time monitoring identifies an unrecognized process on an ICS Linux host loading an ICS/vendor shared library that is normally restricted to approved control or engineering applications. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.
x_mitre_log_source_references[0]['name']	Process	auditd:SYSCALL
x_mitre_log_source_references[0]['channel']	None	Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): dlopen() of Industrial Control Systems (ICS) vendor shared library by process not in authorized ICS applications, followed by write-capable network connection to device subnet
x_mitre_platforms[0]	None	Linux

[AN1876] Analytic 1876

Current version: 1.0

	Old Description			New Description
t	1	Purely passive network sniffing cannot be detected effective	t	1	Real-time monitoring identifies indirect evidence of passive
	>	ly. In cases where the adversary interacts with the wireless		>	RF capture on Industrial Control System (ICS) wireless freq
	>	network (e.g., joining a Wi-Fi network) detection may be po		>	uencies -- an unassociated device's RF signature detected wi
	>	ssible. Monitor for new or irregular network traffic flows w		>	thout a completed association sequence, or a known device's
	>	hich may indicate potentially unwanted devices or sessions o		>	Media Access Control (MAC) address detected from a location/
	>	n wireless networks. In Wi-Fi networks monitor for changes		>	signal strength inconsistent with its registered installatio
	>	such as rogue access points or low signal strength, indicati		>	n point. OT operational-fidelity gate: Do not alert on novel
	>	ng a device is further away from the access point then expec		>	ty, scan/read volume, or enumeration alone. Alert when the s
	>	ted and changes in the physical layer signal.(Citation: Nzym		>	ource role is not authorized for discovery/polling and the t
	>	e Alerts Intro) (Citation: Wireless Intrusion Detection) Ne		>	arget scope, address/tag range, protocol, or rate deviates f
	>	twork traffic content will provide important context, such a		>	rom the established operational baseline. Suppress normal SC
	>	s hardware (e.g., MAC) addresses, user accounts, and types o		>	ADA/HMI/historian polling, commissioning, asset inventory, b
	>	f messages sent.		>	ackup, diagnostics, and approved engineering activity.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ApprovedWirelessDeviceInventory', 'description': 'MAC/identity inventory of all devices authorized on the ICS wireless segment.'}, {'field': 'DesignatedWirelessManagementStations', 'description': 'Hosts authorized to legitimately enable wireless capture for diagnostics.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:48:04.063000+00:00
description	Purely passive network sniffing cannot be detected effectively. In cases where the adversary interacts with the wireless network (e.g., joining a Wi-Fi network) detection may be possible. Monitor for new or irregular network traffic flows which may indicate potentially unwanted devices or sessions on wireless networks. In Wi-Fi networks monitor for changes such as rogue access points or low signal strength, indicating a device is further away from the access point then expected and changes in the physical layer signal.(Citation: Nzyme Alerts Intro) (Citation: Wireless Intrusion Detection) Network traffic content will provide important context, such as hardware (e.g., MAC) addresses, user accounts, and types of messages sent.	Real-time monitoring identifies indirect evidence of passive RF capture on Industrial Control System (ICS) wireless frequencies -- an unassociated device's RF signature detected without a completed association sequence, or a known device's Media Access Control (MAC) address detected from a location/signal strength inconsistent with its registered installation point. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
x_mitre_log_source_references[0]['name']	Network Traffic	wireless:spectrum
x_mitre_log_source_references[0]['channel']	None	Radio Frequency (RF) signal detected on Industrial Control Systems (ICS) wireless frequencies from Media Access Control (MAC) address not in approved wireless device inventory without completed association sequence
x_mitre_platforms[0]	None	Embedded

[AN1877] Analytic 1877

Current version: 1.0

	Old Description			New Description
t	1	Monitor for network traffic originating from unknown/unexpec	t	1	Real-time monitoring identifies a device establishing its fi
	>	ted hardware devices. Local network traffic metadata (such a		>	rst network connection to Industrial Control System (ICS) ap
	>	s source MAC addressing) may be helpful in identifying trans		>	plication servers from an Internet Protocol (IP) address or
	>	ient assets. Networking devices such as switches may log whe		>	Media Access Control (MAC) address not previously seen in th
	>	n new client devices connect (e.g., SNMP notifications). Mon		>	e environment, immediately following a new device associatio
	>	itor for any logs documenting changes to network connection		>	n event on the network. OT operational-fidelity gate: Alert
	>	status to determine when a new connection has occurred, incl		>	only when the account/device/session violates the approved i
	>	uding the resulting addresses (e.g., IP, MAC) of devices on		>	dentity + source host/jump path/zone policy and is corrobora
	>	that network.		>	ted by access to a protected OT asset, execution, configurat
				>	ion change, or another security-relevant follow-on event. Su
				>	ppress approved shift activity, vendor support, break-glass
				>	use, commissioning, and documented remote-access windows.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ApprovedDeviceInventory', 'description': 'Hardware ID inventory of all devices authorized to connect to the ICS network, ideally enforced via NAC/802.1X.'}, {'field': 'NewDeviceWindow', 'description': 'Time window after first network appearance within which access to ICS systems is considered part of the same onboarding/intrusion event.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:45:36.505000+00:00
description	Monitor for network traffic originating from unknown/unexpected hardware devices. Local network traffic metadata (such as source MAC addressing) may be helpful in identifying transient assets. Networking devices such as switches may log when new client devices connect (e.g., SNMP notifications). Monitor for any logs documenting changes to network connection status to determine when a new connection has occurred, including the resulting addresses (e.g., IP, MAC) of devices on that network.	Real-time monitoring identifies a device establishing its first network connection to Industrial Control System (ICS) application servers from an Internet Protocol (IP) address or Media Access Control (MAC) address not previously seen in the environment, immediately following a new device association event on the network. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'Network Traffic', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): connection from newly-observed device to Industrial Control Systems (ICS) application server within new device window of first network appearance'}
x_mitre_platforms[0]	None	Windows
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'Application Log', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9ce98c86-8d30-4043-ba54-0784d478d0b5', 'name': 'WinEventLog:Security', 'channel': 'Windows Security Event ID 4624/4625: EventCode=4624 from a device Media Access Control (MAC) address/hardware-ID first observed on the network, not in approved device inventory'}

[AN1878] Analytic 1878

Current version: 1.0

	Old Description			New Description
t	1	Monitor for unexpected network share access, such as files t	t	1	Real-time monitoring identifies a file written to an Industr
	>	ransferred between shares within a network using protocols s		>	ial Control System (ICS) host from a remote network share, w
	>	uch as Server Message Block (SMB). Monitor for alike file ha		>	here the file has an executable or script extension, immedia
	>	shes or characteristics (ex: filename) that are created on m		>	tely followed by execution of that file from the same path.
	>	ultiple hosts. Monitor for file creation in conjunction wit		>	Documented in the PIPEDREAM toolkit's modular design, where
	>	h other techniques (e.g., file transfers using [Remote Servi		>	components transfer files to compromised Programmable Logic
	>	ces](https://attack.mitre.org/techniques/T0886)). Monitor fo		>	Controllers (PLCs) and engineering workstations. OT operatio
	>	r unusual processes with internal network connections creati		>	nal-fidelity gate: Alert only when execution violates an app
	>	ng files on-system which may be suspicious. Monitor execute		>	roved signer/hash/path/parent/process or tool allowlist, or
	>	d commands and arguments for abnormal usage of utilities and		>	originates from an unauthorized user/tool, and is tied to an
	>	command-line arguments that may be used in support of remot		>	OT asset or follow-on OT-relevant action. Suppress vendor-s
	>	e transfer of files. Monitor newly constructed processes tha		>	igned software, approved engineering utilities, diagnostics,
	>	t assist in lateral tool transfers, such as file transfer pr		>	patching, backup, and documented maintenance.
	>	ograms. Monitor for network traffic originating from unknown
	>	/unexpected hosts. Local network traffic metadata (such as s
	>	ource MAC addressing) as well as usage of network management
	>	protocols such as DHCP may be helpful in identifying hardwa
	>	re.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'AuthorizedFileSources', 'description': 'Allowlist of network shares/hosts authorized to write executable or script files to ICS Windows assets.'}, {'field': 'EngineeringWorkstationList', 'description': 'IP allowlist of workstations authorized to perform file transfers to field devices.'}, {'field': 'SuspiciousFilePatterns', 'description': "Filename/extension patterns inconsistent with the device's normal configuration exchange profile."}, {'field': 'ToolTransferWindow', 'description': 'Time window after file creation within which execution is considered directly connected to the transfer event.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:47:25.745000+00:00
description	Monitor for unexpected network share access, such as files transferred between shares within a network using protocols such as Server Message Block (SMB). Monitor for alike file hashes or characteristics (ex: filename) that are created on multiple hosts. Monitor for file creation in conjunction with other techniques (e.g., file transfers using [Remote Services](https://attack.mitre.org/techniques/T0886)). Monitor for unusual processes with internal network connections creating files on-system which may be suspicious. Monitor executed commands and arguments for abnormal usage of utilities and command-line arguments that may be used in support of remote transfer of files. Monitor newly constructed processes that assist in lateral tool transfers, such as file transfer programs. Monitor for network traffic originating from unknown/unexpected hosts. Local network traffic metadata (such as source MAC addressing) as well as usage of network management protocols such as DHCP may be helpful in identifying hardware.	Real-time monitoring identifies a file written to an Industrial Control System (ICS) host from a remote network share, where the file has an executable or script extension, immediately followed by execution of that file from the same path. Documented in the PIPEDREAM toolkit's modular design, where components transfer files to compromised Programmable Logic Controllers (PLCs) and engineering workstations. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--f5468e67-51c7-4756-9b4f-65707708e7fa', 'name': 'Network Share', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--f5468e67-51c7-4756-9b4f-65707708e7fa', 'name': 'WinEventLog:Security', 'channel': 'Windows Security Event ID 5140/5145: EventCode=5145 for file write to Industrial Control Systems (ICS) host, source not in authorized file sources'}
x_mitre_platforms[0]	None	Windows
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--639e87f3-acb6-448a-9645-258f20da4bc5', 'name': 'File', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=11 with executable/script extension from remote-sourced write operation'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'File', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 of the newly-created file within tool transfer window of its creation'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'Network Traffic', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--685f917a-e95e-4ba0-ade1-c7d354dae6e0', 'name': 'Command', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'Process', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'Network Traffic', 'channel': 'None'}

[AN1879] Analytic 1879

Current version: 1.0

	Old Description			New Description
t	1	Various techniques enable spoofing a reporting message. Cons	t	1	Real-time monitoring identifies a process on an Industrial C
	>	ider monitoring for [Rogue Master](https://attack.mitre.org/		>	ontrol System (ICS) Windows host injecting spoofed reporting
	>	techniques/T0848) and [Adversary-in-the-Middle](https://atta		>	messages into the Supervisory Control and Data Acquisition
	>	ck.mitre.org/techniques/T0830) activity which may precede th		>	(SCADA) data path -- Open Platform Communications Unified Ar
	>	is technique. Monitor asset logs for alarms or other informa		>	chitecture (OPC UA) data change notifications with fabricate
	>	tion the adversary is unable to directly suppress. Relevant		>	d values, or historian tag writes that override device-sourc
	>	alarms include those from a loss of communications due to [A		>	ed values -- from a process that is not the recognized data
	>	dversary-in-the-Middle](https://attack.mitre.org/techniques/		>	acquisition process. OT operational-fidelity gate: Alert onl
	>	T0830) activity. Various techniques enable spoofing a report		>	y when the action is not attributable to an authorized opera
	>	ing message. Monitor for LLMNR/NBT-NS poisoning via new serv		>	tor/engineering source for the specific target and function,
	>	ices/daemons which may be used to enable this technique. For		>	and it is either outside an approved change/maintenance win
	>	added context on adversary procedures and background see [N		>	dow or lacks matching change-control context; where telemetr
	>	ame Resolution Poisoning and SMB Relay](https://attack.mitre		>	y permits, require corroborating device, configuration, or p
	>	.org/techniques/T1557/001). Spoofed reporting messages may b		>	rocess-state effect. Suppress activity that fully matches ap
	>	e detected by reviewing the content of automation protocols,		>	proved maintenance, commissioning, failover, recovery, or te
	>	either through detecting based on expected values or compar		>	sted control procedures.
	>	ing to other out of band process data sources. Spoofed messa
	>	ges may not precisely match legitimate messages which may le
	>	ad to malformed traffic, although traffic may be malformed f
	>	or many benign reasons. Monitor reporting messages for chang
	>	es in how they are constructed. Various techniques enable s
	>	poofing a reporting message. Consider monitoring for [Rogue
	>	Master](https://attack.mitre.org/techniques/T0848) and [Adve
	>	rsary-in-the-Middle](https://attack.mitre.org/techniques/T08
	>	30) activity.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'SensorToleranceThreshold', 'description': 'Acceptable divergence between primary and independent secondary measurement of the same physical quantity.'}, {'field': 'ZeroVarianceWindow', 'description': 'Time window over which reported values are checked for implausible stability.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:46:15.236000+00:00
description	Various techniques enable spoofing a reporting message. Consider monitoring for [Rogue Master](https://attack.mitre.org/techniques/T0848) and [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T0830) activity which may precede this technique. Monitor asset logs for alarms or other information the adversary is unable to directly suppress. Relevant alarms include those from a loss of communications due to [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T0830) activity. Various techniques enable spoofing a reporting message. Monitor for LLMNR/NBT-NS poisoning via new services/daemons which may be used to enable this technique. For added context on adversary procedures and background see [Name Resolution Poisoning and SMB Relay](https://attack.mitre.org/techniques/T1557/001). Spoofed reporting messages may be detected by reviewing the content of automation protocols, either through detecting based on expected values or comparing to other out of band process data sources. Spoofed messages may not precisely match legitimate messages which may lead to malformed traffic, although traffic may be malformed for many benign reasons. Monitor reporting messages for changes in how they are constructed. Various techniques enable spoofing a reporting message. Consider monitoring for [Rogue Master](https://attack.mitre.org/techniques/T0848) and [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T0830) activity.	Real-time monitoring identifies a process on an Industrial Control System (ICS) Windows host injecting spoofed reporting messages into the Supervisory Control and Data Acquisition (SCADA) data path -- Open Platform Communications Unified Architecture (OPC UA) data change notifications with fabricated values, or historian tag writes that override device-sourced values -- from a process that is not the recognized data acquisition process. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'Network Traffic', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--da85d358-741a-410d-9433-20d6269a6170', 'name': 'opc:applog', 'channel': 'Open Platform Communications (OPC) server data change notification or value write from client_id not matching authorized data acquisition service'}
x_mitre_platforms[0]	None	Windows

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--9d56be63-3501-4dd3-bb5f-63c580833298', 'name': 'Operational Databases', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--da85d358-741a-410d-9433-20d6269a6170', 'name': 'Windows Registry', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'Network Traffic', 'channel': 'None'}

[AN1881] Analytic 1881

Current version: 1.0

	Old Description			New Description
t	1	Monitor for unexpected/abnormal access to files that may be	t	1	Monitor Windows Security Event ID 4663 on explicitly audited
	>	malicious collection of local data, such as user files (e.g.		>	ICS data paths and correlate repeated ReadData/ListDirector
	>	, .pdf, .docx, .jpg, .dwg ) or local databases. Monitor fo		>	y access across multiple sensitive files or directories by a
	>	r newly executed processes that may search local system sour		>	n account/process outside the approved engineering, backup,
	>	ces, such as file systems or local databases, to find files		>	or application baseline. This requires Object Access auditin
	>	of interest and sensitive data. Monitor for any suspicious a		>	g and SACLs on the monitored paths; Sysmon does not provide
	>	ttempts to enable scripts running on a system. If scripts ar		>	generic file-read telemetry. Alert when the bulk-read patter
	>	e not commonly used on a system, but enabled, scripts runnin		>	n occurs outside an approved backup/export window or is foll
	>	g out of cycle from patching or other administrator function		>	owed by staging, compression, or network transfer.
	>	s are suspicious. Scripts should be captured from the file s
	>	ystem when possible to determine their actions and intent. D
	>	ata may also be acquired through Windows system management t
	>	ools such as [Windows Management Instrumentation](https://at
	>	tack.mitre.org/techniques/T1047) and [PowerShell](https://at
	>	tack.mitre.org/techniques/T1059/001). Monitor for API calls
	>	that may search local system sources, such as file systems o
	>	r local databases, to find files of interest and sensitive d
	>	ata. Monitor executed commands and arguments that may searc
	>	h and collect local system sources, such as file systems or
	>	local databases, to find files of interest and sensitive dat
	>	a. Remote access tools with built-in features may interact d
	>	irectly with the Windows API to gather data. Data may also b
	>	e acquired through Windows system management tools such as [
	>	Windows Management Instrumentation](https://attack.mitre.org
	>	/techniques/T1047) and [PowerShell](https://attack.mitre.org
	>	/techniques/T1059/001).

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'AuthorizedICSApplications', 'description': 'Allowlist of processes expected to perform legitimate bulk reads of ICS data.'}, {'field': 'BulkAccessThreshold', 'description': 'Number of distinct files read within the detection window that constitutes bulk collection.'}, {'field': 'ICSDataPaths', 'description': 'File system paths containing ICS configuration, project, and sensitive operational data.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:47:43.395000+00:00
description	Monitor for unexpected/abnormal access to files that may be malicious collection of local data, such as user files (e.g., .pdf, .docx, .jpg, .dwg ) or local databases. Monitor for newly executed processes that may search local system sources, such as file systems or local databases, to find files of interest and sensitive data. Monitor for any suspicious attempts to enable scripts running on a system. If scripts are not commonly used on a system, but enabled, scripts running out of cycle from patching or other administrator functions are suspicious. Scripts should be captured from the file system when possible to determine their actions and intent. Data may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001). Monitor for API calls that may search local system sources, such as file systems or local databases, to find files of interest and sensitive data. Monitor executed commands and arguments that may search and collect local system sources, such as file systems or local databases, to find files of interest and sensitive data. Remote access tools with built-in features may interact directly with the Windows API to gather data. Data may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).	Monitor Windows Security Event ID 4663 on explicitly audited ICS data paths and correlate repeated ReadData/ListDirectory access across multiple sensitive files or directories by an account/process outside the approved engineering, backup, or application baseline. This requires Object Access auditing and SACLs on the monitored paths; Sysmon does not provide generic file-read telemetry. Alert when the bulk-read pattern occurs outside an approved backup/export window or is followed by staging, compression, or network transfer.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--235b7491-2d2b-4617-9a52-3c0783680f71', 'name': 'File', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--235b7491-2d2b-4617-9a52-3c0783680f71', 'name': 'WinEventLog:Sysmon', 'channel': 'Sequential file reads across multiple Industrial Control Systems (ICS) data paths by image not in authorized ICS applications, exceeding bulk access threshold within a short window'}
x_mitre_platforms[0]	None	Windows
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'Process', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 of archive utility immediately following bulk file access pattern from same parent process tree'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--9f387817-df83-432a-b56b-a8fb7f71eedd', 'name': 'Script', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'Process', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--685f917a-e95e-4ba0-ade1-c7d354dae6e0', 'name': 'Command', 'channel': 'None'}

[AN1882] Analytic 1882

Current version: 1.0

	Old Description			New Description
t	1	Monitor executed commands and arguments that may delete or a	t	1	Real-time monitoring identifies an audit log clearing event
	>	lter generated artifacts on a host system, including logs or		>	or deletion/truncation of an Industrial Control System (ICS)
	>	captured files such as quarantined malware. Monitor for API		>	vendor application log file, immediately preceded by other
	>	calls that may delete or alter generated artifacts on a hos		>	suspicious activity on the same host within a short lookback
	>	t system, including logs or captured files such as quarantin		>	window. Documented in the CaddyWiper deployment alongside I
	>	ed malware. Monitor for changes made to Windows Registry key		>	ndustroyer2, explicitly intended to destroy evidence and slo
	>	s or values that may delete or alter generated artifacts on		>	w forensic recovery. OT operational-fidelity gate: Alert onl
	>	a host system, including logs or captured files such as quar		>	y when execution violates an approved signer/hash/path/paren
	>	antined malware. For added context on adversary procedures a		>	t/process or tool allowlist, or originates from an unauthori
	>	nd background see [Indicator Removal](https://attack.mitre.o		>	zed user/tool, and is tied to an OT asset or follow-on OT-re
	>	rg/techniques/T1070) and applicable sub-techniques. Monitor		>	levant action. Suppress vendor-signed software, approved eng
	>	for contextual file data that may show signs of deletion or		>	ineering utilities, diagnostics, patching, backup, and docum
	>	alter generated artifacts on a host system, including logs o		>	ented maintenance.
	>	r captured files such as quarantined malware. Monitor Window
	>	s registry keys that may be deleted or alter generated artif
	>	acts on a host system, including logs or captured files such
	>	as quarantined malware. For added context on adversary proc
	>	edures and background see [Indicator Removal](https://attack
	>	.mitre.org/techniques/T1070) and applicable sub-techniques.
	>	Monitor for a file that may delete or alter generated artifa
	>	cts on a host system, including logs or captured files such
	>	as quarantined malware. Monitor for changes made to a file m
	>	ay delete or alter generated artifacts on a host system, inc
	>	luding logs or captured files such as quarantined malware. M
	>	onitor for newly executed processes that may delete or alter
	>	generated artifacts on a host system, including logs or cap
	>	tured files such as quarantined malware.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'AuthorizedLogManagementTools', 'description': 'Allowlist of processes/accounts authorized to delete or truncate ICS application logs.'}, {'field': 'LogClearLookbackWindow', 'description': 'Time window prior to a log-clear event within which other suspicious activity is considered correlated.'}, {'field': 'ScheduledLogRotationWindow', 'description': 'Documented schedule for legitimate, automated log rotation/archival.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:47:26.656000+00:00
description	Monitor executed commands and arguments that may delete or alter generated artifacts on a host system, including logs or captured files such as quarantined malware. Monitor for API calls that may delete or alter generated artifacts on a host system, including logs or captured files such as quarantined malware. Monitor for changes made to Windows Registry keys or values that may delete or alter generated artifacts on a host system, including logs or captured files such as quarantined malware. For added context on adversary procedures and background see [Indicator Removal](https://attack.mitre.org/techniques/T1070) and applicable sub-techniques. Monitor for contextual file data that may show signs of deletion or alter generated artifacts on a host system, including logs or captured files such as quarantined malware. Monitor Windows registry keys that may be deleted or alter generated artifacts on a host system, including logs or captured files such as quarantined malware. For added context on adversary procedures and background see [Indicator Removal](https://attack.mitre.org/techniques/T1070) and applicable sub-techniques. Monitor for a file that may delete or alter generated artifacts on a host system, including logs or captured files such as quarantined malware. Monitor for changes made to a file may delete or alter generated artifacts on a host system, including logs or captured files such as quarantined malware. Monitor for newly executed processes that may delete or alter generated artifacts on a host system, including logs or captured files such as quarantined malware.	Real-time monitoring identifies an audit log clearing event or deletion/truncation of an Industrial Control System (ICS) vendor application log file, immediately preceded by other suspicious activity on the same host within a short lookback window. Documented in the CaddyWiper deployment alongside Industroyer2, explicitly intended to destroy evidence and slow forensic recovery. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--685f917a-e95e-4ba0-ade1-c7d354dae6e0', 'name': 'Command', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--685f917a-e95e-4ba0-ade1-c7d354dae6e0', 'name': 'WinEventLog:Security', 'channel': 'Windows Security Event ID 4688: EventCode=1102 correlated with any other Medium+ confidence alert on the same host within log clear lookback window'}
x_mitre_platforms[0]	None	Windows
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'Process', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--e905dad2-00d6-477c-97e8-800427abd0e8', 'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=23 or wevtutil/Clear-EventLog invocation deleting Industrial Control Systems (ICS) vendor application log file by process not in authorized log management tools'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--da85d358-741a-410d-9433-20d6269a6170', 'name': 'Windows Registry', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--e905dad2-00d6-477c-97e8-800427abd0e8', 'name': 'WinEventLog:System', 'channel': 'EventCode=104 outside scheduled log rotation window'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--639e87f3-acb6-448a-9645-258f20da4bc5', 'name': 'File', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--1177a4c5-31c8-400c-8544-9071166afa0e', 'name': 'Windows Registry', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--e905dad2-00d6-477c-97e8-800427abd0e8', 'name': 'File', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--84572de3-9583-4c73-aabd-06ea88123dd8', 'name': 'File', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'Process', 'channel': 'None'}

[AN1883] Analytic 1883

Current version: 1.0

	Old Description			New Description
t	1	Monitor executed commands and arguments that may attempt to	t	1	Real-time monitoring identifies execution of screenshot util
	>	take screen captures of the desktop to gather information ov		>	ities (scrot, import, xwd) on an Industrial Control System (
	>	er the course of an operation. Monitoring for screen capture		>	ICS) Linux Human-Machine Interface (HMI), from a User Identi
	>	behavior will depend on the method used to obtain data from		>	fier (UID) that does not normally perform display operations
	>	the operating system and write output files. Detection meth		>	. OT operational-fidelity gate: Do not alert on novelty, sca
	>	ods could include collecting information from unusual proces		>	n/read volume, or enumeration alone. Alert when the source r
	>	ses using API calls used to obtain image data, and monitorin		>	ole is not authorized for discovery/polling and the target s
	>	g for image files written to disk, such as CopyFromScreen, x		>	cope, address/tag range, protocol, or rate deviates from the
	>	wd, or screencapture.(Citation: CopyFromScreen .NET)(Citatio		>	established operational baseline. Suppress normal SCADA/HMI
	>	n: Antiquated Mac Malware) The data may need to be correlate		>	/historian polling, commissioning, asset inventory, backup,
	>	d with other events to identify malicious activity, dependin		>	diagnostics, and approved engineering activity.
	>	g on the legitimacy of this behavior within a given network
	>	environment.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'AuthorizedScreenCaptureTools', 'description': 'Allowlist of remote support, training, or documentation tools legitimately authorized to perform screen capture.'}, {'field': 'CaptureToFileWindow', 'description': 'Time window correlating a screen capture API call with a subsequent image file write.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:44:44.933000+00:00
description	Monitor executed commands and arguments that may attempt to take screen captures of the desktop to gather information over the course of an operation. Monitoring for screen capture behavior will depend on the method used to obtain data from the operating system and write output files. Detection methods could include collecting information from unusual processes using API calls used to obtain image data, and monitoring for image files written to disk, such as CopyFromScreen, xwd, or screencapture.(Citation: CopyFromScreen .NET)(Citation: Antiquated Mac Malware) The data may need to be correlated with other events to identify malicious activity, depending on the legitimacy of this behavior within a given network environment.	Real-time monitoring identifies execution of screenshot utilities (scrot, import, xwd) on an Industrial Control System (ICS) Linux Human-Machine Interface (HMI), from a User Identifier (UID) that does not normally perform display operations. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--685f917a-e95e-4ba0-ade1-c7d354dae6e0', 'name': 'Command', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--685f917a-e95e-4ba0-ade1-c7d354dae6e0', 'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): execve of screenshot utility (scrot, import, xwd) on Industrial Control Systems (ICS) Human-Machine Interface (HMI) by User Identifier (UID) not in approved operator UIDs'}
x_mitre_platforms[0]	None	Linux

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'Process', 'channel': 'None'}

[AN1884] Analytic 1884

Current version: 1.0

	Old Description			New Description
t	1	Monitor device alarms for program downloads, although not al	t	1	Real-time monitoring identifies an Industrial Control System
	>	l devices produce such alarms. Monitor for protocol function		>	(ICS) protocol session consistent with a program download t
	>	s related to program download or modification. Program downl		>	o a field device from a source not in the approved engineeri
	>	oads may be observable in ICS automation protocols and remot		>	ng workstation list, correlated with a device mode-change al
	>	e management protocols. Consult asset management systems to		>	arm transitioning to PROGRAM/STOP immediately preceding the
	>	understand expected program versions. Monitor devices config		>	transfer. Documented in Stuxnet (code/data block download to
	>	uration logs which may contain alerts that indicate whether		>	alter programmable logic controller behavior) and Triton (T
	>	a program download has occurred. Devices may maintain applic		>	riStation protocol program download to the Triconex Safety I
	>	ation logs that indicate whether a full program download, on		>	nstrumented System). OT operational-fidelity gate: Alert onl
	>	line edit, or program append function has occurred.		>	y when the action is not attributable to an authorized opera
				>	tor/engineering source for the specific target and function,
				>	and it is either outside an approved change/maintenance win
				>	dow or lacks matching change-control context; where telemetr
				>	y permits, require corroborating device, configuration, or p
				>	rocess-state effect. Suppress activity that fully matches ap
				>	proved maintenance, commissioning, failover, recovery, or te
				>	sted control procedures.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ChangeControlWindow', 'description': 'Scheduled maintenance periods during which program downloads are authorized.'}, {'field': 'EngineeringWorkstationList', 'description': 'IP allowlist of workstations authorized to perform program downloads.'}, {'field': 'ModeChangeToDownloadWindow', 'description': 'Time window within which a mode-change event and subsequent download session are considered the same engineering action.'}, {'field': 'ProgramDownloadSizeThreshold', 'description': 'Minimum byte count distinguishing a full program download from routine traffic.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:44:05.622000+00:00
description	Monitor device alarms for program downloads, although not all devices produce such alarms. Monitor for protocol functions related to program download or modification. Program downloads may be observable in ICS automation protocols and remote management protocols. Consult asset management systems to understand expected program versions. Monitor devices configuration logs which may contain alerts that indicate whether a program download has occurred. Devices may maintain application logs that indicate whether a full program download, online edit, or program append function has occurred.	Real-time monitoring identifies an Industrial Control System (ICS) protocol session consistent with a program download to a field device from a source not in the approved engineering workstation list, correlated with a device mode-change alarm transitioning to PROGRAM/STOP immediately preceding the transfer. Documented in Stuxnet (code/data block download to alter programmable logic controller behavior) and Triton (TriStation protocol program download to the Triconex Safety Instrumented System). OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b05a614b-033c-4578-b4f2-c63a9feee706', 'name': 'Asset', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'NSM:Content', 'channel': 'S7comm Download Block / Common Industrial Protocol (CIP) Download Program / Distributed Network Protocol (DNP3) program file transfer to device_ip from source not in engineering workstation list within mode change to download window of mode-change event'}
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9d56be63-3501-4dd3-bb5f-63c580833298', 'name': 'Operational Databases', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b05a614b-033c-4578-b4f2-c63a9feee706', 'name': 'assetinventory:ProgramHash', 'channel': 'post-transfer program hash does not match last authorized program baseline'}
x_mitre_log_source_references[3]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'Application Log', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'engineeringworkstation:ApplicationLog', 'channel': 'program download session logged without corresponding change ticket reference'}
x_mitre_platforms[0]	None	Embedded
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'Network Traffic', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9d56be63-3501-4dd3-bb5f-63c580833298', 'name': 'operationaldb:AlarmEvent', 'channel': 'device_ip transitions to PROGRAM/STOP mode without operator_ack and without corresponding open change ticket reference'}

[AN1885] Analytic 1885

Current version: 1.0

	Old Description			New Description
t	1	Devices that provide user access to the underlying operating	t	1	Real-time monitoring identifies a process on an Industrial C
	>	system may allow the installation of custom software to mon		>	ontrol System (ICS) Windows host making direct native Operat
	>	itor OS API execution. Monitoring API calls may generate a s		>	ing System (OS) Application Programming Interface (API) call
	>	ignificant amount of data and may not be useful for defense		>	s that bypass the normal ICS vendor Software Development Kit
	>	unless collected under specific circumstances, since benign		>	(SDK) abstraction layer -- direct CreateFile calls against
	>	use of API functions are common and may be difficult to dist		>	raw device paths, DeviceIoControl calls to ICS hardware driv
	>	inguish from malicious behavior. Correlation of other events		>	er handles -- from a process not a recognized vendor applica
	>	with behavior surrounding API function calls using API moni		>	tion. OT operational-fidelity gate: Alert only when executio
	>	toring will provide additional context to an event that may		>	n violates an approved signer/hash/path/parent/process or to
	>	assist in determining if it is due to malicious behavior.		>	ol allowlist, or originates from an unauthorized user/tool,
				>	and is tied to an OT asset or follow-on OT-relevant action.
				>	Suppress vendor-signed software, approved engineering utilit
				>	ies, diagnostics, patching, backup, and documented maintenan
				>	ce.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'AuthorizedICSApplications', 'description': 'Allowlist of processes expected to interact with ICS hardware/protocols.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:45:24.271000+00:00
description	Devices that provide user access to the underlying operating system may allow the installation of custom software to monitor OS API execution. Monitoring API calls may generate a significant amount of data and may not be useful for defense unless collected under specific circumstances, since benign use of API functions are common and may be difficult to distinguish from malicious behavior. Correlation of other events with behavior surrounding API function calls using API monitoring will provide additional context to an event that may assist in determining if it is due to malicious behavior.	Real-time monitoring identifies a process on an Industrial Control System (ICS) Windows host making direct native Operating System (OS) Application Programming Interface (API) calls that bypass the normal ICS vendor Software Development Kit (SDK) abstraction layer -- direct CreateFile calls against raw device paths, DeviceIoControl calls to ICS hardware driver handles -- from a process not a recognized vendor application. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.
x_mitre_log_source_references[0]['name']	Process	edr:Syscall
x_mitre_log_source_references[0]['channel']	None	DeviceIoControl or raw socket creation to Industrial Control Systems (ICS) protocol port from process not in authorized ICS applications, bypassing documented vendor Software Development Kit (SDK) call pattern
x_mitre_platforms[0]	None	Windows

[AN1886] Analytic 1886

Current version: 1.0

	Old Description			New Description
t	1	Monitor for newly constructed logon behavior within Microsof	t	1	Real-time monitoring identifies access to Industrial Control
	>	t's SharePoint can be configured to report access to certain		>	System (ICS) documentation repositories by an account or se
	>	pages and documents.(Citation: Microsoft SharePoint Logging		>	ssion context not associated with documented engineering rol
	>	) Sharepoint audit logging can also be configured to report		>	es, immediately followed by bulk file access or archive crea
	>	when a user shares a resource.(Citation: Sharepoint Sharing		>	tion. OT operational-fidelity gate: Do not alert on novelty,
	>	Events) The user access logging within Atlassian's Confluenc		>	scan/read volume, or enumeration alone. Alert when the sour
	>	e can also be configured to report access to certain pages a		>	ce role is not authorized for discovery/polling and the targ
	>	nd documents through AccessLogFilter.(Citation: Atlassian Co		>	et scope, address/tag range, protocol, or rate deviates from
	>	nfluence Logging) Additional log storage and analysis infras		>	the established operational baseline. Suppress normal SCADA
	>	tructure will likely be required for more robust detection c		>	/HMI/historian polling, commissioning, asset inventory, back
	>	apabilities. In the case of detecting collection from share		>	up, diagnostics, and approved engineering activity.
	>	d network drives monitor for unexpected and abnormal accesse
	>	s to network shares. Monitor for third-party application lo
	>	gging, messaging, and/or other artifacts that may leverage i
	>	nformation repositories to mine valuable information. Inform
	>	ation repositories generally have a considerably large user
	>	base, detection of malicious use can be non-trivial. At mini
	>	mum, access to information repositories performed by privile
	>	ged users (for example, Active Directory Domain, Enterprise,
	>	or Schema Administrators) should be closely monitored and a
	>	lerted upon, as these types of accounts should generally not
	>	be used to access information repositories. If the capabili
	>	ty exists, it may be of value to monitor and alert on users
	>	that are retrieving and viewing a large number of documents
	>	and pages; this behavior may be indicative of programmatic m
	>	eans being used to retrieve all data within the repository.
	>	In environments with high-maturity, it may be possible to le
	>	verage User-Behavioral Analytics (UBA) platforms to detect a
	>	nd alert on user-based anomalies.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ApprovedHistorianClients', 'description': 'Allowlist of applications/accounts authorized to perform bulk historian queries.'}, {'field': 'AuthorizedEngineerAccounts', 'description': 'Allowlist of accounts with documented engineering roles authorized to access ICS documentation repositories.'}, {'field': 'BulkDocumentAccessThreshold', 'description': 'File count threshold distinguishing bulk reconnaissance from routine reference lookups.'}, {'field': 'BulkQueryThreshold', 'description': 'Row count threshold for historian queries considered bulk export.'}, {'field': 'InformationRepositoryTimeWindow', 'description': 'Time window within which sequential file accesses are considered part of a single bulk collection event.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:45:26.194000+00:00
description	Monitor for newly constructed logon behavior within Microsoft's SharePoint can be configured to report access to certain pages and documents.(Citation: Microsoft SharePoint Logging) Sharepoint audit logging can also be configured to report when a user shares a resource.(Citation: Sharepoint Sharing Events) The user access logging within Atlassian's Confluence can also be configured to report access to certain pages and documents through AccessLogFilter.(Citation: Atlassian Confluence Logging) Additional log storage and analysis infrastructure will likely be required for more robust detection capabilities. In the case of detecting collection from shared network drives monitor for unexpected and abnormal accesses to network shares. Monitor for third-party application logging, messaging, and/or other artifacts that may leverage information repositories to mine valuable information. Information repositories generally have a considerably large user base, detection of malicious use can be non-trivial. At minimum, access to information repositories performed by privileged users (for example, Active Directory Domain, Enterprise, or Schema Administrators) should be closely monitored and alerted upon, as these types of accounts should generally not be used to access information repositories. If the capability exists, it may be of value to monitor and alert on users that are retrieving and viewing a large number of documents and pages; this behavior may be indicative of programmatic means being used to retrieve all data within the repository. In environments with high-maturity, it may be possible to leverage User-Behavioral Analytics (UBA) platforms to detect and alert on user-based anomalies.	Real-time monitoring identifies access to Industrial Control System (ICS) documentation repositories by an account or session context not associated with documented engineering roles, immediately followed by bulk file access or archive creation. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9ce98c86-8d30-4043-ba54-0784d478d0b5', 'name': 'Logon Session', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--f5468e67-51c7-4756-9b4f-65707708e7fa', 'name': 'fileserver:audit', 'channel': 'sequential access to above bulk document access threshold files within information repository time window from single session'}
x_mitre_platforms[0]	None	Windows
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--f5468e67-51c7-4756-9b4f-65707708e7fa', 'name': 'Network Share', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'historian:applog', 'channel': 'historian Structured Query Language (SQL) query returning above bulk query threshold rows from account not in approved historian clients'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'Application Log', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9ce98c86-8d30-4043-ba54-0784d478d0b5', 'name': 'WinEventLog:Security', 'channel': 'Windows Security Event ID 4624/4625: EventCode=4624 by account not in authorized engineer accounts'}

[AN1887] Analytic 1887

Current version: 1.0

	Old Description			New Description
t	1	Monitor ICS management protocols for functions that change a	t	1	Real-time monitoring identifies an Industrial Control System
	>	n asset’s operating mode. Monitor device application logs wh		>	(ICS) protocol mode-change command targeting a field device
	>	ich may contain information related to operating mode change		>	from a source not in the approved engineering workstation l
	>	s, although not all devices produce such logs. Monitor alarm		>	ist, where the transition is not immediately followed by a c
	>	s for information about when an operating mode is changed, a		>	orresponding operator acknowledgment. Documented in Triton (
	>	lthough not all devices produce such logs.		>	the Tricon controller had to be placed in PROGRAM mode befor
				>	e the attack could inject its payload). OT operational-fidel
				>	ity gate: Alert only when the action is not attributable to
				>	an authorized operator/engineering source for the specific t
				>	arget and function, and it is either outside an approved cha
				>	nge/maintenance window or lacks matching change-control cont
				>	ext; where telemetry permits, require corroborating device,
				>	configuration, or process-state effect. Suppress activity th
				>	at fully matches approved maintenance, commissioning, failov
				>	er, recovery, or tested control procedures.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ChangeControlWindow', 'description': 'Scheduled maintenance periods during which mode changes are authorized.'}, {'field': 'EngineeringWorkstationList', 'description': 'IP allowlist of workstations authorized to issue mode-change commands.'}, {'field': 'ModeChangeAckWindow', 'description': 'Time window within which a legitimate operator acknowledgment is expected following a mode-change event.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:46:20.438000+00:00
description	Monitor ICS management protocols for functions that change an asset’s operating mode. Monitor device application logs which may contain information related to operating mode changes, although not all devices produce such logs. Monitor alarms for information about when an operating mode is changed, although not all devices produce such logs.	Real-time monitoring identifies an Industrial Control System (ICS) protocol mode-change command targeting a field device from a source not in the approved engineering workstation list, where the transition is not immediately followed by a corresponding operator acknowledgment. Documented in Triton (the Tricon controller had to be placed in PROGRAM mode before the attack could inject its payload). OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'Network Traffic', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9d56be63-3501-4dd3-bb5f-63c580833298', 'name': 'operationaldb:AlarmEvent', 'channel': 'device mode-change alarm generated without corresponding operator_id entry within mode change ack window'}
x_mitre_platforms[0]	None	Embedded
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'Application Log', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'NSM:Content', 'channel': 'mode-change service from source not in engineering workstation list outside change control window'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9d56be63-3501-4dd3-bb5f-63c580833298', 'name': 'Operational Databases', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'engineeringworkstation:ApplicationLog', 'channel': 'mode-change session logged without corresponding change ticket reference'}

[AN1888] Analytic 1888

Current version: 1.0

	Old Description			New Description
t	1	Monitor network traffic for default credential use in protoc	t	1	Real-time monitoring identifies successful authentication to
	>	ols that allow unencrypted authentication. Monitor logon ses		>	an Industrial Control System (ICS) application such as a Hu
	>	sions for default credential use.		>	man-Machine Interface (HMI), historian, Supervisory Control
				>	and Data Acquisition (SCADA) server using credentials matchi
				>	ng known default vendor passwords, from a logon source not a
				>	ssociated with any authorized user. OT operational-fidelity
				>	gate: Alert only when the account/device/session violates th
				>	e approved identity + source host/jump path/zone policy and
				>	is corroborated by access to a protected OT asset, execution
				>	, configuration change, or another security-relevant follow-
				>	on event. Suppress approved shift activity, vendor support,
				>	break-glass use, commissioning, and documented remote-access
				>	windows.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'DefaultVendorCredentialList', 'description': 'Documented default username/password combinations for all device models in the environment.'}, {'field': 'EngineeringWorkstationList', 'description': 'IP allowlist of legitimate authentication sources.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:47:27.472000+00:00
description	Monitor network traffic for default credential use in protocols that allow unencrypted authentication. Monitor logon sessions for default credential use.	Real-time monitoring identifies successful authentication to an Industrial Control System (ICS) application such as a Human-Machine Interface (HMI), historian, Supervisory Control and Data Acquisition (SCADA) server using credentials matching known default vendor passwords, from a logon source not associated with any authorized user. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'Network Traffic', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9ce98c86-8d30-4043-ba54-0784d478d0b5', 'name': 'WinEventLog:Security', 'channel': 'Windows Security Event ID 4624/4625: EventCode=4624 for account matching default vendor credential list from source not in approved host list'}
x_mitre_platforms[0]	None	Windows

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--9ce98c86-8d30-4043-ba54-0784d478d0b5', 'name': 'Logon Session', 'channel': 'None'}

[AN1890] Analytic 1890

Current version: 1.0

	Old Description			New Description
t	1	Monitor for changes made to a large quantity of files for un	t	1	Real-time monitoring identifies a process performing rapid,
	>	expected modifications in both user directories and director		>	bulk deletion or overwrite of files across multiple Industri
	>	ies used to store programs and OS components (e.g., C:\Windo		>	al Control System (ICS)-relevant directories within a short
	>	ws\System32). Monitor for newly executed processes of binar		>	time window, by a process not associated with documented dat
	>	ies that could be involved in data destruction activity, suc		>	a retention management, correlated with a system crash short
	>	h as SDelete. Monitor for unexpected deletion of files. Moni		>	ly after. Documented in CaddyWiper, deployed via GPO alongsi
	>	tor executed commands and arguments for binaries that could		>	de Industroyer2. OT operational-fidelity gate: Alert only wh
	>	be involved in data destruction activity, such as SDelete.		>	en the action is not attributable to an authorized operator/
				>	engineering source for the specific target and function, and
				>	it is either outside an approved change/maintenance window
				>	or lacks matching change-control context; where telemetry pe
				>	rmits, require corroborating device, configuration, or proce
				>	ss-state effect. Suppress activity that fully matches approv
				>	ed maintenance, commissioning, failover, recovery, or tested
				>	control procedures.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'AuthorizedDataManagementTools', 'description': 'Allowlist of backup/archival/retention management tools authorized to perform bulk file operations.'}, {'field': 'BulkDeletionThreshold', 'description': 'File count threshold across monitored directories that distinguishes bulk destruction from routine cleanup.'}, {'field': 'DataDestructionTimeWindow', 'description': 'Time window over which bulk deletion activity is measured.'}, {'field': 'EngineeringWorkstationList', 'description': 'IP allowlist of workstations authorized to issue memory erase commands.'}, {'field': 'WiperCrashWindow', 'description': 'Time window after bulk deletion within which a system crash is considered part of the same destructive event.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:45:27.721000+00:00
description	Monitor for changes made to a large quantity of files for unexpected modifications in both user directories and directories used to store programs and OS components (e.g., C:\Windows\System32). Monitor for newly executed processes of binaries that could be involved in data destruction activity, such as SDelete. Monitor for unexpected deletion of files. Monitor executed commands and arguments for binaries that could be involved in data destruction activity, such as SDelete.	Real-time monitoring identifies a process performing rapid, bulk deletion or overwrite of files across multiple Industrial Control System (ICS)-relevant directories within a short time window, by a process not associated with documented data retention management, correlated with a system crash shortly after. Documented in CaddyWiper, deployed via GPO alongside Industroyer2. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--84572de3-9583-4c73-aabd-06ea88123dd8', 'name': 'File', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--685f917a-e95e-4ba0-ade1-c7d354dae6e0', 'name': 'gpo:deployment', 'channel': 'destructive payload deployed via Group Policy Object (GPO) to multiple hosts simultaneously'}
x_mitre_platforms[0]	None	Windows
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'Process', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--e905dad2-00d6-477c-97e8-800427abd0e8', 'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=23 across multiple Industrial Control Systems (ICS) data directories exceeding bulk deletion threshold within data destruction time window, by process not in authorized data management tools'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--e905dad2-00d6-477c-97e8-800427abd0e8', 'name': 'File', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'WinEventLog:System', 'channel': 'System crash or unexpected halt occurring within wiper crash window of the bulk deletion event'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--685f917a-e95e-4ba0-ade1-c7d354dae6e0', 'name': 'Command', 'channel': 'None'}

[AN1891] Analytic 1891

Current version: 1.0

	Old Description			New Description
t	1	Monitor and analyze traffic patterns and packet inspection a	t	1	Real-time monitoring identifies a Linux process with both a
	>	ssociated to protocol(s) that do not follow the expected pro		>	listening socket on an Industrial Control System (ICS) proto
	>	tocol standards and traffic flows (e.g., extraneous packets		>	col port and an outbound connection to a non-ICS destination
	>	that do not belong to established flows, gratuitous or anoma		>	, or iptables DNAT/REDIRECT rules added on ICS protocol port
	>	lous traffic patterns, anomalous syntax, or structure). Cons		>	s. OT operational-fidelity gate: Alert only when the asset's
	>	ider correlation with process monitoring and command line to		>	documented role does not permit the connection and the dest
	>	detect anomalous processes execution and command line argum		>	ination/proxy/service is outside the approved communications
	>	ents associated to traffic patterns (e.g., monitor anomalies		>	profile, with process/service identity used as corroboratio
	>	in use of files that do not normally initiate connections f		>	n where available. Suppress approved vendor support, update
	>	or respective protocol(s)). Monitor for known proxy protocol		>	repositories, remote operations, failover paths, and documen
	>	s (e.g., SOCKS, Tor, peer-to-peer protocols) and tool usage		>	ted temporary connectivity.
	>	(e.g., Squid, peer-to-peer software) on the network that ar
	>	e not part of normal operations. Also monitor network data f
	>	or uncommon data flows. Processes utilizing the network that
	>	do not normally have network communication or have never be
	>	en seen before are suspicious.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'RelayCorrelationWindow', 'description': 'Time window and byte-count proportionality tolerance used to determine whether concurrent flows represent a relay pattern.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:44:13.553000+00:00
description	Monitor and analyze traffic patterns and packet inspection associated to protocol(s) that do not follow the expected protocol standards and traffic flows (e.g., extraneous packets that do not belong to established flows, gratuitous or anomalous traffic patterns, anomalous syntax, or structure). Consider correlation with process monitoring and command line to detect anomalous processes execution and command line arguments associated to traffic patterns (e.g., monitor anomalies in use of files that do not normally initiate connections for respective protocol(s)). Monitor for known proxy protocols (e.g., SOCKS, Tor, peer-to-peer protocols) and tool usage (e.g., Squid, peer-to-peer software) on the network that are not part of normal operations. Also monitor network data for uncommon data flows. Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious.	Real-time monitoring identifies a Linux process with both a listening socket on an Industrial Control System (ICS) protocol port and an outbound connection to a non-ICS destination, or iptables DNAT/REDIRECT rules added on ICS protocol ports. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'Network Traffic', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; command line invokes iptables/nftables to change ICS traffic filtering or redirection outside the authorized network-administration baseline'}
x_mitre_platforms[0]	None	Linux
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'Network Traffic', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba', 'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): bind/listen/connect syscalls show one process accepting ICS-protocol connections while also initiating an outbound connection to a non-ICS destination'}

[AN1893] Analytic 1893

Current version: 1.0

	Old Description			New Description
t	1	Program uploads may be observable in ICS management protocol	t	1	Real-time monitoring identifies an Industrial Control System
	>	s or file transfer protocols. Note when protocol functions r		>	(ICS) protocol session reading back the user program from a
	>	elated to program uploads occur. In cases where the ICS prot		>	field device to a source not in the approved engineering wo
	>	ocols is not well understood, one option is to examine netwo		>	rkstation list, where the session byte count is consistent w
	>	rk traffic for the program files themselves using signature-		>	ith a substantial portion of the device's program memory. OT
	>	based tools. Monitor device communication patterns to identi		>	operational-fidelity gate: Do not alert on novelty, scan/re
	>	fy irregular bulk transfers of data between the embedded ICS		>	ad volume, or enumeration alone. Alert when the source role
	>	asset and other nodes within the network. Note these indica		>	is not authorized for discovery/polling and the target scope
	>	tors are dependent on the profile of normal operations and t		>	, address/tag range, protocol, or rate deviates from the est
	>	he capabilities of the industrial automation protocols invol		>	ablished operational baseline. Suppress normal SCADA/HMI/his
	>	ved (e.g., partial program uploads). Monitor for device alar		>	torian polling, commissioning, asset inventory, backup, diag
	>	ms produced when program uploads occur, although not all dev		>	nostics, and approved engineering activity.
	>	ices will produce such alarms.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'BackupWindowSchedule', 'description': 'Scheduled periods during which routine backup uploads are expected.'}, {'field': 'EngineeringWorkstationList', 'description': 'IP allowlist of workstations authorized to perform program uploads from field devices.'}, {'field': 'ProgramUploadSizeThreshold', 'description': 'Minimum byte count for a session to be considered a substantial program readback.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:47:05.430000+00:00
description	Program uploads may be observable in ICS management protocols or file transfer protocols. Note when protocol functions related to program uploads occur. In cases where the ICS protocols is not well understood, one option is to examine network traffic for the program files themselves using signature-based tools. Monitor device communication patterns to identify irregular bulk transfers of data between the embedded ICS asset and other nodes within the network. Note these indicators are dependent on the profile of normal operations and the capabilities of the industrial automation protocols involved (e.g., partial program uploads). Monitor for device alarms produced when program uploads occur, although not all devices will produce such alarms.	Real-time monitoring identifies an Industrial Control System (ICS) protocol session reading back the user program from a field device to a source not in the approved engineering workstation list, where the session byte count is consistent with a substantial portion of the device's program memory. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'Network Traffic', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'NSM:Content', 'channel': 'S7comm Upload Block / Common Industrial Protocol (CIP) Read Program session from source not in engineering workstation list with bytes_recv exceeding program upload size threshold'}
x_mitre_platforms[0]	None	Embedded
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'Network Traffic', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'engineeringworkstation:ApplicationLog', 'channel': 'Engineering application audit/session log: controller program upload initiated outside approved backup/change window and without documented backup purpose'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'Application Log', 'channel': 'None'}

[AN1896] Analytic 1896

Current version: 1.0

	Old Description			New Description
t	1	Monitor HKLM\Software\Policies\Microsoft\Windows NT\DNSClien	t	1	Real-time monitoring identifies an Industrial Control System
	>	t for changes to the "EnableMulticast" DWORD value. A value		>	(ICS) Windows host simultaneously holding connections to bo
	>	of "0" indicates LLMNR is disabled. Host-based implementatio		>	th the field device subnet and an unexpected external or int
	>	ns of this technique may utilize networking-based system cal		>	er-zone destination, combined with proxy-capable process spa
	>	ls or network utility commands (e.g., iptables) to locally i		>	wning and ICS vendor application logs showing endpoint or ce
	>	ntercept traffic. Monitor for relevant process creation even		>	rtificate changes. OT operational-fidelity gate: Alert only
	>	ts. Monitor for network traffic originating from unknown/une		>	when the asset's documented role does not permit the connect
	>	xpected hosts. Local network traffic metadata (such as sourc		>	ion and the destination/proxy/service is outside the approve
	>	e MAC addressing) as well as usage of network management pro		>	d communications profile, with process/service identity used
	>	tocols such as DHCP may be helpful in identifying hardware.		>	as corroboration where available. Suppress approved vendor
	>	For added context on adversary procedures and background see		>	support, update repositories, remote operations, failover pa
	>	[Adversary-in-the-Middle](https://attack.mitre.org/techniqu		>	ths, and documented temporary connectivity.
	>	es/T1557) and applicable sub-techniques. Monitor for newly c
	>	onstructed services/daemons through Windows event logs for e
	>	vent IDs 4697 and 7045. Monitor network traffic for anomalie
	>	s associated with known AiTM behavior. For Collection activi
	>	ty where transmitted data is not manipulated, anomalies may
	>	be present in network management protocols (e.g., ARP, DHCP)
	>	. Monitor application logs for changes to settings and other
	>	events associated with network protocols and other services
	>	commonly abused for AiTM.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'AiTMCorrelationWindow', 'description': 'Time window within which a MAC binding change and protocol baseline deviation are considered correlated.'}, {'field': 'ExpectedNextHopBaseline', 'description': 'Documented expected network path for device subnet traffic.'}, {'field': 'TopologyChangeTicket', 'description': 'Change-management reference confirming an authorized hardware replacement or topology modification.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:47:18.240000+00:00
description	Monitor HKLM\Software\Policies\Microsoft\Windows NT\DNSClient for changes to the "EnableMulticast" DWORD value. A value of "0" indicates LLMNR is disabled. Host-based implementations of this technique may utilize networking-based system calls or network utility commands (e.g., iptables) to locally intercept traffic. Monitor for relevant process creation events. Monitor for network traffic originating from unknown/unexpected hosts. Local network traffic metadata (such as source MAC addressing) as well as usage of network management protocols such as DHCP may be helpful in identifying hardware. For added context on adversary procedures and background see [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557) and applicable sub-techniques. Monitor for newly constructed services/daemons through Windows event logs for event IDs 4697 and 7045. Monitor network traffic for anomalies associated with known AiTM behavior. For Collection activity where transmitted data is not manipulated, anomalies may be present in network management protocols (e.g., ARP, DHCP). Monitor application logs for changes to settings and other events associated with network protocols and other services commonly abused for AiTM.	Real-time monitoring identifies an Industrial Control System (ICS) Windows host simultaneously holding connections to both the field device subnet and an unexpected external or inter-zone destination, combined with proxy-capable process spawning and ICS vendor application logs showing endpoint or certificate changes. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--da85d358-741a-410d-9433-20d6269a6170', 'name': 'Windows Registry', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'vendorapp:ApplicationLog', 'channel': 'Industrial Control Systems (ICS) vendor application log shows endpoint or certificate change without documented maintenance reference'}
x_mitre_platforms[0]	None	Windows
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'Process', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba', 'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=3 process holds connections to both device subnet and external/inter-zone destination simultaneously, combined with proxy-capable process spawn'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'Network Traffic', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--5297a638-1382-4f0c-8472-0d21830bf705', 'name': 'Service', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'Network Traffic', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'Application Log', 'channel': 'None'}

[AN1897] Analytic 1897

Current version: 1.0

	Old Description			New Description
t	1	Monitor for changes made to files that may stop or disable s	t	1	Real-time monitoring identifies a service control command ta
	>	ervices on a system to render those services unavailable to		>	rgeting a critical Industrial Control System (ICS) services
	>	legitimate users. Monitor executed commands and arguments th		>	such as Open Platform Communications (OPC) server, historian
	>	at may stop or disable services on a system to render those		>	, Supervisory Control and Data Acquisition (SCADA) polling f
	>	services unavailable to legitimate users. Remote access tool		>	rom an account not in the authorized service administration
	>	s with built-in features may interact directly with the Wind		>	role, without a preceding change-control ticket, immediately
	>	ows API to perform these functions outside of typical system		>	followed by the service transitioning to Stopped state. OT
	>	utilities. For example, ChangeServiceConfigW may be used by		>	operational-fidelity gate: Alert only when the action is not
	>	an adversary to prevent services from starting. For added c		>	attributable to an authorized operator/engineering source f
	>	ontext on adversary procedures and background see [Service S		>	or the specific target and function, and it is either outsid
	>	top](https://attack.mitre.org/techniques/T1489). Monitor pro		>	e an approved change/maintenance window or lacks matching ch
	>	cesses and command-line arguments to see if critical process		>	ange-control context; where telemetry permits, require corro
	>	es are terminated or stop running. For added context on adve		>	borating device, configuration, or process-state effect. Sup
	>	rsary procedures and background see [Service Stop](https://a		>	press activity that fully matches approved maintenance, comm
	>	ttack.mitre.org/techniques/T1489). Alterations to the servic		>	issioning, failover, recovery, or tested control procedures.
	>	e binary path or the service startup type changed to disable
	>	d may be suspicious. Monitor for changes made to Windows reg
	>	istry keys and/or values that may stop or disable services o
	>	n a system to render those services unavailable to legitimat
	>	e users. Monitor for newly executed processes that may stop
	>	or disable services on a system to render those services una
	>	vailable to legitimate users.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'AuthorizedServiceAdmins', 'description': 'Accounts authorized to stop/start critical ICS services.'}, {'field': 'BulkRestartTimeWindow', 'description': 'Time window within which multiple device restarts are considered a coordinated event.'}, {'field': 'CriticalICSServiceList', 'description': 'List of Windows services whose stoppage constitutes a high-impact event.'}, {'field': 'EngineeringWorkstationList', 'description': 'IP allowlist of workstations authorized to issue device restart commands.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:47:46.090000+00:00
description	Monitor for changes made to files that may stop or disable services on a system to render those services unavailable to legitimate users. Monitor executed commands and arguments that may stop or disable services on a system to render those services unavailable to legitimate users. Remote access tools with built-in features may interact directly with the Windows API to perform these functions outside of typical system utilities. For example, ChangeServiceConfigW may be used by an adversary to prevent services from starting. For added context on adversary procedures and background see [Service Stop](https://attack.mitre.org/techniques/T1489). Monitor processes and command-line arguments to see if critical processes are terminated or stop running. For added context on adversary procedures and background see [Service Stop](https://attack.mitre.org/techniques/T1489). Alterations to the service binary path or the service startup type changed to disabled may be suspicious. Monitor for changes made to Windows registry keys and/or values that may stop or disable services on a system to render those services unavailable to legitimate users. Monitor for newly executed processes that may stop or disable services on a system to render those services unavailable to legitimate users.	Real-time monitoring identifies a service control command targeting a critical Industrial Control System (ICS) services such as Open Platform Communications (OPC) server, historian, Supervisory Control and Data Acquisition (SCADA) polling from an account not in the authorized service administration role, without a preceding change-control ticket, immediately followed by the service transitioning to Stopped state. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--84572de3-9583-4c73-aabd-06ea88123dd8', 'name': 'File', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 sc.exe/net.exe invocation targeting a critical ICS service from an account outside the authorized service-administration set'}
x_mitre_platforms[0]	None	Windows
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--685f917a-e95e-4ba0-ade1-c7d354dae6e0', 'name': 'Command', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--74fa567d-bc90-425c-8a41-3c703abb221c', 'name': 'WinEventLog:System', 'channel': 'EventCode=7036 critical Industrial Control Systems (ICS) service transitions to Stopped without preceding change ticket reference'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'Process', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--61f1d40e-f3d0-4cc6-aa2d-937b6204194f', 'name': 'Process', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--74fa567d-bc90-425c-8a41-3c703abb221c', 'name': 'Service', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--da85d358-741a-410d-9433-20d6269a6170', 'name': 'Windows Registry', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'Process', 'channel': 'None'}

[AN1898] Analytic 1898

Current version: 1.0

	Old Description			New Description
t	1	Monitor for unexpected changes to project files, although if	t	1	Configured Windows object-access monitoring identifies a wri
	>	the malicious modification occurs in tandem with legitimate		>	te to an Industrial Control System (ICS) engineering project
	>	changes it will be difficult to isolate the unintended chan		>	file by a process that is not the recognized vendor enginee
	>	ges by analyzing only file systems modifications.		>	ring software, or by the vendor engineering software immedia
				>	tely after loading a project file from an untrusted source.
				>	Documented mechanism in Havex (trojanized vendor software/in
				>	stallers distributed via compromised vendor websites). OT op
				>	erational-fidelity gate: Alert only when execution violates
				>	an approved signer/hash/path/parent/process or tool allowlis
				>	t, or originates from an unauthorized user/tool, and is tied
				>	to an OT asset or follow-on OT-relevant action. Suppress ve
				>	ndor-signed software, approved engineering utilities, diagno
				>	stics, patching, backup, and documented maintenance. Collect
				>	ion requirement: use Windows Security Event ID 4663 with Obj
				>	ect Access auditing and SACLs on approved project repositori
				>	es; Sysmon FileCreate events can corroborate writes/overwrit
				>	es but do not report generic file-open/read activity.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ApprovedProjectRepository', 'description': 'Documented, trusted source location(s) for project files.'}, {'field': 'AuthorizedEngineeringTools', 'description': 'Allowlist of vendor engineering software processes authorized to modify project files.'}, {'field': 'ProjectFileExtensions', 'description': 'File extensions used by ICS engineering project files for in-use vendor platforms.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:47:46.920000+00:00
description	Monitor for unexpected changes to project files, although if the malicious modification occurs in tandem with legitimate changes it will be difficult to isolate the unintended changes by analyzing only file systems modifications.	Configured Windows object-access monitoring identifies a write to an Industrial Control System (ICS) engineering project file by a process that is not the recognized vendor engineering software, or by the vendor engineering software immediately after loading a project file from an untrusted source. Documented mechanism in Havex (trojanized vendor software/installers distributed via compromised vendor websites). OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance. Collection requirement: use Windows Security Event ID 4663 with Object Access auditing and SACLs on approved project repositories; Sysmon FileCreate events can corroborate writes/overwrites but do not report generic file-open/read activity.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--84572de3-9583-4c73-aabd-06ea88123dd8', 'name': 'File', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--235b7491-2d2b-4617-9a52-3c0783680f71', 'name': 'WinEventLog:Security', 'channel': 'Windows Security Event ID 4663 (requires Object Access auditing/SACL): engineering process reads/opens project file from unapproved repository/removable-media/network-share path'}
x_mitre_platforms[0]	None	Windows

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--639e87f3-acb6-448a-9645-258f20da4bc5', 'name': 'WinEventLog:Sysmon', 'channel': 'Microsoft-Windows-Sysmon/Operational Event ID 11 FileCreate/overwrite or Event ID 2 FileCreateTime, as applicable: Engineering tool process opens project file from path not in approved project repository (removable media, email attachment cache, untrusted network share)'}

[AN1899] Analytic 1899

Current version: 1.0

	Old Description			New Description
t	1	Detecting software exploitation may be difficult depending o	t	1	Real-time monitoring identifies a network-accessible service
	>	n the tools available. Software exploits may not always succ		>	process (lsass.exe, a vendor remote management service) spa
	>	eed or may cause the exploited process to become unstable or		>	wning an unexpected child process or exhibiting cross-proces
	>	crash, which may be recorded in the application log. Use de		>	s memory access patterns immediately following inbound conne
	>	ep packet inspection to look for artifacts of common exploit		>	ction from an unusual source. OT operational-fidelity gate:
	>	traffic, such as known payloads.		>	Alert only when execution violates an approved signer/hash/p
				>	ath/parent/process or tool allowlist, or originates from an
				>	unauthorized user/tool, and is tied to an OT asset or follow
				>	-on OT-relevant action. Suppress vendor-signed software, app
				>	roved engineering utilities, diagnostics, patching, backup,
				>	and documented maintenance.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ApprovedClientCIDR', 'description': 'IP ranges from which legitimate connections to network-facing ICS services are expected.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:47:47.678000+00:00
description	Detecting software exploitation may be difficult depending on the tools available. Software exploits may not always succeed or may cause the exploited process to become unstable or crash, which may be recorded in the application log. Use deep packet inspection to look for artifacts of common exploit traffic, such as known payloads.	Real-time monitoring identifies a network-accessible service process (lsass.exe, a vendor remote management service) spawning an unexpected child process or exhibiting cross-process memory access patterns immediately following inbound connection from an unusual source. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'Application Log', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--1887a270-576a-4049-84de-ef746b2572d6', 'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=10 where SourceImage outside the approved ICS vendor/process baseline accesses TargetImage associated with an ICS application or service'}
x_mitre_platforms[0]	None	Windows

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'Network Traffic', 'channel': 'None'}

[AN1900] Analytic 1900

Current version: 1.0

	Old Description			New Description
t	1	Monitor ICS automation network protocols for functions relat	t	1	Real-time monitoring identifies Industrial Control System (I
	>	ed to reading an asset’s operating mode. In some cases, ther		>	CS) protocol requests specifically targeting mode/status reg
	>	e may be multiple ways to detect a device’s operating mode,		>	isters from a source not in the approved control server or e
	>	one of which is typically used in the operational environmen		>	ngineering workstation list, where the request pattern is na
	>	t. Monitor for the operating mode being checked in unexpecte		>	rrowly focused on mode/state data rather than broader proces
	>	d ways.		>	s value polling. Directly documented in the Triton attack ch
				>	ain's 'Get Control Program Status' request. OT operational-f
				>	idelity gate: Do not alert on novelty, scan/read volume, or
				>	enumeration alone. Alert when the source role is not authori
				>	zed for discovery/polling and the target scope, address/tag
				>	range, protocol, or rate deviates from the established opera
				>	tional baseline. Suppress normal SCADA/HMI/historian polling
				>	, commissioning, asset inventory, backup, diagnostics, and a
				>	pproved engineering activity.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ApprovedSCADAServers', 'description': 'IP allowlist of legitimate engineering and SCADA systems authorized to query device operating mode.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:47:06.181000+00:00
description	Monitor ICS automation network protocols for functions related to reading an asset’s operating mode. In some cases, there may be multiple ways to detect a device’s operating mode, one of which is typically used in the operational environment. Monitor for the operating mode being checked in unexpected ways.	Real-time monitoring identifies Industrial Control System (ICS) protocol requests specifically targeting mode/status registers from a source not in the approved control server or engineering workstation list, where the request pattern is narrowly focused on mode/state data rather than broader process value polling. Directly documented in the Triton attack chain's 'Get Control Program Status' request. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
x_mitre_log_source_references[0]['name']	Network Traffic	NSM:Content
x_mitre_log_source_references[0]['channel']	None	S7comm SZL Central Processing Unit (CPU)-state read or Common Industrial Protocol (CIP) Identity Object state attribute read from source not in approved Supervisory Control and Data Acquisition (SCADA) servers
x_mitre_platforms[0]	None	Embedded

[AN1902] Analytic 1902

Current version: 1.0

	Old Description			New Description
t	1	Monitor executed commands and arguments that may look for de	t	1	Real-time monitoring identifies execution of network enumera
	>	tails about the network configuration and settings, such as		>	tion commands (netstat, arp -a, Get-NetTCPConnection) on an
	>	IP and/or MAC addresses, of systems they access or through i		>	Industrial Control System (ICS) host from an account not ass
	>	nformation discovery of remote systems. Also monitor execute		>	ociated with documented network administration, where multip
	>	d commands and arguments that may attempt to get a listing o		>	le such commands execute in sequence within a short window.
	>	f network connections to or from the compromised system they		>	OT operational-fidelity gate: Do not alert on novelty, scan/
	>	are currently accessing or from remote systems by querying		>	read volume, or enumeration alone. Alert when the source rol
	>	for information over the network. Information may also be ac		>	e is not authorized for discovery/polling and the target sco
	>	quired through Windows system management tools such as [Wind		>	pe, address/tag range, protocol, or rate deviates from the e
	>	ows Management Instrumentation](https://attack.mitre.org/tec		>	stablished operational baseline. Suppress normal SCADA/HMI/h
	>	hniques/T1047) and [PowerShell](https://attack.mitre.org/tec		>	istorian polling, commissioning, asset inventory, backup, di
	>	hniques/T1059/001). Monitor for executed processes (such as		>	agnostics, and approved engineering activity.
	>	ipconfig/ifconfig and arp) with arguments that may look for
	>	details about the network configuration and settings, such a
	>	s IP and/or MAC addresses. Also monitor for executed process
	>	es that may attempt to get a listing of network connections
	>	to or from the compromised system they are currently accessi
	>	ng or from remote systems by querying for information over t
	>	he network. Monitor for any suspicious attempts to enable sc
	>	ript execution on a system. If scripts are not commonly used
	>	on a system, but enabled, scripts running out of cycle from
	>	patching or other administrator functions are suspicious. S
	>	cripts should be captured from the file system when possible
	>	to determine their actions and intent. Monitor for API call
	>	s (such as GetAdaptersInfo() and GetIpNetTable()) that may g
	>	ather details about the network configuration and settings,
	>	such as IP and/or MAC addresses. Also monitor for API calls
	>	that may attempt to get a listing of network connections to
	>	or from the compromised system they are currently accessing
	>	or from remote systems by querying for information over the
	>	network. For added context on adversary procedures and backg
	>	round see [System Network Configuration Discovery](https://a
	>	ttack.mitre.org/techniques/T1016) and [System Network Connec
	>	tions Discovery](https://attack.mitre.org/techniques/T1049).

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ApprovedNetworkAdmins', 'description': 'Accounts with documented network administration responsibilities.'}, {'field': 'ApprovedSCADAServers', 'description': 'IP allowlist of legitimate sources for topology queries.'}, {'field': 'EnumerationTimeWindow', 'description': 'Time window within which multiple enumeration commands are considered a systematic mapping sequence.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:47:48.446000+00:00
description	Monitor executed commands and arguments that may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Also monitor executed commands and arguments that may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001). Monitor for executed processes (such as ipconfig/ifconfig and arp) with arguments that may look for details about the network configuration and settings, such as IP and/or MAC addresses. Also monitor for executed processes that may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network. Monitor for any suspicious attempts to enable script execution on a system. If scripts are not commonly used on a system, but enabled, scripts running out of cycle from patching or other administrator functions are suspicious. Scripts should be captured from the file system when possible to determine their actions and intent. Monitor for API calls (such as GetAdaptersInfo() and GetIpNetTable()) that may gather details about the network configuration and settings, such as IP and/or MAC addresses. Also monitor for API calls that may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network. For added context on adversary procedures and background see [System Network Configuration Discovery](https://attack.mitre.org/techniques/T1016) and [System Network Connections Discovery](https://attack.mitre.org/techniques/T1049).	Real-time monitoring identifies execution of network enumeration commands (netstat, arp -a, Get-NetTCPConnection) on an Industrial Control System (ICS) host from an account not associated with documented network administration, where multiple such commands execute in sequence within a short window. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--685f917a-e95e-4ba0-ade1-c7d354dae6e0', 'name': 'Command', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 network enumeration command from account not in approved network admins, with more than one distinct command within enumeration time window'}
x_mitre_platforms[0]	None	Windows

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'Process', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--9f387817-df83-432a-b56b-a8fb7f71eedd', 'name': 'Script', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e', 'name': 'Process', 'channel': 'None'}

[AN1903] Analytic 1903

Current version: 1.0

	Old Description			New Description
t	1	Monitor for device alarms produced when device management pa	t	1	Real-time monitoring identifies Industrial Control System (I
	>	sswords are changed, although not all devices will produce s		>	CS) protocol commands changing device-level credentials or a
	>	uch alarms. Monitor for device credential changes observable		>	ccess codes from a source not in the approved security admin
	>	in automation or management network protocols.		>	istration list, where the device subsequently rejects connec
				>	tions from legitimate control system components. OT operatio
				>	nal-fidelity gate: Alert only when the action is not attribu
				>	table to an authorized operator/engineering source for the s
				>	pecific target and function, and it is either outside an app
				>	roved change/maintenance window or lacks matching change-con
				>	trol context; where telemetry permits, require corroborating
				>	device, configuration, or process-state effect. Suppress ac
				>	tivity that fully matches approved maintenance, commissionin
				>	g, failover, recovery, or tested control procedures.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'AuthorizedCredentialAdmins', 'description': 'Accounts authorized to change credentials for ICS service and operator accounts.'}, {'field': 'CredentialChangeImpactWindow', 'description': 'Time window after a credential change within which a service authentication failure is considered directly connected.'}, {'field': 'CredentialRotationSchedule', 'description': 'Documented schedule for routine credential rotation.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:46:33.230000+00:00
description	Monitor for device alarms produced when device management passwords are changed, although not all devices will produce such alarms. Monitor for device credential changes observable in automation or management network protocols.	Real-time monitoring identifies Industrial Control System (ICS) protocol commands changing device-level credentials or access codes from a source not in the approved security administration list, where the device subsequently rejects connections from legitimate control system components. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9d56be63-3501-4dd3-bb5f-63c580833298', 'name': 'Operational Databases', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'NSM:Content', 'channel': 'credential/access code change command from source not in approved security admin list'}
x_mitre_platforms[0]	None	Embedded

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'Network Traffic', 'channel': 'None'}

[AN1904] Analytic 1904

Current version: 1.0

	Old Description			New Description
t	1	Monitor for newly executed processes related to services spe	t	1	Real-time monitoring identifies an interactive desktop sessi
	>	cifically designed to accept remote graphical connections, s		>	on Remote Desktop Protocol (RDP), Virtual Network Computing
	>	uch as RDP and VNC. [Remote Services](https://attack.mitre.o		>	(VNC), or vendor remote console to an Human-Machine Interfac
	>	rg/techniques/T0886) and [Valid Accounts](https://attack.mit		>	e (HMI) or engineering station from a source Internet Protoc
	>	re.org/techniques/T0859) may be used to access a host’s GUI.		>	ol (IP) addresses outside the approved Network Management Sy
	>	Monitor executed commands and arguments related to services		>	stem (NMS) Classless Inter-Domain Routing (CIDR) subnet, or
	>	specifically designed to accept remote graphical connection		>	from an account not in the approved operator/engineer list,
	>	s, such as RDP and VNC. [Remote Services](https://attack.mit		>	where the session subsequently interacts with Industrial Con
	>	re.org/techniques/T0886) and [Valid Accounts](https://attack		>	trol System (ICS) control elements. OT operational-fidelity
	>	.mitre.org/techniques/T0859) may be used to access a host’s		>	gate: Alert only when the account/device/session violates th
	>	GUI. Monitor DLL file events, specifically creation of these		>	e approved identity + source host/jump path/zone policy and
	>	binary files as well as the loading of DLLs into processes		>	is corroborated by access to a protected OT asset, execution
	>	associated with remote graphical connections, such as RDP an		>	, configuration change, or another security-relevant follow-
	>	d VNC. [Remote Services](https://attack.mitre.org/techniques		>	on event. Suppress approved shift activity, vendor support,
	>	/T0886) may be used to access a host’s GUI. Monitor for user		>	break-glass use, commissioning, and documented remote-access
	>	accounts logged into systems they would not normally access		>	windows.
	>	or abnormal access patterns, such as multiple systems over
	>	a relatively short period of time. Correlate use of login ac
	>	tivity related to remote services with unusual behavior or o
	>	ther malicious or suspicious activity. [Remote Services](htt
	>	ps://attack.mitre.org/techniques/T0886) may be used to acces
	>	s a host’s GUI.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ApprovedManagementCIDR', 'description': 'IP ranges authorized for remote desktop/console access to ICS hosts.'}, {'field': 'ApprovedOperatorList', 'description': 'Accounts with documented operator/engineer roles.'}, {'field': 'ApprovedOperatorWorkstations', 'description': 'Inventory of workstations from which operator/engineer interactive sessions are expected to originate.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:47:29.050000+00:00
description	Monitor for newly executed processes related to services specifically designed to accept remote graphical connections, such as RDP and VNC. [Remote Services](https://attack.mitre.org/techniques/T0886) and [Valid Accounts](https://attack.mitre.org/techniques/T0859) may be used to access a host’s GUI. Monitor executed commands and arguments related to services specifically designed to accept remote graphical connections, such as RDP and VNC. [Remote Services](https://attack.mitre.org/techniques/T0886) and [Valid Accounts](https://attack.mitre.org/techniques/T0859) may be used to access a host’s GUI. Monitor DLL file events, specifically creation of these binary files as well as the loading of DLLs into processes associated with remote graphical connections, such as RDP and VNC. [Remote Services](https://attack.mitre.org/techniques/T0886) may be used to access a host’s GUI. Monitor for user accounts logged into systems they would not normally access or abnormal access patterns, such as multiple systems over a relatively short period of time. Correlate use of login activity related to remote services with unusual behavior or other malicious or suspicious activity. [Remote Services](https://attack.mitre.org/techniques/T0886) may be used to access a host’s GUI.	Real-time monitoring identifies an interactive desktop session Remote Desktop Protocol (RDP), Virtual Network Computing (VNC), or vendor remote console to an Human-Machine Interface (HMI) or engineering station from a source Internet Protocol (IP) addresses outside the approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet, or from an account not in the approved operator/engineer list, where the session subsequently interacts with Industrial Control System (ICS) control elements. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'Process', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9ce98c86-8d30-4043-ba54-0784d478d0b5', 'name': 'WinEventLog:Security', 'channel': 'Windows Security Event ID 4624/4625: EventCode=4624, Type 2/10 to Industrial Control Systems (ICS) host from source not in approved operator workstations or account not in approved operator list'}
x_mitre_platforms[0]	None	Windows
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--685f917a-e95e-4ba0-ade1-c7d354dae6e0', 'name': 'Command', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 process execution associated with a remote session targets ICS application directories or initiates device-subnet activity'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--c0a4a086-cc20-4e1e-b7cb-29d99dfa3fb1', 'name': 'Module', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba', 'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=3 network connection to an RDP/VNC service on an ICS Windows host from a source outside the approved management CIDR baseline'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--9ce98c86-8d30-4043-ba54-0784d478d0b5', 'name': 'Logon Session', 'channel': 'None'}

[AN1905] Analytic 1905

Current version: 1.0

	Old Description			New Description
t	1	A manipulated I/O image requires analyzing the application p	t	1	Real-time monitoring identifies an Industrial Control System
	>	rogram running on the PLC for specific data block writes. De		>	(ICS) protocol write to output register addresses on a fiel
	>	tecting this requires obtaining and analyzing a PLC’s applic		>	d device from a source not in the approved write-source list
	>	ation program, either directly from the device or from asset		>	, correlated with a discrepancy between the value reported b
	>	management platforms.		>	y the Input/Output (I/O) image and an independent measuremen
				>	t of the actual physical output state. OT operational-fideli
				>	ty gate: Alert only when the action is not attributable to a
				>	n authorized operator/engineering source for the specific ta
				>	rget and function, and it is either outside an approved chan
				>	ge/maintenance window or lacks matching change-control conte
				>	xt; where telemetry permits, require corroborating device, c
				>	onfiguration, or process-state effect. Suppress activity tha
				>	t fully matches approved maintenance, commissioning, failove
				>	r, recovery, or tested control procedures. The independent m
				>	easurement is process-state telemetry, not network-flow evid
				>	ence; implementation requires a separately trusted sensor/hi
				>	storian/measurement path with time alignment and an engineer
				>	ing-defined tolerance.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ApprovedWriteSources', 'description': 'IP allowlist of sources authorized to write to I/O output registers.'}, {'field': 'IOIntegrityToleranceThreshold', 'description': 'Acceptable divergence between reported I/O image value and independently measured physical state.'}, {'field': 'OutputRegisterAddressRange', 'description': 'Register/address ranges corresponding to physical outputs for the device type.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:46:53.888000+00:00
description	A manipulated I/O image requires analyzing the application program running on the PLC for specific data block writes. Detecting this requires obtaining and analyzing a PLC’s application program, either directly from the device or from asset management platforms.	Real-time monitoring identifies an Industrial Control System (ICS) protocol write to output register addresses on a field device from a source not in the approved write-source list, correlated with a discrepancy between the value reported by the Input/Output (I/O) image and an independent measurement of the actual physical output state. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures. The independent measurement is process-state telemetry, not network-flow evidence; implementation requires a separately trusted sensor/historian/measurement path with time alignment and an engineering-defined tolerance.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--8ed4e6d0-56d7-4e6b-8fa6-41f41631f30d', 'name': 'Asset', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'NSM:Content', 'channel': 'write function code to output register address range from source not in approved write sources'}
x_mitre_platforms[0]	None	Embedded

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--931b3fc6-ad68-42a8-9018-e98515eedc95', 'name': 'processsensor:RedundantComparison', 'channel': 'Independent process measurement comparison: controller I/O image value diverges from independent sensor/measurement beyond configured integrity tolerance'}

[AN1906] Analytic 1906

Current version: 1.0

	Old Description			New Description
t	1	Collecting information from the I/O image requires analyzing	t	1	Real-time monitoring identifies a single Industrial Control
	>	the application program running on the PLC for specific dat		>	System (ICS) protocol session reading the complete Input/Out
	>	a block reads. Detecting this requires obtaining and analyzi		>	put (I/O) image from a field device, rather than the sparse,
	>	ng a PLC’s application program, either directly from the dev		>	fixed tag subset that legitimate Supervisory Control and Da
	>	ice or from asset management platforms.		>	ta Acquisition (SCADA) polling queries, from a source not in
				>	the approved control server list. OT operational-fidelity g
				>	ate: Do not alert on novelty, scan/read volume, or enumerati
				>	on alone. Alert when the source role is not authorized for d
				>	iscovery/polling and the target scope, address/tag range, pr
				>	otocol, or rate deviates from the established operational ba
				>	seline. Suppress normal SCADA/HMI/historian polling, commiss
				>	ioning, asset inventory, backup, diagnostics, and approved e
				>	ngineering activity.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ApprovedSCADAServers', 'description': 'IP allowlist of legitimate polling sources.'}, {'field': 'FullImageCoverageThreshold', 'description': 'Percentage of total device address space read within a single session constituting a full I/O image read.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:46:54.639000+00:00
description	Collecting information from the I/O image requires analyzing the application program running on the PLC for specific data block reads. Detecting this requires obtaining and analyzing a PLC’s application program, either directly from the device or from asset management platforms.	Real-time monitoring identifies a single Industrial Control System (ICS) protocol session reading the complete Input/Output (I/O) image from a field device, rather than the sparse, fixed tag subset that legitimate Supervisory Control and Data Acquisition (SCADA) polling queries, from a source not in the approved control server list. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
x_mitre_log_source_references[0]['x_mitre_data_component_ref']	x-mitre-data-component--8ed4e6d0-56d7-4e6b-8fa6-41f41631f30d	x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c
x_mitre_log_source_references[0]['name']	Asset	NSM:Content
x_mitre_log_source_references[0]['channel']	None	single session reads address range covering above full image coverage threshold percent of device total Input/Output (I/O) space, from source not in approved Supervisory Control and Data Acquisition (SCADA) servers
x_mitre_platforms[0]	None	Embedded

[AN1908] Analytic 1908

Current version: 1.0

	Old Description			New Description
t	1	Monitor asset management systems for device configuration ch	t	1	Real-time monitoring identifies an Industrial Control System
	>	anges which can be used to understand expected parameter set		>	(ICS) protocol write to a parameter/setpoint register where
	>	tings. Monitor device application logs parameter changes, al		>	the written value falls outside the documented safe operati
	>	though not all devices will produce such logs. Monitor for d		>	ng range, or where the write originates from a source not in
	>	evice alarms produced when parameters are changed, although		>	the approved write-source list, correlated with subsequent
	>	not all devices will produce such alarms. Monitor ICS manage		>	historian tag drift. Documented precedent: FrostyGoop direct
	>	ment protocols for parameter changes, including for unexpect		>	ly modified Modbus holding register values on ENCO heating c
	>	ed values, changes far exceeding standard values, or for par		>	ontrollers in Lviv, Ukraine, causing a two-day remediation o
	>	ameters being changed in an unexpected way (e.g., via a new		>	utage. OT operational-fidelity gate: Alert only when the act
	>	function, at an unusual time).		>	ion is not attributable to an authorized operator/engineerin
				>	g source for the specific target and function, and it is eit
				>	her outside an approved change/maintenance window or lacks m
				>	atching change-control context; where telemetry permits, req
				>	uire corroborating device, configuration, or process-state e
				>	ffect. Suppress activity that fully matches approved mainten
				>	ance, commissioning, failover, recovery, or tested control p
				>	rocedures.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ApprovedWriteSources', 'description': 'IP allowlist of sources authorized to write to parameter/setpoint registers.'}, {'field': 'BaselineValueRange', 'description': 'Documented safe operating range for each monitored parameter.'}, {'field': 'ParameterDriftThreshold', 'description': 'Percentage deviation from rolling baseline considered significant drift.'}, {'field': 'SetpointAddressRange', 'description': 'Register/address ranges corresponding to parameter and setpoint values for the device type.'}, {'field': 'TimeWindow', 'description': 'Time window over which post-write drift is measured.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:46:29.074000+00:00
description	Monitor asset management systems for device configuration changes which can be used to understand expected parameter settings. Monitor device application logs parameter changes, although not all devices will produce such logs. Monitor for device alarms produced when parameters are changed, although not all devices will produce such alarms. Monitor ICS management protocols for parameter changes, including for unexpected values, changes far exceeding standard values, or for parameters being changed in an unexpected way (e.g., via a new function, at an unusual time).	Real-time monitoring identifies an Industrial Control System (ICS) protocol write to a parameter/setpoint register where the written value falls outside the documented safe operating range, or where the write originates from a source not in the approved write-source list, correlated with subsequent historian tag drift. Documented precedent: FrostyGoop directly modified Modbus holding register values on ENCO heating controllers in Lviv, Ukraine, causing a two-day remediation outage. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b05a614b-033c-4578-b4f2-c63a9feee706', 'name': 'Asset', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--931b3fc6-ad68-42a8-9018-e98515eedc95', 'name': 'operationaldb:ProcessHistory', 'channel': 'tag value deviates from rolling baseline mean by more than parameter drift threshold percent within time window following a flagged write'}
x_mitre_platforms[0]	None	Embedded
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'Application Log', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'NSM:Content', 'channel': 'write function code (FC 6/16) to setpoint address range with value outside baseline value range, or from source not in approved write sources'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9d56be63-3501-4dd3-bb5f-63c580833298', 'name': 'Operational Databases', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'scada:applog', 'channel': 'parameter write logged without corresponding operator_id in the Human-Machine Interface (HMI) audit trail'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'Network Traffic', 'channel': 'None'}

[AN1909] Analytic 1909

Current version: 1.0

	Old Description			New Description
t	1	Monitor ICS asset application logs that indicate alarm setti	t	1	Real-time monitoring identifies Simple Network Management Pr
	>	ngs have changed, although not all assets will produce such		>	otocol (SNMP) SET commands to alarm threshold Object Identif
	>	logs. Consult asset management systems to understand expecte		>	iers (OIDs) on Industrial Control System (ICS) network devic
	>	d alarm settings. Data about the industrial process may indi		>	es or process monitoring systems from a source not in the ap
	>	cate it is operating outside of expected bounds and could he		>	proved Network Management System (NMS) Classless Inter-Domai
	>	lp indicate that that an alarm setting has changed. This wil		>	n Routing (CIDR) subnet. OT operational-fidelity gate: Alert
	>	l not directly detect the technique’s execution, but instead		>	only when the action is not attributable to an authorized o
	>	may provide additional evidence that the technique has been		>	perator/engineering source for the specific target and funct
	>	used and may complement other detections. Monitor for alarm		>	ion, and it is either outside an approved change/maintenance
	>	setting changes observable in automation or management netw		>	window or lacks matching change-control context; where tele
	>	ork protocols.		>	metry permits, require corroborating device, configuration,
				>	or process-state effect. Suppress activity that fully matche
				>	s approved maintenance, commissioning, failover, recovery, o
				>	r tested control procedures.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'AlarmThresholdAddressRange', 'description': 'Register addresses specifically corresponding to alarm threshold/deadband configuration.'}, {'field': 'ApprovedWriteSources', 'description': 'IP allowlist of sources authorized to modify alarm configuration.'}, {'field': 'SafeAlarmThresholdRange', 'description': 'Documented safe range for alarm thresholds per parameter.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:45:49.005000+00:00
description	Monitor ICS asset application logs that indicate alarm settings have changed, although not all assets will produce such logs. Consult asset management systems to understand expected alarm settings. Data about the industrial process may indicate it is operating outside of expected bounds and could help indicate that that an alarm setting has changed. This will not directly detect the technique’s execution, but instead may provide additional evidence that the technique has been used and may complement other detections. Monitor for alarm setting changes observable in automation or management network protocols.	Real-time monitoring identifies Simple Network Management Protocol (SNMP) SET commands to alarm threshold Object Identifiers (OIDs) on Industrial Control System (ICS) network devices or process monitoring systems from a source not in the approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'Application Log', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'networkdevice:snmp', 'channel': 'Simple Network Management Protocol (SNMP) SET to alarm threshold Object Identifier (OID) from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet'}
x_mitre_platforms[0]	None	Network Devices

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--b05a614b-033c-4578-b4f2-c63a9feee706', 'name': 'Asset', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--931b3fc6-ad68-42a8-9018-e98515eedc95', 'name': 'Operational Databases', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'Network Traffic', 'channel': 'None'}

[AN1912] Analytic 1912

Current version: 1.0

	Old Description			New Description
t	1	Monitor for changes made to firmware for unexpected modifica	t	1	Periodic or event-triggered integrity verification identifie
	>	tions to settings and/or data that may be used by rootkits t		>	s a discrepancy between a field device's self-reported diagn
	>	o hide the presence of programs, files, network connections,		>	ostic state and an independently verified hardware/firmware
	>	services, drivers, and other system components. Asset manag		>	fingerprint, indicating the device's reporting layer has bee
	>	ement systems should be consulted to understand known-good f		>	n compromised. MITRE explicitly notes firmware/module rootki
	>	irmware versions and configurations.		>	ts 'can also be developed for the Input/Output (I/O) that is
				>	attached to an asset.'. OT operational-fidelity gate: Alert
				>	only when execution violates an approved signer/hash/path/p
				>	arent/process or tool allowlist, or originates from an unaut
				>	horized user/tool, and is tied to an OT asset or follow-on O
				>	T-relevant action. Suppress vendor-signed software, approved
				>	engineering utilities, diagnostics, patching, backup, and d
				>	ocumented maintenance. Monitoring reality: this is an integr
				>	ity/posture analytic, not a universal streaming field-device
				>	event; collection cadence depends on the vendor integrity i
				>	nterface, asset-management system, or acquisition workflow.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'FirmwareIntegrityScanSchedule', 'description': 'Frequency of out-of-band firmware integrity verification.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:44:01.941000+00:00
description	Monitor for changes made to firmware for unexpected modifications to settings and/or data that may be used by rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Asset management systems should be consulted to understand known-good firmware versions and configurations.	Periodic or event-triggered integrity verification identifies a discrepancy between a field device's self-reported diagnostic state and an independently verified hardware/firmware fingerprint, indicating the device's reporting layer has been compromised. MITRE explicitly notes firmware/module rootkits 'can also be developed for the Input/Output (I/O) that is attached to an asset.'. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance. Monitoring reality: this is an integrity/posture analytic, not a universal streaming field-device event; collection cadence depends on the vendor integrity interface, asset-management system, or acquisition workflow.
x_mitre_log_source_references[0]['name']	Firmware	assetinventory:FirmwareHash
x_mitre_log_source_references[0]['channel']	None	device-reported firmware hash/version does not match independently verified value obtained through vendor integrity tool or physical inspection
x_mitre_platforms[0]	None	Embedded

[AN1913] Analytic 1913

Current version: 1.0

	Old Description			New Description
t	1	Monitor for suspicious descendant process spawning from Micr	t	1	Real-time monitoring identifies an email client process on a
	>	osoft Office and other productivity software.(Citation: Elas		>	n Industrial Control System (ICS) Linux workstation spawning
	>	tic - Koadiac Detection with EQL) For added context on adver		>	a child process inconsistent with normal email handling. OT
	>	sary procedures and background see [Spearphishing Attachment		>	operational-fidelity gate: Alert only when the account/devi
	>	](https://attack.mitre.org/techniques/T1566/001). Monitor fo		>	ce/session violates the approved identity + source host/jump
	>	r newly constructed files from a spearphishing emails with a		>	path/zone policy and is corroborated by access to a protect
	>	malicious attachment in an attempt to gain access to victim		>	ed OT asset, execution, configuration change, or another sec
	>	systems. Monitor network traffic for suspicious email attac		>	urity-relevant follow-on event. Suppress approved shift acti
	>	hments. Consider correlation with process monitoring and com		>	vity, vendor support, break-glass use, commissioning, and do
	>	mand line to detect anomalous processes execution and comman		>	cumented remote-access windows.
	>	d line arguments associated to traffic patterns (e.g., monit
	>	or anomalies in use of files that do not normally initiate c
	>	onnections for respective protocol(s)). Use web proxies to r
	>	eview content of emails including sender information, header
	>	s, and attachments for potentially malicious content. Monito
	>	r mail server and proxy logs for evidence of messages origin
	>	ating from spoofed addresses, including records indicating f
	>	ailed DKIM+SPF validation or mismatched message headers.(Cit
	>	ation: Microsoft Anti Spoofing)(Citation: ACSC Email Spoofin
	>	g) Anti-virus can potentially detect malicious documents and
	>	attachments as they're scanned to be stored on the email se
	>	rver or on the user's computer.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ICSWorkstationInventory', 'description': 'Inventory of hosts classified as ICS engineering or operator workstations.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:44:56.723000+00:00
description	Monitor for suspicious descendant process spawning from Microsoft Office and other productivity software.(Citation: Elastic - Koadiac Detection with EQL) For added context on adversary procedures and background see [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001). Monitor for newly constructed files from a spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. Monitor network traffic for suspicious email attachments. Consider correlation with process monitoring and command line to detect anomalous processes execution and command line arguments associated to traffic patterns (e.g., monitor anomalies in use of files that do not normally initiate connections for respective protocol(s)). Use web proxies to review content of emails including sender information, headers, and attachments for potentially malicious content. Monitor mail server and proxy logs for evidence of messages originating from spoofed addresses, including records indicating failed DKIM+SPF validation or mismatched message headers.(Citation: Microsoft Anti Spoofing)(Citation: ACSC Email Spoofing) Anti-virus can potentially detect malicious documents and attachments as they're scanned to be stored on the email server or on the user's computer.	Real-time monitoring identifies an email client process on an Industrial Control System (ICS) Linux workstation spawning a child process inconsistent with normal email handling. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'Process', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; shell/interpreter process is spawned by an ICS network-facing service or other unexpected parent process'}
x_mitre_platforms[0]	None	Linux

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'File', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'Network Traffic', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'Application Log', 'channel': 'None'}

[AN1914] Analytic 1914

Current version: 1.0

	Old Description			New Description
t	1	Monitor for unusual network traffic that may indicate additi	t	1	Real-time monitoring identifies a browser process on an Indu
	>	onal tools transferred to the system. Use network intrusion		>	strial Control System (ICS) workstation spawning an unexpect
	>	detection systems, sometimes with SSL/TLS inspection, to loo		>	ed child process immediately following navigation to an exte
	>	k for known malicious scripts (recon, heap spray, and browse		>	rnal website, particularly a vendor support or software-down
	>	r identification scripts have been frequently reused), commo		>	load site. Documented Havex precedent: adversaries compromis
	>	n script obfuscation, and exploit code. Firewalls and proxie		>	ed legitimate ICS vendor websites to serve trojanized softwa
	>	s can inspect URLs for potentially known-bad domains or para		>	re downloads. OT operational-fidelity gate: Alert only when
	>	meters. They can also do reputation-based analytics on websi		>	the account/device/session violates the approved identity +
	>	tes and their requested resources such as how old a domain i		>	source host/jump path/zone policy and is corroborated by acc
	>	s, who it's registered to, if it's on a known bad list, or h		>	ess to a protected OT asset, execution, configuration change
	>	ow many other users have connected to it before. Monitor for		>	, or another security-relevant follow-on event. Suppress app
	>	behaviors on the endpoint system that might indicate succes		>	roved shift activity, vendor support, break-glass use, commi
	>	sful compromise, such as abnormal behaviors of browser proce		>	ssioning, and documented remote-access windows.
	>	sses. This could include suspicious files written to disk. M
	>	onitor for newly constructed files written to disk through a
	>	user visiting a website over the normal course of browsing.
	>	Monitor for newly constructed network connections to untrus
	>	ted hosts that are used to send or receive data.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ICSWorkstationInventory', 'description': 'Inventory of ICS engineering/operator workstations from which routine vendor software downloads occur.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:47:20.792000+00:00
description	Monitor for unusual network traffic that may indicate additional tools transferred to the system. Use network intrusion detection systems, sometimes with SSL/TLS inspection, to look for known malicious scripts (recon, heap spray, and browser identification scripts have been frequently reused), common script obfuscation, and exploit code. Firewalls and proxies can inspect URLs for potentially known-bad domains or parameters. They can also do reputation-based analytics on websites and their requested resources such as how old a domain is, who it's registered to, if it's on a known bad list, or how many other users have connected to it before. Monitor for behaviors on the endpoint system that might indicate successful compromise, such as abnormal behaviors of browser processes. This could include suspicious files written to disk. Monitor for newly constructed files written to disk through a user visiting a website over the normal course of browsing. Monitor for newly constructed network connections to untrusted hosts that are used to send or receive data.	Real-time monitoring identifies a browser process on an Industrial Control System (ICS) workstation spawning an unexpected child process immediately following navigation to an external website, particularly a vendor support or software-download site. Documented Havex precedent: adversaries compromised legitimate ICS vendor websites to serve trojanized software downloads. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'Network Traffic', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'webproxy:applog', 'channel': 'file download from domain not matching verified vendor Transport Layer Security (TLS) certificate/domain history, immediately preceding the anomalous process spawn'}
x_mitre_platforms[0]	None	Windows
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'Application Log', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 where a browser process spawns cmd.exe, powershell.exe, wscript.exe, or another executable outside the approved browser-child baseline'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'Process', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c', 'name': 'File', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba', 'name': 'Network Traffic', 'channel': 'None'}

[AN1915] Analytic 1915

Current version: 1.0

	Old Description			New Description
t	1	Monitor device management protocols for functions that modif	t	1	Real-time monitoring identifies an Industrial Control System
	>	y programs such as online edit and program append events. Mo		>	(ICS) protocol write to an existing program block from a so
	>	nitor device alarms that indicate the program has changed, a		>	urce not in the approved engineering workstation list, outsi
	>	lthough not all devices produce such alarms. Engineering and		>	de a scheduled change-control window, correlated against pos
	>	asset management software will often maintain a copy of the		>	t-modification program hash comparison and measurable change
	>	expected program loaded on a controller and may also record		>	in controller Input/Output (I/O) behavior. OT operational-f
	>	any changes made to controller programs. Data from these pl		>	idelity gate: Alert only when the action is not attributable
	>	atforms can be used to identify modified controller programs		>	to an authorized operator/engineering source for the specif
	>	. Monitor device application logs that indicate the program		>	ic target and function, and it is either outside an approved
	>	has changed, although not all devices produce such logs.		>	change/maintenance window or lacks matching change-control
				>	context; where telemetry permits, require corroborating devi
				>	ce, configuration, or process-state effect. Suppress activit
				>	y that fully matches approved maintenance, commissioning, fa
				>	ilover, recovery, or tested control procedures.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ChangeControlWindow', 'description': 'Scheduled maintenance periods during which program modifications are authorized.'}, {'field': 'EngineeringWorkstationList', 'description': 'IP allowlist of workstations authorized to modify existing controller program blocks.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:44:06.365000+00:00
description	Monitor device management protocols for functions that modify programs such as online edit and program append events. Monitor device alarms that indicate the program has changed, although not all devices produce such alarms. Engineering and asset management software will often maintain a copy of the expected program loaded on a controller and may also record any changes made to controller programs. Data from these platforms can be used to identify modified controller programs. Monitor device application logs that indicate the program has changed, although not all devices produce such logs.	Real-time monitoring identifies an Industrial Control System (ICS) protocol write to an existing program block from a source not in the approved engineering workstation list, outside a scheduled change-control window, correlated against post-modification program hash comparison and measurable change in controller Input/Output (I/O) behavior. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'Network Traffic', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--8ed4e6d0-56d7-4e6b-8fa6-41f41631f30d', 'name': 'assetinventory:ProgramHash', 'channel': 'program hash differs from last authorized baseline without corresponding change ticket reference'}
x_mitre_platforms[0]	None	Embedded
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9d56be63-3501-4dd3-bb5f-63c580833298', 'name': 'Operational Databases', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'NSM:Content', 'channel': 'write to existing program block address from source not in engineering workstation list outside change control window'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--8ed4e6d0-56d7-4e6b-8fa6-41f41631f30d', 'name': 'Asset', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9d56be63-3501-4dd3-bb5f-63c580833298', 'name': 'device:VendorLog', 'channel': 'measurable change in scan cycle timing or Input/Output (I/O) update pattern following a flagged program write'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'Application Log', 'channel': 'None'}

[AN1916] Analytic 1916

Current version: 1.0

	Old Description			New Description
t	1	Monitor for the termination of processes or services associa	t	1	Real-time monitoring identifies the absence of expected comm
	>	ted with ICS automation protocols and application software w		>	and-message delivery confirmation -- a Supervisory Control a
	>	hich could help detect blocked communications. Monitor for l		>	nd Data Acquisition (SCADA)-issued command that does not pro
	>	ack of operational process data which may help identify a lo		>	duce the expected corresponding state-change response within
	>	ss of communications. This will not directly detect the tech		>	the normal response latency window, while the device remain
	>	nique’s execution, but instead may provide additional eviden		>	s reachable for other traffic. Documented in the 2015 Ukrain
	>	ce that the technique has been used and may complement other		>	e attack, where Sandworm used malicious firmware to render s
	>	detections. Monitor application logs for changes to setting		>	erial-to-Ethernet converters inoperable. OT operational-fide
	>	s and other events associated with network protocols that ma		>	lity gate: Alert only when the action is not attributable to
	>	y be used to block communications. Monitor for a loss of net		>	an authorized operator/engineering source for the specific
	>	work communications, which may indicate this technique is be		>	target and function, and it is either outside an approved ch
	>	ing used. Monitor asset alarms which may help identify a los		>	ange/maintenance window or lacks matching change-control con
	>	s of communications. Consider correlating alarms with other		>	text; where telemetry permits, require corroborating device,
	>	data sources that indicate traffic has been blocked, such as		>	configuration, or process-state effect. Suppress activity t
	>	network traffic. In cases where alternative methods of comm		>	hat fully matches approved maintenance, commissioning, failo
	>	unicating with outstations exist alarms may still be visible		>	ver, recovery, or tested control procedures.
	>	even if command messages are blocked.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'CommandConfirmationWindow', 'description': 'Maximum expected latency between a command being issued and its corresponding state-change confirmation.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:46:29.860000+00:00
description	Monitor for the termination of processes or services associated with ICS automation protocols and application software which could help detect blocked communications. Monitor for lack of operational process data which may help identify a loss of communications. This will not directly detect the technique’s execution, but instead may provide additional evidence that the technique has been used and may complement other detections. Monitor application logs for changes to settings and other events associated with network protocols that may be used to block communications. Monitor for a loss of network communications, which may indicate this technique is being used. Monitor asset alarms which may help identify a loss of communications. Consider correlating alarms with other data sources that indicate traffic has been blocked, such as network traffic. In cases where alternative methods of communicating with outstations exist alarms may still be visible even if command messages are blocked.	Real-time monitoring identifies the absence of expected command-message delivery confirmation -- a Supervisory Control and Data Acquisition (SCADA)-issued command that does not produce the expected corresponding state-change response within the normal response latency window, while the device remains reachable for other traffic. Documented in the 2015 Ukraine attack, where Sandworm used malicious firmware to render serial-to-Ethernet converters inoperable. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--61f1d40e-f3d0-4cc6-aa2d-937b6204194f', 'name': 'Process', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--931b3fc6-ad68-42a8-9018-e98515eedc95', 'name': 'operationaldb:ProcessHistory', 'channel': 'process value expected to change following a command does not change within command confirmation window'}
x_mitre_platforms[0]	None	Embedded
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--931b3fc6-ad68-42a8-9018-e98515eedc95', 'name': 'Operational Databases', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'NSM:Connections', 'channel': 'command-type traffic to device_ip absent while other traffic types (polling, reporting) to the same device continue normally'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'Application Log', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'scada:applog', 'channel': 'command issued to device_ip with no corresponding state-change confirmation received within command confirmation window'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'Network Traffic', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--4c12c1c8-bcef-4daf-8e5b-fca235f71d9e', 'name': 'Operational Databases', 'channel': 'None'}

[AN1919] Analytic 1919

Current version: 1.0

	Old Description			New Description
t	1	Monitor for new ICS protocol connections to existing assets	t	1	Real-time monitoring identifies remote Windows system-inform
	>	or for device scanning (i.e., a host connecting to many devi		>	ation queries using WMI/CIM, WinRM, PowerShell remoting, or
	>	ces) over ICS and enterprise protocols (e.g., ICMP, DCOM, Wi		>	equivalent management tooling where the command names a non-
	>	nRM). Monitor for anomalies related to discovery related ICS		>	local target and the account/source is outside the approved
	>	functions, including devices that have not previously used		>	management baseline. OT operational-fidelity gate: Do not al
	>	these functions or for functions being sent to many outstati		>	ert on novelty, scan/read volume, or enumeration alone. Aler
	>	ons. Note that some ICS protocols use broadcast or multicast		>	t when the source role is not authorized for discovery/polli
	>	functionality, which may produce false positives. Also moni		>	ng and the target scope, address/tag range, protocol, or rat
	>	tor for hosts enumerating network connected resources using		>	e deviates from the established operational baseline. Suppre
	>	non-ICS enterprise protocols. Monitor for files (such as /et		>	ss normal SCADA/HMI/historian polling, commissioning, asset
	>	c/hosts) being accessed that may attempt to get a listing of		>	inventory, backup, diagnostics, and approved engineering act
	>	other systems by IP address, hostname, or other logical ide		>	ivity.
	>	ntifier on a network that may be used for Lateral Movement f
	>	rom the current system. Monitor for newly executed processes
	>	that can be used to discover remote systems, such as ping.e
	>	xe and tracert.exe, especially when executed in quick succes
	>	sion.(Citation: Elastic - Koadiac Detection with EQL) Consid
	>	er monitoring for new processes engaging in scanning activit
	>	y or connecting to multiple systems by correlating process c
	>	reation network data.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ApprovedSCADAServers', 'description': 'IP allowlist of legitimate sources for device identification queries.'}, {'field': 'ApprovedSystemAdmins', 'description': 'Accounts with documented system administration responsibilities.'}, {'field': 'EnumerationTimeWindow', 'description': 'Time window within which multiple enumeration commands are considered a systematic reconnaissance sequence.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:47:50.905000+00:00
description	Monitor for new ICS protocol connections to existing assets or for device scanning (i.e., a host connecting to many devices) over ICS and enterprise protocols (e.g., ICMP, DCOM, WinRM). Monitor for anomalies related to discovery related ICS functions, including devices that have not previously used these functions or for functions being sent to many outstations. Note that some ICS protocols use broadcast or multicast functionality, which may produce false positives. Also monitor for hosts enumerating network connected resources using non-ICS enterprise protocols. Monitor for files (such as /etc/hosts) being accessed that may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Monitor for newly executed processes that can be used to discover remote systems, such as ping.exe and tracert.exe, especially when executed in quick succession.(Citation: Elastic - Koadiac Detection with EQL) Consider monitoring for new processes engaging in scanning activity or connecting to multiple systems by correlating process creation network data.	Real-time monitoring identifies remote Windows system-information queries using WMI/CIM, WinRM, PowerShell remoting, or equivalent management tooling where the command names a non-local target and the account/source is outside the approved management baseline. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'Network Traffic', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 remote-management command (for example wmic /node, winrs, or PowerShell/CIM with -ComputerName) includes a remote target and queries system identity/inventory outside the authorized management baseline'}
x_mitre_platforms[0]	None	Windows

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'Network Traffic', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--235b7491-2d2b-4617-9a52-3c0783680f71', 'name': 'File', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'Process', 'channel': 'None'}

[AN1920] Analytic 1920

Current version: 1.0

	Old Description			New Description
t	1	Monitor ICS automation protocols for anomalies related to re	t	1	Real-time monitoring identifies an Industrial Control System
	>	ading point or tag data, such as new assets using these func		>	(ICS) protocol session that systematically enumerates a dev
	>	tions, changes in volume or timing, or unusual information b		>	ice's full tag/object namespace from a source not in the app
	>	eing queried. Many protocols provide multiple ways to achiev		>	roved control server list, where the enumeration pattern cov
	>	e the same result (e.g., functions with/without an acknowled		>	ers the complete address/object space rather than the sparse
	>	gment or functions that operate on a single point vs. multip		>	, fixed tag set legitimate Supervisory Control and Data Acqu
	>	le points). Monitor for changes in the functions used. Monit		>	isition (SCADA) polling queries. OT operational-fidelity gat
	>	or asset application logs which may provide information abou		>	e: Do not alert on novelty, scan/read volume, or enumeration
	>	t requests for points or tags. Look for anomalies related to		>	alone. Alert when the source role is not authorized for dis
	>	reading point or tag data, such as new assets using these f		>	covery/polling and the target scope, address/tag range, prot
	>	unctions, changes in volume or timing, or unusual informatio		>	ocol, or rate deviates from the established operational base
	>	n being queried. Many devices provide multiple ways to achie		>	line. Suppress normal SCADA/HMI/historian polling, commissio
	>	ve the same result (e.g., functions with/without an acknowle		>	ning, asset inventory, backup, diagnostics, and approved eng
	>	dgment or functions that operate on a single point vs. multi		>	ineering activity.
	>	ple points). Monitor for changes in the functions used.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ApprovedOPCClients', 'description': 'Allowlist of OPC client identities authorized for namespace browsing.'}, {'field': 'ApprovedSCADAServers', 'description': 'IP allowlist of legitimate polling/browsing sources.'}, {'field': 'NamespaceCoverageThreshold', 'description': 'Percentage of total device tag/object space accessed within a session constituting full enumeration.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:46:17.221000+00:00
description	Monitor ICS automation protocols for anomalies related to reading point or tag data, such as new assets using these functions, changes in volume or timing, or unusual information being queried. Many protocols provide multiple ways to achieve the same result (e.g., functions with/without an acknowledgment or functions that operate on a single point vs. multiple points). Monitor for changes in the functions used. Monitor asset application logs which may provide information about requests for points or tags. Look for anomalies related to reading point or tag data, such as new assets using these functions, changes in volume or timing, or unusual information being queried. Many devices provide multiple ways to achieve the same result (e.g., functions with/without an acknowledgment or functions that operate on a single point vs. multiple points). Monitor for changes in the functions used.	Real-time monitoring identifies an Industrial Control System (ICS) protocol session that systematically enumerates a device's full tag/object namespace from a source not in the approved control server list, where the enumeration pattern covers the complete address/object space rather than the sparse, fixed tag set legitimate Supervisory Control and Data Acquisition (SCADA) polling queries. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'Network Traffic', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'opc:applog', 'channel': 'client_id not in approved Open Platform Communications (OPC) clients traversing entire tag tree rather than known fixed subset'}
x_mitre_platforms[0]	None	Embedded
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'Application Log', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'NSM:Content', 'channel': 'Open Platform Communications Unified Architecture (OPC UA) BrowseNamespace or Distributed Network Protocol 3 (DNP3) object 0 all-variation read or Common Industrial Protocol (CIP) Get_Attributes_All from source not in approved Supervisory Control and Data Acquisition (SCADA) servers, covering above namespace coverage threshold percent of device tag space'}

[AN1921] Analytic 1921

Current version: 1.0

	Old Description			New Description
t	1	Monitor asset alarms which may help identify a loss of commu	t	1	Real-time monitoring identifies iptables/nftables rules on I
	>	nications. Consider correlating alarms with other data sourc		>	ndustrial Control System (ICS) Linux gateways that selective
	>	es that indicate traffic has been blocked, such as network t		>	ly drop ICS reporting message traffic based on content while
	>	raffic. In cases where alternative methods of communicating		>	allowing command traffic to pass. OT operational-fidelity g
	>	with outstations exist alarms may still be visible even if r		>	ate: Alert only when the action is not attributable to an au
	>	eporting messages are blocked. Monitor for the termination		>	thorized operator/engineering source for the specific target
	>	of processes or services associated with ICS automation pro		>	and function, and it is either outside an approved change/m
	>	tocols and application software which could help detect bloc		>	aintenance window or lacks matching change-control context;
	>	ked communications. Monitor application logs for changes to		>	where telemetry permits, require corroborating device, confi
	>	settings and other events associated with network protocols		>	guration, or process-state effect. Suppress activity that fu
	>	that may be used to block communications. Monitor for a loss		>	lly matches approved maintenance, commissioning, failover, r
	>	of network communications, which may indicate this techniqu		>	ecovery, or tested control procedures.
	>	e is being used. Monitor for lack of operational process dat
	>	a which may help identify a loss of communications. This wil
	>	l not directly detect the technique’s execution, but instead
	>	may provide additional evidence that the technique has been
	>	used and may complement other detections.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ExpectedReportingInterval', 'description': 'Device-specific configured interval for unsolicited reporting.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:44:19.350000+00:00
description	Monitor asset alarms which may help identify a loss of communications. Consider correlating alarms with other data sources that indicate traffic has been blocked, such as network traffic. In cases where alternative methods of communicating with outstations exist alarms may still be visible even if reporting messages are blocked. Monitor for the termination of processes or services associated with ICS automation protocols and application software which could help detect blocked communications. Monitor application logs for changes to settings and other events associated with network protocols that may be used to block communications. Monitor for a loss of network communications, which may indicate this technique is being used. Monitor for lack of operational process data which may help identify a loss of communications. This will not directly detect the technique’s execution, but instead may provide additional evidence that the technique has been used and may complement other detections.	Real-time monitoring identifies iptables/nftables rules on Industrial Control System (ICS) Linux gateways that selectively drop ICS reporting message traffic based on content while allowing command traffic to pass. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--4c12c1c8-bcef-4daf-8e5b-fca235f71d9e', 'name': 'Operational Databases', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; command line invokes iptables/nftables to change ICS traffic filtering or redirection outside the authorized network-administration baseline'}
x_mitre_platforms[0]	None	Linux

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--61f1d40e-f3d0-4cc6-aa2d-937b6204194f', 'name': 'Process', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'Application Log', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'Network Traffic', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--931b3fc6-ad68-42a8-9018-e98515eedc95', 'name': 'Operational Databases', 'channel': 'None'}

[AN1922] Analytic 1922

Current version: 1.1

	Old Description			New Description
t	1	Monitor for firmware changes which may be observable via ope	t	1	Real-time monitoring identifies a firmware write command tar
	>	rational alarms from devices. Monitor device application log		>	geting a specific Input/Output (I/O) module slot address wit
	>	s for firmware changes, although not all devices will produc		>	hin a controller chassis from a source not in the approved e
	>	e such logs. Monitor ICS management protocols / file transfe		>	ngineering workstation list, distinguishing module-level fir
	>	r protocols for protocol functions related to firmware chang		>	mware modification from main-processor firmware updates by i
	>	es. Monitor firmware for unexpected changes. Asset managemen		>	ts slot-addressed targeting. OT operational-fidelity gate: A
	>	t systems should be consulted to understand known-good firmw		>	lert only when the action is not attributable to an authoriz
	>	are versions. Dump and inspect BIOS images on vulnerable sys		>	ed operator/engineering source for the specific target and f
	>	tems and compare against known good images.(Citation: MITRE		>	unction, and it is either outside an approved change/mainten
	>	Copernicus) Analyze differences to determine if malicious ch		>	ance window or lacks matching change-control context; where
	>	anges have occurred. Log attempts to read/write to BIOS and		>	telemetry permits, require corroborating device, configurati
	>	compare against known patching behavior. Likewise, EFI modul		>	on, or process-state effect. Suppress activity that fully ma
	>	es can be collected and compared against a known-clean list		>	tches approved maintenance, commissioning, failover, recover
	>	of EFI executable binaries to detect potentially malicious m		>	y, or tested control procedures.
	>	odules. The CHIPSEC framework can be used for analysis to de
	>	termine if firmware modifications have been performed.(Citat
	>	ion: McAfee CHIPSEC Blog)(Citation: Github CHIPSEC)(Citation
	>	: Intel HackingTeam UEFI Rootkit)

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'AuthorizedModuleFirmwareInventory', 'description': 'Hash inventory of authorized firmware versions per I/O module type and slot position.'}, {'field': 'ChangeControlWindow', 'description': 'Scheduled maintenance periods during which module firmware updates are authorized.'}, {'field': 'EngineeringWorkstationList', 'description': 'IP allowlist of workstations authorized to perform module-level firmware updates.'}]

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.379000+00:00	2026-10-13 17:44:02.622000+00:00
description	Monitor for firmware changes which may be observable via operational alarms from devices. Monitor device application logs for firmware changes, although not all devices will produce such logs. Monitor ICS management protocols / file transfer protocols for protocol functions related to firmware changes. Monitor firmware for unexpected changes. Asset management systems should be consulted to understand known-good firmware versions. Dump and inspect BIOS images on vulnerable systems and compare against known good images.(Citation: MITRE Copernicus) Analyze differences to determine if malicious changes have occurred. Log attempts to read/write to BIOS and compare against known patching behavior. Likewise, EFI modules can be collected and compared against a known-clean list of EFI executable binaries to detect potentially malicious modules. The CHIPSEC framework can be used for analysis to determine if firmware modifications have been performed.(Citation: McAfee CHIPSEC Blog)(Citation: Github CHIPSEC)(Citation: Intel HackingTeam UEFI Rootkit)	Real-time monitoring identifies a firmware write command targeting a specific Input/Output (I/O) module slot address within a controller chassis from a source not in the approved engineering workstation list, distinguishing module-level firmware modification from main-processor firmware updates by its slot-addressed targeting. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9d56be63-3501-4dd3-bb5f-63c580833298', 'name': 'Operational Databases', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b9d031bb-d150-4fc6-8025-688201bf3ffd', 'name': 'assetinventory:FirmwareHash', 'channel': 'module-specific firmware hash post-write does not match authorized module firmware inventory'}
x_mitre_platforms[0]	None	Embedded
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'Application Log', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'NSM:Content', 'channel': 'firmware write service targeting specific slot/rack address from source not in engineering workstation list outside change control window'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'Network Traffic', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--b9d031bb-d150-4fc6-8025-688201bf3ffd', 'name': 'Firmware', 'channel': 'None'}

[AN1923] Analytic 1923

Current version: 1.0

	Old Description			New Description
t	1	Monitor for newly executed processes that depend on user int	t	1	Real-time monitoring identifies a user-invoked action on an
	>	eraction, especially for applications that can embed program		>	Industrial Control System (ICS) workstation immediately foll
	>	matic capabilities (e.g., Microsoft Office products with scr		>	owed by a process execution chain inconsistent with normal I
	>	ipts, installers, zip files). This includes compression appl		>	CS operations -- the user-driven trigger plus the resulting
	>	ications, such as those for zip files, that can be used to [		>	anomalous execution chain together distinguish this from gen
	>	Deobfuscate/Decode Files or Information](https://attack.mitr		>	eric malware execution. OT operational-fidelity gate: Alert
	>	e.org/techniques/T1140) in payloads. For added context on ad		>	only when the account/device/session violates the approved i
	>	versary procedures and background see [User Execution](https		>	dentity + source host/jump path/zone policy and is corrobora
	>	://attack.mitre.org/techniques/T1204) and applicable sub-tec		>	ted by access to a protected OT asset, execution, configurat
	>	hniques. Monitor for application logging, messaging, and/or		>	ion change, or another security-relevant follow-on event. Su
	>	other artifacts that may rely upon specific actions by a use		>	ppress approved shift activity, vendor support, break-glass
	>	r in order to gain execution. Monitor for newly constructed		>	use, commissioning, and documented remote-access windows.
	>	web-based network connections that are sent to malicious or
	>	suspicious destinations (e.g., destinations attributed to ph
	>	ishing campaigns). Consider correlation with process monitor
	>	ing and command line to detect anomalous processes execution
	>	and command line arguments (e.g., monitor anomalies in use
	>	of files that do not normally initiate network connections o
	>	r unusual connections initiated by regsvr32.exe, rundll.exe,
	>	SCF, HTA, MSI, DLLs, or msiexec.exe). Anti-virus can poten
	>	tially detect malicious documents and files that are downloa
	>	ded and executed on the user's computer. Endpoint sensing or
	>	network sensing can potentially detect malicious events onc
	>	e the file is opened (such as a Microsoft Word document or P
	>	DF reaching out to the internet or spawning PowerShell). Mon
	>	itor for newly executed processes that depend on user intera
	>	ction, especially for applications that can embed programmat
	>	ic capabilities (e.g., Microsoft Office products with script
	>	s, installers, zip files). This includes compression applica
	>	tions, such as those for zip files, that can be used to [Deo
	>	bfuscate/Decode Files or Information](https://attack.mitre.o
	>	rg/techniques/T1140) in payloads. Monitor and analyze traffi
	>	c patterns and packet inspection associated with web-based n
	>	etwork connections that are sent to malicious or suspicious
	>	destinations (e.g., destinations attributed to phishing camp
	>	aigns). Consider correlation with process monitoring and com
	>	mand line to detect anomalous processes execution and comman
	>	d line arguments (e.g., monitor anomalies in use of files th
	>	at do not normally initiate network connections or unusual c
	>	onnections initiated by regsvr32.exe, rundll.exe, SCF, HTA,
	>	MSI, DLLs, or msiexec.exe).

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ApprovedDestinations', 'description': 'Allowlist of network destinations consistent with legitimate document/link content.'}, {'field': 'ExpectedDocumentViewerChildren', 'description': 'Documented normal child processes for legitimate document viewers/handlers.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:47:51.681000+00:00
description	Monitor for newly executed processes that depend on user interaction, especially for applications that can embed programmatic capabilities (e.g., Microsoft Office products with scripts, installers, zip files). This includes compression applications, such as those for zip files, that can be used to [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140) in payloads. For added context on adversary procedures and background see [User Execution](https://attack.mitre.org/techniques/T1204) and applicable sub-techniques. Monitor for application logging, messaging, and/or other artifacts that may rely upon specific actions by a user in order to gain execution. Monitor for newly constructed web-based network connections that are sent to malicious or suspicious destinations (e.g., destinations attributed to phishing campaigns). Consider correlation with process monitoring and command line to detect anomalous processes execution and command line arguments (e.g., monitor anomalies in use of files that do not normally initiate network connections or unusual connections initiated by regsvr32.exe, rundll.exe, SCF, HTA, MSI, DLLs, or msiexec.exe). Anti-virus can potentially detect malicious documents and files that are downloaded and executed on the user's computer. Endpoint sensing or network sensing can potentially detect malicious events once the file is opened (such as a Microsoft Word document or PDF reaching out to the internet or spawning PowerShell). Monitor for newly executed processes that depend on user interaction, especially for applications that can embed programmatic capabilities (e.g., Microsoft Office products with scripts, installers, zip files). This includes compression applications, such as those for zip files, that can be used to [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140) in payloads. Monitor and analyze traffic patterns and packet inspection associated with web-based network connections that are sent to malicious or suspicious destinations (e.g., destinations attributed to phishing campaigns). Consider correlation with process monitoring and command line to detect anomalous processes execution and command line arguments (e.g., monitor anomalies in use of files that do not normally initiate network connections or unusual connections initiated by regsvr32.exe, rundll.exe, SCF, HTA, MSI, DLLs, or msiexec.exe).	Real-time monitoring identifies a user-invoked action on an Industrial Control System (ICS) workstation immediately followed by a process execution chain inconsistent with normal ICS operations -- the user-driven trigger plus the resulting anomalous execution chain together distinguish this from generic malware execution. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--685f917a-e95e-4ba0-ade1-c7d354dae6e0', 'name': 'Command', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 chain originating from user-invoked file open or link click action, spawning processes not in expected document viewer children'}
x_mitre_platforms[0]	None	Windows
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'Application Log', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba', 'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=3 from resulting process to destinations not in approved destinations list'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba', 'name': 'Network Traffic', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--235b7491-2d2b-4617-9a52-3c0783680f71', 'name': 'File', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'Process', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'Network Traffic', 'channel': 'None'}

[AN1924] Analytic 1924

Current version: 1.0

	Old Description			New Description
t	1	Consult asset management systems which may help with the det	t	1	Real-time monitoring identifies Industrial Control System (I
	>	ection of computer systems or network devices that should no		>	CS) master-role command traffic originating from a source no
	>	t exist on a network. Monitor for network traffic originatin		>	t in the approved control server inventory, directed at mult
	>	g from unknown/unexpected devices or addresses. Local netwo		>	iple field devices in a pattern consistent with control-serv
	>	rk traffic metadata could be used to identify unexpected con		>	er behavior. Documented in Maroochy Water Services (falsifie
	>	nections, including unknown/unexpected source MAC addresses		>	d PDS/station addresses to impersonate the master) and the 2
	>	connecting to ports associated with operational protocols. A		>	017 Dallas Siren incident (rogue radio transmitter to 156 si
	>	lso, network management protocols such as DHCP and ARP may b		>	rens). OT operational-fidelity gate: Alert only when the mas
	>	e helpful in identifying unexpected devices. Monitor for ne		>	ter/station identity or source is not authorized for the tar
	>	w master devices communicating with outstations, which may b		>	get device and command function, or when a normally authoriz
	>	e visible in alarms within the ICS environment. Monitor for		>	ed master violates its configured role/sequence and produces
	>	unexpected ICS protocol functions from new and existing devi		>	a corroborating device/process-state change. Suppress legit
	>	ces. Monitoring known devices requires ICS function level in		>	imate redundancy/failover, hot-standby promotion, commission
	>	sight to determine if an unauthorized device is issuing comm		>	ing, and approved engineering master activity.
	>	ands (e.g., a historian). Monitor for new master devices com
	>	municating with outstation assets, which may be visible in a
	>	sset application logs.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ApprovedSCADAServers', 'description': 'IP/identity allowlist of legitimate master/control server systems.'}, {'field': 'RegisteredMasterAddresses', 'description': 'Inventory of authorized station/master addresses for protocols using logical addressing distinct from IP.'}, {'field': 'RogueMasterTimeWindow', 'description': 'Time window within which command traffic to multiple devices from a single unrecognized source is considered a coordinated rogue master event.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:44:04.143000+00:00
description	Consult asset management systems which may help with the detection of computer systems or network devices that should not exist on a network. Monitor for network traffic originating from unknown/unexpected devices or addresses. Local network traffic metadata could be used to identify unexpected connections, including unknown/unexpected source MAC addresses connecting to ports associated with operational protocols. Also, network management protocols such as DHCP and ARP may be helpful in identifying unexpected devices. Monitor for new master devices communicating with outstations, which may be visible in alarms within the ICS environment. Monitor for unexpected ICS protocol functions from new and existing devices. Monitoring known devices requires ICS function level insight to determine if an unauthorized device is issuing commands (e.g., a historian). Monitor for new master devices communicating with outstation assets, which may be visible in asset application logs.	Real-time monitoring identifies Industrial Control System (ICS) master-role command traffic originating from a source not in the approved control server inventory, directed at multiple field devices in a pattern consistent with control-server behavior. Documented in Maroochy Water Services (falsified PDS/station addresses to impersonate the master) and the 2017 Dallas Siren incident (rogue radio transmitter to 156 sirens). OT operational-fidelity gate: Alert only when the master/station identity or source is not authorized for the target device and command function, or when a normally authorized master violates its configured role/sequence and produces a corroborating device/process-state change. Suppress legitimate redundancy/failover, hot-standby promotion, commissioning, and approved engineering master activity.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b05a614b-033c-4578-b4f2-c63a9feee706', 'name': 'Asset', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b05a614b-033c-4578-b4f2-c63a9feee706', 'name': 'assetinventory:MasterAddress', 'channel': 'command traffic uses master/station address not in registered master addresses'}
x_mitre_platforms[0]	None	Embedded
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'Network Traffic', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9d56be63-3501-4dd3-bb5f-63c580833298', 'name': 'operationaldb:AlarmEvent', 'channel': 'device receives commands from two distinct master identities within a short window'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9d56be63-3501-4dd3-bb5f-63c580833298', 'name': 'Operational Databases', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'NSM:Content', 'channel': 'write/control command traffic from source not in approved Supervisory Control and Data Acquisition (SCADA) servers directed at multiple distinct device IPs within rogue master time window'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'Network Traffic', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'Application Log', 'channel': 'None'}

[AN1925] Analytic 1925

Current version: 1.0

	Old Description			New Description
t	1	Monitor for any suspicious attempts to enable script executi	t	1	Real-time monitoring identifies a trusted, signed Windows sy
	>	on on a system. If scripts are not commonly used on a system		>	stem binary executing with command-line arguments inconsiste
	>	, but enabled, scripts running out of cycle from patching or		>	nt with its documented administrative purpose -- specificall
	>	other administrator functions are suspicious. Scripts shoul		>	y arguments indicating payload decoding, remote content exec
	>	d be captured from the file system when possible to determin		>	ution, or script invocation -- on an Industrial Control Syst
	>	e their actions and intent. Monitor executed commands and as		>	em (ICS) host. OT operational-fidelity gate: Alert only when
	>	sociated arguments for application programs which support ex		>	execution violates an approved signer/hash/path/parent/proc
	>	ecuting custom code, scripts, commands, or executables. Mon		>	ess or tool allowlist, or originates from an unauthorized us
	>	itor for unusual processes execution, especially for process		>	er/tool, and is tied to an OT asset or follow-on OT-relevant
	>	es that allow the proxy execution of malicious files.		>	action. Suppress vendor-signed software, approved engineeri
				>	ng utilities, diagnostics, patching, backup, and documented
				>	maintenance.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ICSWorkstationInventory', 'description': 'Inventory of ICS hosts warranting this elevated monitoring.'}, {'field': 'LOLBinAbusePatterns', 'description': 'Documented command-line argument patterns for living-off-the-land binary abuse.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:47:53.370000+00:00
description	Monitor for any suspicious attempts to enable script execution on a system. If scripts are not commonly used on a system, but enabled, scripts running out of cycle from patching or other administrator functions are suspicious. Scripts should be captured from the file system when possible to determine their actions and intent. Monitor executed commands and associated arguments for application programs which support executing custom code, scripts, commands, or executables. Monitor for unusual processes execution, especially for processes that allow the proxy execution of malicious files.	Real-time monitoring identifies a trusted, signed Windows system binary executing with command-line arguments inconsistent with its documented administrative purpose -- specifically arguments indicating payload decoding, remote content execution, or script invocation -- on an Industrial Control System (ICS) host. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9f387817-df83-432a-b56b-a8fb7f71eedd', 'name': 'Script', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 image matches certutil.exe/regsvr32.exe/mshta.exe/rundll32.exe and command line matches Living-off-the-Land Binary (LOLBin) abuse patterns on host in Industrial Control Systems (ICS) workstation inventory'}
x_mitre_platforms[0]	None	Windows

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--685f917a-e95e-4ba0-ade1-c7d354dae6e0', 'name': 'Command', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'Process', 'channel': 'None'}

[AN1926] Analytic 1926

Current version: 1.0

	Old Description			New Description
t	1	Monitor industrial process history data for events that corr	t	1	Real-time monitoring identifies a Windows process generating
	>	espond with command message functions, such as setpoint modi		>	Industrial Control System (ICS) command messages to field d
	>	fication or changes to system status for key devices. This w		>	evice tags representing physical outputs, from a process tha
	>	ill not directly detect the technique’s execution, but inste		>	t is not the recognized Supervisory Control and Data Acquisi
	>	ad may provide additional evidence that the technique has be		>	tion (SCADA) or Distributed Control System (DCS) control app
	>	en used and may complement other detections. Monitor for ano		>	lication, targeting safety-critical output tags. OT operatio
	>	malous or unexpected commands that may result in changes to		>	nal-fidelity gate: Alert only when the action is not attribu
	>	the process operation (e.g., discrete write, logic and devic		>	table to an authorized operator/engineering source for the s
	>	e configuration, mode changes) observable via asset applicat		>	pecific target and function, and it is either outside an app
	>	ion logs. Monitor for new or unexpected connections to contr		>	roved change/maintenance window or lacks matching change-con
	>	ollers, which could indicate an Unauthorized Command Message		>	trol context; where telemetry permits, require corroborating
	>	being sent via [Rogue Master](https://attack.mitre.org/tech		>	device, configuration, or process-state effect. Suppress ac
	>	niques/T0848). Monitor for anomalous or unexpected commands		>	tivity that fully matches approved maintenance, commissionin
	>	that may result in changes to the process operation (e.g., d		>	g, failover, recovery, or tested control procedures.
	>	iscrete write, logic and device configuration, mode changes)
	>	observable via asset application logs. Monitor for unexpect
	>	ed ICS protocol command functions to controllers from existi
	>	ng master devices (including from new processes) or from new
	>	devices. The latter is like detection for [Rogue Master](ht
	>	tps://attack.mitre.org/techniques/T0848) but requires ICS fu
	>	nction level insight to determine if an unauthorized device
	>	is issuing commands (e.g., a historian). Monitoring for une
	>	xpected or problematic values below the function level will
	>	provide better insights into potentially malicious activity
	>	but at the cost of additional false positives depending on t
	>	he underlying operational process.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ApprovedSCADAServers', 'description': 'IP allowlist of legitimate control sources.'}, {'field': 'RapidToggleWindow', 'description': 'Time window within which multiple safety-critical output changes are considered a coordinated event.'}, {'field': 'SafetyCriticalOutputAddresses', 'description': 'Documented register/IOA addresses corresponding to safety-critical outputs per device.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:46:18.931000+00:00
description	Monitor industrial process history data for events that correspond with command message functions, such as setpoint modification or changes to system status for key devices. This will not directly detect the technique’s execution, but instead may provide additional evidence that the technique has been used and may complement other detections. Monitor for anomalous or unexpected commands that may result in changes to the process operation (e.g., discrete write, logic and device configuration, mode changes) observable via asset application logs. Monitor for new or unexpected connections to controllers, which could indicate an Unauthorized Command Message being sent via [Rogue Master](https://attack.mitre.org/techniques/T0848). Monitor for anomalous or unexpected commands that may result in changes to the process operation (e.g., discrete write, logic and device configuration, mode changes) observable via asset application logs. Monitor for unexpected ICS protocol command functions to controllers from existing master devices (including from new processes) or from new devices. The latter is like detection for [Rogue Master](https://attack.mitre.org/techniques/T0848) but requires ICS function level insight to determine if an unauthorized device is issuing commands (e.g., a historian). Monitoring for unexpected or problematic values below the function level will provide better insights into potentially malicious activity but at the cost of additional false positives depending on the underlying operational process.	Real-time monitoring identifies a Windows process generating Industrial Control System (ICS) command messages to field device tags representing physical outputs, from a process that is not the recognized Supervisory Control and Data Acquisition (SCADA) or Distributed Control System (DCS) control application, targeting safety-critical output tags. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--931b3fc6-ad68-42a8-9018-e98515eedc95', 'name': 'Operational Databases', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'opc:applog', 'channel': 'command call to field device output tag from process not matching recognized Supervisory Control and Data Acquisition (SCADA)/Distributed Control System (DCS) control application'}
x_mitre_platforms[0]	None	Windows

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'Application Log', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'Network Traffic', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--4c12c1c8-bcef-4daf-8e5b-fca235f71d9e', 'name': 'Operational Databases', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'Network Traffic', 'channel': 'None'}

[AN1927] Analytic 1927

Current version: 1.0

	Old Description			New Description
t	1	Detecting software exploitation may be difficult depending o	t	1	Real-time monitoring identifies malformed or out-of-spec ICS
	>	n the tools available. Software exploits may not always succ		>	protocol exchanges targeting an embedded device from a sour
	>	eed or may cause the exploited process to become unstable or		>	ce outside the approved communication baseline. OT operation
	>	crash.		>	al-fidelity gate: Alert only when execution violates an appr
				>	oved signer/hash/path/parent/process or tool allowlist, or o
				>	riginates from an unauthorized user/tool, and is tied to an
				>	OT asset or follow-on OT-relevant action. Suppress vendor-si
				>	gned software, approved engineering utilities, diagnostics,
				>	patching, backup, and documented maintenance.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ExploitCrashCorrelationWindow', 'description': 'Time window correlating a memory access event with a subsequent crash.'}, {'field': 'TrustedSecurityToolList', 'description': 'Allowlist of legitimate security/diagnostic tools authorized to perform cross-process memory access.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:46:59.428000+00:00
description	Detecting software exploitation may be difficult depending on the tools available. Software exploits may not always succeed or may cause the exploited process to become unstable or crash.	Real-time monitoring identifies malformed or out-of-spec ICS protocol exchanges targeting an embedded device from a source outside the approved communication baseline. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.
x_mitre_log_source_references[0]['x_mitre_data_component_ref']	x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa	x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c
x_mitre_log_source_references[0]['name']	Application Log	NSM:Content
x_mitre_log_source_references[0]['channel']	None	anomalous protocol exchange preceding device behavioral change (reboot, altered configuration)
x_mitre_platforms[0]	None	Embedded

[AN1928] Analytic 1928

Current version: 1.0

	Old Description			New Description
t	1	Monitor logon activity for unexpected or unusual access to d	t	1	Real-time monitoring identifies inbound connections to Indus
	>	evices from the Internet. Monitor for unexpected protocols t		>	trial Control System (ICS) Windows application servers from
	>	o/from the Internet. While network traffic content and logon		>	internet-routed Internet Protocol (IP) addresses. OT operati
	>	session metadata may directly identify a login event, new I		>	onal-fidelity gate: Alert only when the asset's documented r
	>	nternet-based network flows may also be a reliable indicator		>	ole does not permit the connection and the destination/proxy
	>	of this technique. Monitor for unusual logins to Internet c		>	/service is outside the approved communications profile, wit
	>	onnected devices or unexpected protocols to/from the Interne		>	h process/service identity used as corroboration where avail
	>	t. Network traffic content will provide valuable context and		>	able. Suppress approved vendor support, update repositories,
	>	details about the content of network flows.		>	remote operations, failover paths, and documented temporary
				>	connectivity.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'OrganizationalIPSpace', 'description': 'Documented internal/organizational IP address ranges.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:47:31.506000+00:00
description	Monitor logon activity for unexpected or unusual access to devices from the Internet. Monitor for unexpected protocols to/from the Internet. While network traffic content and logon session metadata may directly identify a login event, new Internet-based network flows may also be a reliable indicator of this technique. Monitor for unusual logins to Internet connected devices or unexpected protocols to/from the Internet. Network traffic content will provide valuable context and details about the content of network flows.	Real-time monitoring identifies inbound connections to Industrial Control System (ICS) Windows application servers from internet-routed Internet Protocol (IP) addresses. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--39b9db72-8b48-4595-a18d-db5bbba3091b', 'name': 'Logon Session', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--39b9db72-8b48-4595-a18d-db5bbba3091b', 'name': 'WinEventLog:Security', 'channel': 'Windows Security Event ID 4624/4625: inbound authentication attempt or successful session from internet-sourced Internet Protocol (IP) address to Industrial Control Systems (ICS) application port'}
x_mitre_platforms[0]	None	Windows

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'Network Traffic', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'Network Traffic', 'channel': 'None'}

[AN1929] Analytic 1929

Current version: 1.0

	Old Description			New Description
t	1	Monitor asset alarms which may help identify a loss of commu	t	1	Real-time monitoring identifies a loss of communication with
	>	nications. Consider correlating alarms with other data sourc		>	serially-connected field devices correlated with a configur
	>	es that indicate traffic has been blocked, such as network t		>	ation change event on the serial-to-Ethernet gateway. Docume
	>	raffic. In cases where alternative methods of communicating		>	nted in the 2015 Ukraine attack, where Sandworm used malicio
	>	with outstations exist alarms may still be visible even if m		>	us firmware to render serial-to-Ethernet converters inoperab
	>	essages over serial COM ports are blocked. Monitor for a los		>	le. OT operational-fidelity gate: Alert only when the action
	>	s of network communications, which may indicate this techniq		>	is not attributable to an authorized operator/engineering s
	>	ue is being used. Monitor for lack of operational process da		>	ource for the specific target and function, and it is either
	>	ta which may help identify a loss of communications. This wi		>	outside an approved change/maintenance window or lacks matc
	>	ll not directly detect the technique’s execution, but instea		>	hing change-control context; where telemetry permits, requir
	>	d may provide additional evidence that the technique has bee		>	e corroborating device, configuration, or process-state effe
	>	n used and may complement other detections. Monitor applicat		>	ct. Suppress activity that fully matches approved maintenanc
	>	ion logs for changes to settings and other events associated		>	e, commissioning, failover, recovery, or tested control proc
	>	with network protocols that may be used to block communicat		>	edures.
	>	ions. Monitor for the termination of processes or services a
	>	ssociated with ICS automation protocols and application soft
	>	ware which could help detect blocked communications.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'SerialBlockCorrelationWindow', 'description': 'Time window within which a serial gateway configuration change and subsequent device communication loss are considered causally connected.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:46:22.866000+00:00
description	Monitor asset alarms which may help identify a loss of communications. Consider correlating alarms with other data sources that indicate traffic has been blocked, such as network traffic. In cases where alternative methods of communicating with outstations exist alarms may still be visible even if messages over serial COM ports are blocked. Monitor for a loss of network communications, which may indicate this technique is being used. Monitor for lack of operational process data which may help identify a loss of communications. This will not directly detect the technique’s execution, but instead may provide additional evidence that the technique has been used and may complement other detections. Monitor application logs for changes to settings and other events associated with network protocols that may be used to block communications. Monitor for the termination of processes or services associated with ICS automation protocols and application software which could help detect blocked communications.	Real-time monitoring identifies a loss of communication with serially-connected field devices correlated with a configuration change event on the serial-to-Ethernet gateway. Documented in the 2015 Ukraine attack, where Sandworm used malicious firmware to render serial-to-Ethernet converters inoperable. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--4c12c1c8-bcef-4daf-8e5b-fca235f71d9e', 'name': 'Operational Databases', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--4c12c1c8-bcef-4daf-8e5b-fca235f71d9e', 'name': 'operationaldb:AlarmEvent', 'channel': 'device_ip communication-loss alarm within serial block correlation window of a flagged serial gateway configuration change'}
x_mitre_platforms[0]	None	Embedded
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'Network Traffic', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'serialgw:syslog', 'channel': 'serial port parameter change (baud rate, parity, port disable) without corresponding change ticket reference'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--931b3fc6-ad68-42a8-9018-e98515eedc95', 'name': 'Operational Databases', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'Application Log', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--61f1d40e-f3d0-4cc6-aa2d-937b6204194f', 'name': 'Process', 'channel': 'None'}

[AN1930] Analytic 1930

Current version: 1.0

	Old Description			New Description
t	1	Monitor network traffic for hardcoded credential use in prot	t	1	Real-time monitoring identifies field device access using cr
	>	ocols that allow unencrypted authentication. Monitor logon s		>	edentials matching hardcoded values extracted from Industria
	>	essions for hardcoded credential use, when feasible.		>	l Control System (ICS) vendor firmware or configuration file
				>	s, from a source with no legitimate operational role. Docume
				>	nted in TriStation 1131 v4.9.0 and earlier, which contained
				>	undocumented power-user accounts with hardcoded credentials.
				>	OT operational-fidelity gate: Alert only when the account/d
				>	evice/session violates the approved identity + source host/j
				>	ump path/zone policy and is corroborated by access to a prot
				>	ected OT asset, execution, configuration change, or another
				>	security-relevant follow-on event. Suppress approved shift a
				>	ctivity, vendor support, break-glass use, commissioning, and
				>	documented remote-access windows.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'KnownHardcodedCredentialPatterns', 'description': 'Documented hardcoded credential values for in-use ICS products, where publicly disclosed by vendors or security researchers.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:46:33.957000+00:00
description	Monitor network traffic for hardcoded credential use in protocols that allow unencrypted authentication. Monitor logon sessions for hardcoded credential use, when feasible.	Real-time monitoring identifies field device access using credentials matching hardcoded values extracted from Industrial Control System (ICS) vendor firmware or configuration files, from a source with no legitimate operational role. Documented in TriStation 1131 v4.9.0 and earlier, which contained undocumented power-user accounts with hardcoded credentials. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'Network Traffic', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'NSM:Content', 'channel': 'device authentication success using credential pattern matching known hardcoded credential patterns from source not in approved access list'}
x_mitre_platforms[0]	None	Embedded

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--9ce98c86-8d30-4043-ba54-0784d478d0b5', 'name': 'Logon Session', 'channel': 'None'}

[AN1931] Analytic 1931

Current version: 1.0

	Old Description			New Description
t	1	Monitor and analyze traffic flows that do not follow the exp	t	1	Real-time monitoring identifies Domain Name System (DNS) que
	>	ected protocol standards and traffic flows (e.g., extraneous		>	ries from Industrial Control System (ICS) host Internet Prot
	>	packets that do not belong to established flows , or gra		>	ocol (IP) addresses to external resolvers for domains not as
	>	tuitous or anomalous traffic patterns). Consider correlation		>	sociated with any approved ICS vendor, particularly domains
	>	with process monitoring and command line to detect anomalou		>	exhibiting Domain Generation Algorithm (DGA)-like patterns.
	>	s processes execution and command line arguments associated		>	OT operational-fidelity gate: Alert only when the asset's do
	>	to traffic patterns (e.g., monitor anomalies in use of files		>	cumented role does not permit the connection and the destina
	>	that do not normally initiate connections for respective pr		>	tion/proxy/service is outside the approved communications pr
	>	otocol(s)). Monitor and analyze traffic patterns and packet		>	ofile, with process/service identity used as corroboration w
	>	inspection associated to protocol(s), leveraging SSL/TLS ins		>	here available. Suppress approved vendor support, update rep
	>	pection for encrypted traffic, that do not follow the expect		>	ositories, remote operations, failover paths, and documented
	>	ed protocol standards and traffic flows (e.g., extraneous pa		>	temporary connectivity.
	>	ckets that do not belong to established flows, gratuitous or
	>	anomalous traffic patterns, anomalous syntax, or structure)
	>	. Consider correlation with process monitoring and command l
	>	ine to detect anomalous processes execution and command line
	>	arguments associated to traffic patterns (e.g., monitor an
	>	omalies in use of files that do not normally initiate connec
	>	tions for respective protocol(s)).

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ApprovedVendorDomains', 'description': 'Allowlist of legitimate vendor/business domains for application-layer protocol traffic.'}, {'field': 'NoExternalConnectivityRoleList', 'description': 'Inventory of ICS hosts whose role does not require external application-layer connectivity.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:45:22.783000+00:00
description	Monitor and analyze traffic flows that do not follow the expected protocol standards and traffic flows (e.g., extraneous packets that do not belong to established flows , or gratuitous or anomalous traffic patterns). Consider correlation with process monitoring and command line to detect anomalous processes execution and command line arguments associated to traffic patterns (e.g., monitor anomalies in use of files that do not normally initiate connections for respective protocol(s)). Monitor and analyze traffic patterns and packet inspection associated to protocol(s), leveraging SSL/TLS inspection for encrypted traffic, that do not follow the expected protocol standards and traffic flows (e.g., extraneous packets that do not belong to established flows, gratuitous or anomalous traffic patterns, anomalous syntax, or structure). Consider correlation with process monitoring and command line to detect anomalous processes execution and command line arguments associated to traffic patterns (e.g., monitor anomalies in use of files that do not normally initiate connections for respective protocol(s)).	Real-time monitoring identifies Domain Name System (DNS) queries from Industrial Control System (ICS) host Internet Protocol (IP) addresses to external resolvers for domains not associated with any approved ICS vendor, particularly domains exhibiting Domain Generation Algorithm (DGA)-like patterns. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'Network Traffic', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'dns:querylog', 'channel': 'Domain Name System (DNS) query from Industrial Control Systems (ICS) host to domain not in approved vendor domains, particularly domains exhibiting Domain Generation Algorithm (DGA)-like patterns'}
x_mitre_platforms[0]	None	Network Devices

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'Network Traffic', 'channel': 'None'}

[AN1932] Analytic 1932

Current version: 1.0

	Old Description			New Description
t	1	Monitor for newly executed processes that can aid in sniffin	t	1	Real-time monitoring identifies a process loading a packet c
	>	g network traffic to capture information about an environmen		>	apture driver or executing a known capture utility on an Ind
	>	t. Monitor executed commands and arguments for actions that		>	ustrial Control System (ICS) host's network interface, from
	>	aid in sniffing network traffic to capture information about		>	a process or account not associated with documented network
	>	an environment.		>	analysis responsibilities. OT operational-fidelity gate: Do
				>	not alert on novelty, scan/read volume, or enumeration alone
				>	. Alert when the source role is not authorized for discovery
				>	/polling and the target scope, address/tag range, protocol,
				>	or rate deviates from the established operational baseline.
				>	Suppress normal SCADA/HMI/historian polling, commissioning,
				>	asset inventory, backup, diagnostics, and approved engineeri
				>	ng activity.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ApprovedNetworkAnalysts', 'description': 'Accounts with documented network analysis/diagnostic responsibilities.'}, {'field': 'AuthorizedCaptureSoftware', 'description': 'Allowlist of approved packet capture tools and processes that legitimately load capture drivers.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:47:57.089000+00:00
description	Monitor for newly executed processes that can aid in sniffing network traffic to capture information about an environment. Monitor executed commands and arguments for actions that aid in sniffing network traffic to capture information about an environment.	Real-time monitoring identifies a process loading a packet capture driver or executing a known capture utility on an Industrial Control System (ICS) host's network interface, from a process or account not associated with documented network analysis responsibilities. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'Process', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3551476e-14f5-4e48-a518-e82135329e03', 'name': 'WinEventLog:Sysmon', 'channel': 'EventCode= 6 Npcap/WinPcap driver loaded by image not in authorized capture software'}
x_mitre_platforms[0]	None	Windows
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--685f917a-e95e-4ba0-ade1-c7d354dae6e0', 'name': 'Command', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 capture utility execution from account not in approved network analysts'}

[AN1933] Analytic 1933

Current version: 1.0

	Old Description			New Description
t	1	Monitor for a loss of network communications, which may indi	t	1	Real-time monitoring identifies an Industrial Control System
	>	cate a device has been shutdown or restarted. This will not		>	(ICS) protocol restart/reset command directed at a field de
	>	directly detect the technique’s execution, but instead may p		>	vice from a source not in the approved engineering workstati
	>	rovide additional evidence that the technique has been used		>	on list, particularly where multiple devices receive restart
	>	and may complement other detections. Device restarts and shu		>	commands within a short window. Documented precedent: Indus
	>	tdowns may be observable in device application logs. Monitor		>	troyer exploited CVE-2015-5374 via a crafted 18-byte User Da
	>	for unexpected device restarts or shutdowns. Devices may pr		>	tagram Protocol (UDP) packet to port 50000 on Siemens SIPROT
	>	oduce alarms about restarts or shutdowns. Monitor for unexpe		>	EC relays. OT operational-fidelity gate: Alert only when the
	>	cted device restarts or shutdowns. Monitor ICS automation pr		>	action is not attributable to an authorized operator/engine
	>	otocols for functions that restart or shutdown a device. Com		>	ering source for the specific target and function, and it is
	>	mands to restart or shutdown devices may also be observable		>	either outside an approved change/maintenance window or lac
	>	in traditional IT management protocols.		>	ks matching change-control context; where telemetry permits,
				>	require corroborating device, configuration, or process-sta
				>	te effect. Suppress activity that fully matches approved mai
				>	ntenance, commissioning, failover, recovery, or tested contr
				>	ol procedures.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'BulkRestartTimeWindow', 'description': 'Time window within which multiple device restarts are considered a coordinated event.'}, {'field': 'ChangeControlWindow', 'description': 'Scheduled maintenance periods during which restarts are authorized.'}, {'field': 'EngineeringWorkstationList', 'description': 'IP allowlist of workstations authorized to issue device restart commands.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:46:23.610000+00:00
description	Monitor for a loss of network communications, which may indicate a device has been shutdown or restarted. This will not directly detect the technique’s execution, but instead may provide additional evidence that the technique has been used and may complement other detections. Device restarts and shutdowns may be observable in device application logs. Monitor for unexpected device restarts or shutdowns. Devices may produce alarms about restarts or shutdowns. Monitor for unexpected device restarts or shutdowns. Monitor ICS automation protocols for functions that restart or shutdown a device. Commands to restart or shutdown devices may also be observable in traditional IT management protocols.	Real-time monitoring identifies an Industrial Control System (ICS) protocol restart/reset command directed at a field device from a source not in the approved engineering workstation list, particularly where multiple devices receive restart commands within a short window. Documented precedent: Industroyer exploited CVE-2015-5374 via a crafted 18-byte User Datagram Protocol (UDP) packet to port 50000 on Siemens SIPROTEC relays. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'Network Traffic', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9d56be63-3501-4dd3-bb5f-63c580833298', 'name': 'operationaldb:AlarmEvent', 'channel': 'more than one device generates restart/offline alarm within bulk restart time window without open maintenance ticket'}
x_mitre_platforms[0]	None	Embedded
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'Application Log', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'NSM:Content', 'channel': 'restart/reset service from source not in engineering workstation list outside change control window'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9d56be63-3501-4dd3-bb5f-63c580833298', 'name': 'Operational Databases', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'NSM:Content', 'channel': 'non-standard or malformed packet to device-specific diagnostic port immediately preceding a device-offline alarm'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'Network Traffic', 'channel': 'None'}

[AN1934] Analytic 1934

Current version: 1.0

	Old Description			New Description
t	1	Monitor ICS automation network protocols for information tha	t	1	Real-time monitoring identifies an Industrial Control System
	>	t an asset has been placed into Firmware Update Mode. Monito		>	(ICS) protocol message sequence placing a field device into
	>	r device alarms that indicate the devices has been placed in		>	firmware-update mode from a source not in the approved engi
	>	to Firmware Update Mode, although not all devices produce su		>	neering workstation list, correlated with the device's alarm
	>	ch alarms. Monitor asset log which may provide information t		>	telemetry going silent within a short grace period without
	>	hat an asset has been placed into Firmware Update Mode. Some		>	acknowledgment. Documented precedent: Industroyer exploited
	>	assets may log firmware updates themselves without logging		>	CVE-2015-5374 by sending a crafted packet that initiated an
	>	that the device has been placed into update mode.		>	incomplete firmware update sequence on Siemens Protection Te
				>	chnology (SIPROTEC) relays. OT operational-fidelity gate: Al
				>	ert only when the action is not attributable to an authorize
				>	d operator/engineering source for the specific target and fu
				>	nction, and it is either outside an approved change/maintena
				>	nce window or lacks matching change-control context; where t
				>	elemetry permits, require corroborating device, configuratio
				>	n, or process-state effect. Suppress activity that fully mat
				>	ches approved maintenance, commissioning, failover, recovery
				>	, or tested control procedures.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'AlarmSilenceGracePeriod', 'description': 'Time window within which alarm telemetry going silent following a mode-change message is considered directly connected.'}, {'field': 'AuthorizedFirmwareManagers', 'description': 'Accounts authorized to perform firmware update mode activation.'}, {'field': 'ChangeControlWindow', 'description': 'Scheduled maintenance periods during which firmware update mode activation is authorized.'}, {'field': 'EngineeringWorkstationList', 'description': 'IP allowlist of workstations authorized to activate firmware update mode.'}, {'field': 'MaintenanceWindowSchedule', 'description': 'Recurring scheduled periods when firmware update activities are expected.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:46:24.377000+00:00
description	Monitor ICS automation network protocols for information that an asset has been placed into Firmware Update Mode. Monitor device alarms that indicate the devices has been placed into Firmware Update Mode, although not all devices produce such alarms. Monitor asset log which may provide information that an asset has been placed into Firmware Update Mode. Some assets may log firmware updates themselves without logging that the device has been placed into update mode.	Real-time monitoring identifies an Industrial Control System (ICS) protocol message sequence placing a field device into firmware-update mode from a source not in the approved engineering workstation list, correlated with the device's alarm telemetry going silent within a short grace period without acknowledgment. Documented precedent: Industroyer exploited CVE-2015-5374 by sending a crafted packet that initiated an incomplete firmware update sequence on Siemens Protection Technology (SIPROTEC) relays. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'Network Traffic', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9d56be63-3501-4dd3-bb5f-63c580833298', 'name': 'operationaldb:AlarmEvent', 'channel': 'device_ip alarm telemetry goes silent within alarm silence grace period of the mode-activation message without operator acknowledgment'}
x_mitre_platforms[0]	None	Embedded
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9d56be63-3501-4dd3-bb5f-63c580833298', 'name': 'Operational Databases', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'NSM:Content', 'channel': 'firmware-update-mode activation service from source not in engineering workstation list outside change control window'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'Application Log', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'engineeringworkstation:ApplicationLog', 'channel': 'firmware update mode entry logged without corresponding change ticket reference'}

[AN1935] Analytic 1935

Current version: 1.0

	Old Description			New Description
t	1	Monitor for network traffic originating from unknown/unexpec	t	1	Real-time monitoring identifies authentication to an externa
	>	ted systems. Monitor authentication logs and analyze for unu		>	l remote access gateway using credentials associated with In
	>	sual access patterns, windows of activity, and access outsid		>	dustrial Control System (ICS)-role accounts, from a source g
	>	e of normal business hours, including use of [Valid Accounts		>	eolocation or Autonomous System Number (ASN) inconsistent wi
	>	](https://attack.mitre.org/techniques/T0859). When authentic		>	th the account's established usage pattern, immediately foll
	>	ation is not required to access an exposed remote service, m		>	owed by that session establishing connectivity into the ICS
	>	onitor for follow-on activities such as anomalous external u		>	network zone. Documented in VPNFilter, which specifically ta
	>	se of the exposed API or application.		>	rgeted routers and network edge devices. OT operational-fide
				>	lity gate: Alert only when the account/device/session violat
				>	es the approved identity + source host/jump path/zone policy
				>	and is corroborated by access to a protected OT asset, exec
				>	ution, configuration change, or another security-relevant fo
				>	llow-on event. Suppress approved shift activity, vendor supp
				>	ort, break-glass use, commissioning, and documented remote-a
				>	ccess windows.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ApprovedRemoteAccessOrigins', 'description': 'Documented geographic regions/ASNs from which legitimate ICS-role remote access is expected.'}, {'field': 'ExpectedSessionPattern', 'description': "Baseline of normal session timing/duration for each ICS-role account's remote access usage."}, {'field': 'RemoteAccessToICSWindow', 'description': 'Time window correlating VPN authentication with subsequent ICS-zone network access.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:45:42.856000+00:00
description	Monitor for network traffic originating from unknown/unexpected systems. Monitor authentication logs and analyze for unusual access patterns, windows of activity, and access outside of normal business hours, including use of [Valid Accounts](https://attack.mitre.org/techniques/T0859). When authentication is not required to access an exposed remote service, monitor for follow-on activities such as anomalous external use of the exposed API or application.	Real-time monitoring identifies authentication to an external remote access gateway using credentials associated with Industrial Control System (ICS)-role accounts, from a source geolocation or Autonomous System Number (ASN) inconsistent with the account's established usage pattern, immediately followed by that session establishing connectivity into the ICS network zone. Documented in VPNFilter, which specifically targeted routers and network edge devices. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'Network Traffic', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): connection from Virtual Private Network (VPN)-assigned Internet Protocol (IP) address into device subnet within remote access to Industrial Control Systems (ICS) window of the anomalous authentication'}
x_mitre_platforms[0]	None	Network Devices
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--39b9db72-8b48-4595-a18d-db5bbba3091b', 'name': 'Logon Session', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'vpn:applog', 'channel': 'session duration or command activity inconsistent with documented vendor support session profiles'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'Application Log', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--39b9db72-8b48-4595-a18d-db5bbba3091b', 'name': 'vpn:authlog', 'channel': 'Industrial Control Systems (ICS)-role account authentication from source geolocation/Autonomous System Number (ASN) not in approved remote access origins or outside expected session pattern'}

[AN1936] Analytic 1936

Current version: 1.0

	Old Description			New Description
t	1	Monitor network data for uncommon data flows (e.g., time of	t	1	Real-time monitoring identifies a remote service connection
	>	day, unusual source/destination address) that may be relate		>	between two Industrial Control System (ICS) network hosts th
	>	d to abuse of [Valid Accounts](https://attack.mitre.org/tech		>	at does not match the documented, approved communication mat
	>	niques/T0859) to log into a service specifically designed to		>	rix, where the destination host subsequently exhibits proces
	>	accept remote connections, such as RDP, Telnet, SSH, and VN		>	s execution or file access inconsistent with normal automate
	>	C. Monitor DLL file events, specifically creation of these f		>	d/scheduled inter-host communication. OT operational-fidelit
	>	iles as well as the loading of DLLs into processes specifica		>	y gate: Alert only when the account/device/session violates
	>	lly designed to accept remote connections, such as RDP, Teln		>	the approved identity + source host/jump path/zone policy an
	>	et, SSH, and VNC. Monitor for user accounts logged into syst		>	d is corroborated by access to a protected OT asset, executi
	>	ems they would not normally access or abnormal access patter		>	on, configuration change, or another security-relevant follo
	>	ns, such as multiple systems over a relatively short period		>	w-on event. Suppress approved shift activity, vendor support
	>	of time. Correlate use of login activity related to remote s		>	, break-glass use, commissioning, and documented remote-acce
	>	ervices with unusual behavior or other malicious or suspicio		>	ss windows.
	>	us activity. Adversaries will likely need to learn about an
	>	environment and the relationships between systems through Di
	>	scovery techniques prior to attempting Lateral Movement. For
	>	added context on adversary procedures and background see [R
	>	emote Services](https://attack.mitre.org/techniques/T1021) a
	>	nd applicable sub-techniques. Monitor for newly executed pro
	>	cesses related to services specifically designed to accept r
	>	emote connections, such as RDP, Telnet, SSH, and VNC. The ad
	>	versary may use [Valid Accounts](https://attack.mitre.org/te
	>	chniques/T0859) to login and may perform follow-on actions t
	>	hat spawn additional processes as the user. Monitor executed
	>	commands and arguments to services specifically designed to
	>	accept remote connections, such as RDP, Telnet, SSH, and VN
	>	C. The adversary may then perform these actions using [Valid
	>	Accounts](https://attack.mitre.org/techniques/T0859). Monit
	>	or for newly constructed network connections into a service
	>	specifically designed to accept remote connections, such as
	>	RDP, Telnet, SSH, and VNC. Monitor network connections invol
	>	ving common remote management protocols, such as ports tcp:3
	>	283 and tcp:5900, as well as ports tcp:3389 and tcp:22 for r
	>	emote logins. The adversary may use [Valid Accounts](https:/
	>	/attack.mitre.org/techniques/T0859) to enable remote logins.
	>	Monitor interactions with network shares, such as reads or
	>	file transfers, using remote services such as Server Message
	>	Block (SMB). For added context on adversary procedures and
	>	background see [Remote Services](https://attack.mitre.org/te
	>	chniques/T1021) and applicable sub-techniques.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ApprovedCommunicationMatrix', 'description': 'Comprehensive matrix of expected inter-host communication on remote service ports.'}, {'field': 'ApprovedLateralMovementPairs', 'description': 'Documented, approved host-to-host remote access pairs within the ICS network.'}]

values_changed
STIX Field	Old value	New Value
modified	2025-10-21 15:10:28.402000+00:00	2026-10-13 17:47:33.082000+00:00
description	Monitor network data for uncommon data flows (e.g., time of day, unusual source/destination address) that may be related to abuse of [Valid Accounts](https://attack.mitre.org/techniques/T0859) to log into a service specifically designed to accept remote connections, such as RDP, Telnet, SSH, and VNC. Monitor DLL file events, specifically creation of these files as well as the loading of DLLs into processes specifically designed to accept remote connections, such as RDP, Telnet, SSH, and VNC. Monitor for user accounts logged into systems they would not normally access or abnormal access patterns, such as multiple systems over a relatively short period of time. Correlate use of login activity related to remote services with unusual behavior or other malicious or suspicious activity. Adversaries will likely need to learn about an environment and the relationships between systems through Discovery techniques prior to attempting Lateral Movement. For added context on adversary procedures and background see [Remote Services](https://attack.mitre.org/techniques/T1021) and applicable sub-techniques. Monitor for newly executed processes related to services specifically designed to accept remote connections, such as RDP, Telnet, SSH, and VNC. The adversary may use [Valid Accounts](https://attack.mitre.org/techniques/T0859) to login and may perform follow-on actions that spawn additional processes as the user. Monitor executed commands and arguments to services specifically designed to accept remote connections, such as RDP, Telnet, SSH, and VNC. The adversary may then perform these actions using [Valid Accounts](https://attack.mitre.org/techniques/T0859). Monitor for newly constructed network connections into a service specifically designed to accept remote connections, such as RDP, Telnet, SSH, and VNC. Monitor network connections involving common remote management protocols, such as ports tcp:3283 and tcp:5900, as well as ports tcp:3389 and tcp:22 for remote logins. The adversary may use [Valid Accounts](https://attack.mitre.org/techniques/T0859) to enable remote logins. Monitor interactions with network shares, such as reads or file transfers, using remote services such as Server Message Block (SMB). For added context on adversary procedures and background see [Remote Services](https://attack.mitre.org/techniques/T1021) and applicable sub-techniques.	Real-time monitoring identifies a remote service connection between two Industrial Control System (ICS) network hosts that does not match the documented, approved communication matrix, where the destination host subsequently exhibits process execution or file access inconsistent with normal automated/scheduled inter-host communication. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'Network Traffic', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9ce98c86-8d30-4043-ba54-0784d478d0b5', 'name': 'WinEventLog:Security', 'channel': 'Windows Security Event ID 4624/4625: EventCode=4624, Type 3/10 between Industrial Control Systems (ICS) hosts not in approved lateral movement pairs'}
x_mitre_platforms[0]	None	Windows
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--c0a4a086-cc20-4e1e-b7cb-29d99dfa3fb1', 'name': 'Module', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba', 'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=3 on remote service ports (e.g., 22, 445, 3389, 5985/5986) between hosts not in approved communication matrix'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9ce98c86-8d30-4043-ba54-0784d478d0b5', 'name': 'Logon Session', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'WinEventLog:Sysmon', 'channel': 'Microsoft-Windows-Sysmon/Operational Event ID 1 ProcessCreate: Process execution within the remote session targeting Industrial Control Systems (ICS) application directories or device subnet connections'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'Process', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--685f917a-e95e-4ba0-ade1-c7d354dae6e0', 'name': 'Command', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba', 'name': 'Network Traffic', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--f5468e67-51c7-4756-9b4f-65707708e7fa', 'name': 'Network Share', 'channel': 'None'}

[AN2045] Analytic 2045

Current version: 1.0

	Old Description			New Description
t	1	Unauthorized messages may be detected by reviewing the conte	t	1	Real-time monitoring identifies an Industrial Control System
	>	nt of automation protocols, either through detecting based o		>	(ICS) protocol message arriving at a device from a source w
	>	n expected values or comparing to other out of band process		>	hose identity is not in the approved communication baseline
	>	data sources. Unauthorized messages may not precisely match		>	for that destination, where the message is structurally vali
	>	legitimate messages which may lead to malformed traffic, alt		>	d but originates outside the documented set of legitimate co
	>	hough traffic may be malformed for benign reasons. Monitor m		>	mmunicators. This technique-level analytic synthesizes Comma
	>	essages for changes in how they are constructed. Monitor fo		>	nd Message (T1692.001) and Reporting Message (T1692.002). OT
	>	r anomalous or unexpected messages that may result in change		>	operational-fidelity gate: Alert only when the action is no
	>	s to the process operation observable via asset application		>	t attributable to an authorized operator/engineering source
	>	logs (e.g., discrete write, logic and device configuration,		>	for the specific target and function, and it is either outsi
	>	mode changes, safety triggers). Consider monitoring for [Ro		>	de an approved change/maintenance window or lacks matching c
	>	gue Master](https://attack.mitre.org/techniques/T0848) and [		>	hange-control context; where telemetry permits, require corr
	>	Adversary-in-the-Middle](https://attack.mitre.org/techniques		>	oborating device, configuration, or process-state effect. Su
	>	/T0830) activity which may precede this technique.		>	ppress activity that fully matches approved maintenance, com
				>	missioning, failover, recovery, or tested control procedures
				>	.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ApprovedCommunicationBaseline', 'description': 'The complete, maintained inventory of every legitimate source-to-destination communication pair in the ICS environment.'}]

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.378000+00:00	2026-10-13 17:45:44.737000+00:00
description	Unauthorized messages may be detected by reviewing the content of automation protocols, either through detecting based on expected values or comparing to other out of band process data sources. Unauthorized messages may not precisely match legitimate messages which may lead to malformed traffic, although traffic may be malformed for benign reasons. Monitor messages for changes in how they are constructed. Monitor for anomalous or unexpected messages that may result in changes to the process operation observable via asset application logs (e.g., discrete write, logic and device configuration, mode changes, safety triggers). Consider monitoring for [Rogue Master](https://attack.mitre.org/techniques/T0848) and [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T0830) activity which may precede this technique.	Real-time monitoring identifies an Industrial Control System (ICS) protocol message arriving at a device from a source whose identity is not in the approved communication baseline for that destination, where the message is structurally valid but originates outside the documented set of legitimate communicators. This technique-level analytic synthesizes Command Message (T1692.001) and Reporting Message (T1692.002). OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'Network Traffic', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'netflow:ipfix', 'channel': 'IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): first-seen connection from a source to an Industrial Control System (ICS) device outside the documented approved communication matrix'}
x_mitre_platforms[0]	None	Embedded
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'Traffic', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'NSM:Content', 'channel': 'structurally valid Industrial Control System (ICS) protocol message from source not in approved communication baseline for the destination device_ip'}

[AN2046] Analytic 2046

Current version: 1.0

	Old Description			New Description
t	1	Monitor for the termination of processes or services associa	t	1	Real-time monitoring identifies iptables/nftables rule chang
	>	ted with ICS automation protocols and application software w		>	es on Industrial Control System (ICS) Linux gateways that se
	>	hich could help detect blocked communications. Monitor for		>	lectively block one ICS communication traffic type. OT opera
	>	lack of operational process data which may help identify a l		>	tional-fidelity gate: Alert only when the action is not attr
	>	oss of communications. This will not directly detect the tec		>	ibutable to an authorized operator/engineering source for th
	>	hnique’s execution, but instead may provide additional evide		>	e specific target and function, and it is either outside an
	>	nce that the technique has been used and may complement othe		>	approved change/maintenance window or lacks matching change-
	>	r detections. Monitor application logs for changes to setti		>	control context; where telemetry permits, require corroborat
	>	ngs and other events associated with network protocols that		>	ing device, configuration, or process-state effect. Suppress
	>	may be used to block communications. Monitor for a loss of		>	activity that fully matches approved maintenance, commissio
	>	network communications, which may indicate this technique is		>	ning, failover, recovery, or tested control procedures.
	>	being used. Monitor asset alarms which may help identify a
	>	loss of communications. Consider correlating alarms with ot
	>	her data sources that indicate traffic has been blocked, suc
	>	h as network traffic. In cases where alternative methods of
	>	communicating with outstations exist alarms may still be vis
	>	ible even if messages are blocked.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'CommunicationGapThreshold', 'description': 'Time threshold beyond the expected communication interval that constitutes a gap warranting investigation.'}]

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.382000+00:00	2026-10-13 17:44:21.233000+00:00
description	Monitor for the termination of processes or services associated with ICS automation protocols and application software which could help detect blocked communications. Monitor for lack of operational process data which may help identify a loss of communications. This will not directly detect the technique’s execution, but instead may provide additional evidence that the technique has been used and may complement other detections. Monitor application logs for changes to settings and other events associated with network protocols that may be used to block communications. Monitor for a loss of network communications, which may indicate this technique is being used. Monitor asset alarms which may help identify a loss of communications. Consider correlating alarms with other data sources that indicate traffic has been blocked, such as network traffic. In cases where alternative methods of communicating with outstations exist alarms may still be visible even if messages are blocked.	Real-time monitoring identifies iptables/nftables rule changes on Industrial Control System (ICS) Linux gateways that selectively block one ICS communication traffic type. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--61f1d40e-f3d0-4cc6-aa2d-937b6204194f', 'name': 'Process', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'auditd:SYSCALL', 'channel': 'Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; command line invokes iptables/nftables to change ICS traffic filtering or redirection outside the authorized network-administration baseline'}
x_mitre_platforms[0]	None	Linux

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--931b3fc6-ad68-42a8-9018-e98515eedc95', 'name': 'Operational Databases', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'Application Log', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'Network Traffic', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--4c12c1c8-bcef-4daf-8e5b-fca235f71d9e', 'name': 'Databases', 'channel': 'None'}

[AN2047] Analytic 2047

Current version: 1.0

	Old Description			New Description
t	1	Monitor for firmware changes which may be observable via ope	t	1	Real-time monitoring identifies the full firmware modificati
	>	rational alarms from devices. Monitor device application lo		>	on chain: a device entering firmware-update mode, receiving
	>	gs for firmware changes, although not all devices will produ		>	a large data transfer on a firmware-capable protocol port fr
	>	ce such logs. Monitor ICS management protocols / file trans		>	om a source not in the approved engineering workstation list
	>	fer protocols for protocol functions related to firmware cha		>	, rebooting, and reporting a post-reboot firmware hash that
	>	nges. Monitor firmware for unexpected changes. Asset manage		>	does not match the authorized inventory. This technique-leve
	>	ment systems should be consulted to understand known-good fi		>	l analytic synthesizes System Firmware (T1693.001) and Modul
	>	rmware versions. Dump and inspect BIOS images on vulnerable		>	e Firmware (T1693.002). OT operational-fidelity gate: Alert
	>	systems and compare against known good images.(Citation: MIT		>	only when the action is not attributable to an authorized op
	>	RE Copernicus) Analyze differences to determine if malicious		>	erator/engineering source for the specific target and functi
	>	changes have occurred. Log attempts to read/write to BIOS a		>	on, and it is either outside an approved change/maintenance
	>	nd compare against known patching behavior. Likewise, EFI mo		>	window or lacks matching change-control context; where telem
	>	dules can be collected and compared against a known-clean li		>	etry permits, require corroborating device, configuration, o
	>	st of EFI executable binaries to detect potentially maliciou		>	r process-state effect. Suppress activity that fully matches
	>	s modules. The CHIPSEC framework can be used for analysis to		>	approved maintenance, commissioning, failover, recovery, or
	>	determine if firmware modifications have been performed.(Ci		>	tested control procedures.
	>	tation: McAfee CHIPSEC Blog)(Citation: Github CHIPSEC)(Citat
	>	ion: Intel HackingTeam UEFI Rootkit)

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'AuthorizedFirmwareInventory', 'description': 'Cryptographic hash inventory of authorized firmware versions, covering both main processor and module-level firmware.'}, {'field': 'ChangeControlWindow', 'description': 'Scheduled maintenance periods during which firmware updates are authorized.'}, {'field': 'EngineeringWorkstationList', 'description': 'IP allowlist of workstations authorized to perform firmware updates.'}, {'field': 'FirmwareUpdateWindow', 'description': 'Time window within which a device reboot following a large transfer session is considered part of the same firmware update event.'}]

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.384000+00:00	2026-10-13 17:44:03.392000+00:00
description	Monitor for firmware changes which may be observable via operational alarms from devices. Monitor device application logs for firmware changes, although not all devices will produce such logs. Monitor ICS management protocols / file transfer protocols for protocol functions related to firmware changes. Monitor firmware for unexpected changes. Asset management systems should be consulted to understand known-good firmware versions. Dump and inspect BIOS images on vulnerable systems and compare against known good images.(Citation: MITRE Copernicus) Analyze differences to determine if malicious changes have occurred. Log attempts to read/write to BIOS and compare against known patching behavior. Likewise, EFI modules can be collected and compared against a known-clean list of EFI executable binaries to detect potentially malicious modules. The CHIPSEC framework can be used for analysis to determine if firmware modifications have been performed.(Citation: McAfee CHIPSEC Blog)(Citation: Github CHIPSEC)(Citation: Intel HackingTeam UEFI Rootkit)	Real-time monitoring identifies the full firmware modification chain: a device entering firmware-update mode, receiving a large data transfer on a firmware-capable protocol port from a source not in the approved engineering workstation list, rebooting, and reporting a post-reboot firmware hash that does not match the authorized inventory. This technique-level analytic synthesizes System Firmware (T1693.001) and Module Firmware (T1693.002). OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9d56be63-3501-4dd3-bb5f-63c580833298', 'name': 'Operational Databases', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b9d031bb-d150-4fc6-8025-688201bf3ffd', 'name': 'assetinventory:FirmwareHash', 'channel': 'post-reboot firmware hash (main processor or specific module) not in authorized firmware inventory'}
x_mitre_platforms[0]	None	Embedded
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'Application Log', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9d56be63-3501-4dd3-bb5f-63c580833298', 'name': 'operationaldb:AlarmEvent', 'channel': 'device reboot within firmware update window of the flagged transfer session'}
x_mitre_log_source_references[2]	{'x_mitre_data_component_ref': 'x-mitre-data-component--b9d031bb-d150-4fc6-8025-688201bf3ffd', 'name': 'Firmware', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'NSM:Content', 'channel': 'large session on firmware-capable port from source not in engineering workstation list outside change control window'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'Network Traffic', 'channel': 'None'}

[AN2048] Analytic 2048

Current version: 1.0

	Old Description			New Description
t	1	Monitor network traffic for insecure credential use in proto	t	1	Real-time monitoring identifies successful authentication to
	>	cols that allow unencrypted authentication. Monitor logon s		>	Windows-hosted Industrial Control System (ICS) applications
	>	essions for insecure credential use, when feasible.		>	using credentials matching known default or hardcoded vendo
				>	r passwords. OT operational-fidelity gate: Alert only when t
				>	he account/device/session violates the approved identity + s
				>	ource host/jump path/zone policy and is corroborated by acce
				>	ss to a protected OT asset, execution, configuration change,
				>	or another security-relevant follow-on event. Suppress appr
				>	oved shift activity, vendor support, break-glass use, commis
				>	sioning, and documented remote-access windows.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'DefaultVendorCredentialList', 'description': 'Documented default username/password combinations for all device models in the environment.'}, {'field': 'EngineeringWorkstationList', 'description': 'IP allowlist of legitimate authentication sources.'}, {'field': 'KnownHardcodedCredentialPatterns', 'description': 'Documented hardcoded credential values for in-use ICS products.'}]

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.375000+00:00	2026-10-13 17:47:34.740000+00:00
description	Monitor network traffic for insecure credential use in protocols that allow unencrypted authentication. Monitor logon sessions for insecure credential use, when feasible.	Real-time monitoring identifies successful authentication to Windows-hosted Industrial Control System (ICS) applications using credentials matching known default or hardcoded vendor passwords. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'Network Traffic', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9ce98c86-8d30-4043-ba54-0784d478d0b5', 'name': 'WinEventLog:Security', 'channel': 'Windows Security Event ID 4624/4625: EventCode=4624 for account matching default or hardcoded credential patterns from source not in approved host list'}
x_mitre_platforms[0]	None	Windows

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--9ce98c86-8d30-4043-ba54-0784d478d0b5', 'name': 'Logon Session', 'channel': 'None'}

[AN2049] Analytic 2049

Current version: 1.0

	Old Description			New Description
t	1	Monitor for unexpected changes to project files, although if	t	1	Configured Windows object-access monitoring identifies a wri
	>	the malicious modification occurs in tandem with legitimate		>	te to a Siemens project file by a process that is not the Si
	>	changes it will be difficult to isolate the unintended chan		>	emens Totally Integrated Automation (TIA) Portal or Step7 en
	>	ges by analyzing only file systems modifications.		>	gineering software, or by the legitimate Siemens tool immedi
				>	ately after loading a project from an untrusted path. Direct
				>	ly documented as a Stuxnet mechanism. OT operational-fidelit
				>	y gate: Alert only when execution violates an approved signe
				>	r/hash/path/parent/process or tool allowlist, or originates
				>	from an unauthorized user/tool, and is tied to an OT asset o
				>	r follow-on OT-relevant action. Suppress vendor-signed softw
				>	are, approved engineering utilities, diagnostics, patching,
				>	backup, and documented maintenance. Collection requirement:
				>	use Windows Security Event ID 4663 with Object Access auditi
				>	ng and SACLs on approved project repositories; Sysmon FileCr
				>	eate events can corroborate writes/overwrites but do not rep
				>	ort generic file-open/read activity.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ApprovedProjectRepository', 'description': 'Documented, trusted source location(s) for Siemens project files.'}]

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.378000+00:00	2026-10-13 17:47:59.527000+00:00
description	Monitor for unexpected changes to project files, although if the malicious modification occurs in tandem with legitimate changes it will be difficult to isolate the unintended changes by analyzing only file systems modifications.	Configured Windows object-access monitoring identifies a write to a Siemens project file by a process that is not the Siemens Totally Integrated Automation (TIA) Portal or Step7 engineering software, or by the legitimate Siemens tool immediately after loading a project from an untrusted path. Directly documented as a Stuxnet mechanism. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance. Collection requirement: use Windows Security Event ID 4663 with Object Access auditing and SACLs on approved project repositories; Sysmon FileCreate events can corroborate writes/overwrites but do not report generic file-open/read activity.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--84572de3-9583-4c73-aabd-06ea88123dd8', 'name': 'File', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--235b7491-2d2b-4617-9a52-3c0783680f71', 'name': 'WinEventLog:Security', 'channel': 'Windows Security Event ID 4663 (requires Object Access auditing/SACL): Siemens engineering process reads/opens project file from unapproved repository/removable-media/network-share path'}
x_mitre_platforms[0]	None	Windows

iterable_item_added
STIX Field	Old value	New Value
x_mitre_log_source_references		{'x_mitre_data_component_ref': 'x-mitre-data-component--84572de3-9583-4c73-aabd-06ea88123dd8', 'name': 'WinEventLog:Sysmon', 'channel': 'Siemens engineering tool opens project file from path not in approved project repository'}

[AN2050] Analytic 2050

Current version: 1.0

	Old Description			New Description
t	1	Monitor for new processes engaging in scanning activity or c	t	1	Real-time monitoring identifies execution of port scanning u
	>	onnecting to multiple systems by correlating process creatio		>	tilities (nmap, masscan) with arguments targeting Industrial
	>	n network data. Monitor for hosts enumerating network conne		>	Control System (ICS) protocol port ranges on an ICS Windows
	>	cted resources using non-ICS enterprise protocols.		>	host. OT operational-fidelity gate: Do not alert on novelty
				>	, scan/read volume, or enumeration alone. Alert when the sou
				>	rce role is not authorized for discovery/polling and the tar
				>	get scope, address/tag range, protocol, or rate deviates fro
				>	m the established operational baseline. Suppress normal SCAD
				>	A/HMI/historian polling, commissioning, asset inventory, bac
				>	kup, diagnostics, and approved engineering activity.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ApprovedSCADAServers', 'description': 'IP allowlist of legitimate sources.'}, {'field': 'PortScanTimeWindow', 'description': 'Time window within which connections across multiple ports are considered a single scan event.'}]

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.377000+00:00	2026-10-13 17:48:00.318000+00:00
description	Monitor for new processes engaging in scanning activity or connecting to multiple systems by correlating process creation network data. Monitor for hosts enumerating network connected resources using non-ICS enterprise protocols.	Real-time monitoring identifies execution of port scanning utilities (nmap, masscan) with arguments targeting Industrial Control System (ICS) protocol port ranges on an ICS Windows host. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'Network Traffic', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1 of port scanning utility with arguments targeting Industrial Control Systems (ICS) protocol port ranges'}
x_mitre_platforms[0]	None	Windows

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'Traffic', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'Process', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba', 'name': 'Network', 'channel': 'None'}

[AN2051] Analytic 2051

Current version: 1.0

	Old Description			New Description
t	1	Monitor for anomalies related to discovery related ICS funct	t	1	Real-time monitoring identifies new Internet Group Managemen
	>	ions, including devices that have not previously used these		>	t Protocol (IGMP) joins or broadcast traffic spikes on Indus
	>	functions or for functions being sent to many outstations. M		>	trial Control System (ICS) Virtual Local Area Networks (VLAN
	>	onitor for new ICS protocol connections to existing assets o		>	s) from a source not in the approved device inventory. OT op
	>	r for device scanning (i.e., a host connecting to many devic		>	erational-fidelity gate: Do not alert on novelty, scan/read
	>	es) over ICS and enterprise protocols (e.g., ICMP, DCOM, Win		>	volume, or enumeration alone. Alert when the source role is
	>	RM). For added context on adversary enterprise procedures an		>	not authorized for discovery/polling and the target scope, a
	>	d background see [Remote System Discovery](https://attack.mi		>	ddress/tag range, protocol, or rate deviates from the establ
	>	tre.org/techniques/T1018).		>	ished operational baseline. Suppress normal SCADA/HMI/histor
				>	ian polling, commissioning, asset inventory, backup, diagnos
				>	tics, and approved engineering activity.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ApprovedDeviceInventory', 'description': 'MAC address inventory of devices authorized on the ICS network segment.'}]

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.384000+00:00	2026-10-13 17:45:52.486000+00:00
description	Monitor for anomalies related to discovery related ICS functions, including devices that have not previously used these functions or for functions being sent to many outstations. Monitor for new ICS protocol connections to existing assets or for device scanning (i.e., a host connecting to many devices) over ICS and enterprise protocols (e.g., ICMP, DCOM, WinRM). For added context on adversary enterprise procedures and background see [Remote System Discovery](https://attack.mitre.org/techniques/T1018).	Real-time monitoring identifies new Internet Group Management Protocol (IGMP) joins or broadcast traffic spikes on Industrial Control System (ICS) Virtual Local Area Networks (VLANs) from a source not in the approved device inventory. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'Traffic', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'networkdevice:snmp', 'channel': 'new Internet Group Management Protocol (IGMP) join or broadcast traffic spike on Industrial Control Systems (ICS) Virtual Local Area Network (VLAN) from source not in approved device inventory'}
x_mitre_platforms[0]	None	Network Devices

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'Network Traffic', 'channel': 'None'}

[AN2052] Analytic 2052

Current version: 1.0

	Old Description			New Description
t	1	Monitor for anomalies related to discovery related ICS funct	t	1	Real-time monitoring identifies Internet Group Management Pr
	>	ions, including devices that have not previously used these		>	otocol (IGMP) membership reports for Industrial Control Syst
	>	functions or for functions being sent to many outstations.		>	em (ICS) multicast groups from a source not in the approved
	>	Monitor for new ICS protocol connections to existing assets		>	device inventory. OT operational-fidelity gate: Do not alert
	>	or for device scanning (i.e., a host connecting to many devi		>	on novelty, scan/read volume, or enumeration alone. Alert w
	>	ces) over ICS and enterprise protocols (e.g., ICMP, DCOM, Wi		>	hen the source role is not authorized for discovery/polling
	>	nRM). For added context on adversary enterprise procedures a		>	and the target scope, address/tag range, protocol, or rate d
	>	nd background see [Remote System Discovery](https://attack.m		>	eviates from the established operational baseline. Suppress
	>	itre.org/techniques/T1018).		>	normal SCADA/HMI/historian polling, commissioning, asset inv
				>	entory, backup, diagnostics, and approved engineering activi
				>	ty.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ApprovedDeviceInventory', 'description': 'MAC address inventory of devices authorized to subscribe to ICS multicast groups.'}]

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.378000+00:00	2026-10-13 17:45:53.254000+00:00
description	Monitor for anomalies related to discovery related ICS functions, including devices that have not previously used these functions or for functions being sent to many outstations. Monitor for new ICS protocol connections to existing assets or for device scanning (i.e., a host connecting to many devices) over ICS and enterprise protocols (e.g., ICMP, DCOM, WinRM). For added context on adversary enterprise procedures and background see [Remote System Discovery](https://attack.mitre.org/techniques/T1018).	Real-time monitoring identifies Internet Group Management Protocol (IGMP) membership reports for Industrial Control System (ICS) multicast groups from a source not in the approved device inventory. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'Traffic', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'networkdevice:snmp', 'channel': 'Internet Group Management Protocol (IGMP) membership report for Industrial Control Systems (ICS) multicast group from source not in approved device inventory'}
x_mitre_platforms[0]	None	Network Devices

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'Network Traffic', 'channel': 'None'}

[AN2053] Analytic 2053

Current version: 1.0

	Old Description			New Description
t	1	Monitor asset alarms which may help identify a loss of commu	t	1	Real-time monitoring identifies a network infrastructure con
	>	nications. Consider correlating alarms with other data sourc		>	figuration change that results in a communication gap betwee
	>	es that indicate traffic has been blocked, such as network t		>	n previously-connected Industrial Control System (ICS) zones
	>	raffic. In cases where alternative methods of communicating		>	, from a source not in the approved network administration l
	>	with outstations exist, alarms may still be visible even if		>	ist. This technique-level analytic synthesizes Serial COM (T
	>	messages are blocked. Monitor for a loss of network communi		>	1695.001), Ethernet (T1695.002), and Wi-Fi (T1695.003). OT o
	>	cations, which may indicate this technique is being used. M		>	perational-fidelity gate: Alert only when the action is not
	>	onitor for lack of operational process data which may help i		>	attributable to an authorized operator/engineering source fo
	>	dentify a loss of communications. This will not directly det		>	r the specific target and function, and it is either outside
	>	ect the technique’s execution but instead may provide additi		>	an approved change/maintenance window or lacks matching cha
	>	onal evidence that the technique has been used and may compl		>	nge-control context; where telemetry permits, require corrob
	>	ement other detections. Monitor application logs for change		>	orating device, configuration, or process-state effect. Supp
	>	s to settings and other events associated with network proto		>	ress activity that fully matches approved maintenance, commi
	>	cols that may be used to block communications. Monitor for		>	ssioning, failover, recovery, or tested control procedures.
	>	the termination of processes or services associated with ICS
	>	automation protocols and application software which could h
	>	elp detect blocked communications.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ApprovedNMSCIDR', 'description': 'IP ranges authorized for network infrastructure configuration changes.'}, {'field': 'ChangeControlWindow', 'description': 'Scheduled maintenance periods during which connectivity-affecting changes are authorized.'}, {'field': 'CommBlockCorrelationWindow', 'description': 'Time window correlating a configuration change with subsequent communication loss.'}]

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.377000+00:00	2026-10-13 17:46:09.218000+00:00
description	Monitor asset alarms which may help identify a loss of communications. Consider correlating alarms with other data sources that indicate traffic has been blocked, such as network traffic. In cases where alternative methods of communicating with outstations exist, alarms may still be visible even if messages are blocked. Monitor for a loss of network communications, which may indicate this technique is being used. Monitor for lack of operational process data which may help identify a loss of communications. This will not directly detect the technique’s execution but instead may provide additional evidence that the technique has been used and may complement other detections. Monitor application logs for changes to settings and other events associated with network protocols that may be used to block communications. Monitor for the termination of processes or services associated with ICS automation protocols and application software which could help detect blocked communications.	Real-time monitoring identifies a network infrastructure configuration change that results in a communication gap between previously-connected Industrial Control System (ICS) zones, from a source not in the approved network administration list. This technique-level analytic synthesizes Serial COM (T1695.001), Ethernet (T1695.002), and Wi-Fi (T1695.003). OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--4c12c1c8-bcef-4daf-8e5b-fca235f71d9e', 'name': 'Operational Databases', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'networkdevice:syslog', 'channel': 'Access Control List (ACL)/firewall/routing configuration change from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet outside change control window'}
x_mitre_platforms[0]	None	Network Devices
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'Network Traffic', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--4c12c1c8-bcef-4daf-8e5b-fca235f71d9e', 'name': 'operationaldb:AlarmEvent', 'channel': 'communication-loss alarm for affected devices within comm block correlation window of the flagged configuration change'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--931b3fc6-ad68-42a8-9018-e98515eedc95', 'name': 'Databases', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'Application Log', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--61f1d40e-f3d0-4cc6-aa2d-937b6204194f', 'name': 'Process', 'channel': 'None'}

[AN2054] Analytic 2054

Current version: 1.0

	Old Description			New Description
t	1	Monitor asset alarms which may help identify a loss of commu	t	1	Real-time monitoring identifies a Windows network-adapter di
	>	nications. Consider correlating alarms with other data sourc		>	sable or administrative interface-down event on an ICS gatew
	>	es that indicate traffic has been blocked, such as network t		>	ay or protocol-converter host outside the approved network-m
	>	raffic. In cases where alternative methods of communicating		>	aintenance window. OT operational-fidelity gate: Alert only
	>	with outstations exist, alarms may still be visible even if		>	when the action is not attributable to an authorized operato
	>	Ethernet messages are blocked. Monitor for a loss of networ		>	r/engineering source for the specific target and function, a
	>	k communications, which may indicate this technique is being		>	nd it is either outside an approved change/maintenance windo
	>	used. Monitor for lack of operational process data which m		>	w or lacks matching change-control context; where telemetry
	>	ay help identify a loss of communications. This will not dir		>	permits, require corroborating device, configuration, or pro
	>	ectly detect the technique’s execution but instead may provi		>	cess-state effect. Suppress activity that fully matches appr
	>	de additional evidence that the technique has been used and		>	oved maintenance, commissioning, failover, recovery, or test
	>	may complement other detections. Monitor application logs f		>	ed control procedures.
	>	or changes to settings and other events associated with netw
	>	ork protocols that may be used to block communications. Mon
	>	itor for the termination of processes or services associated
	>	with ICS automation protocols and application software whic
	>	h could help detect blocked communications.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ApprovedNMSCIDR', 'description': 'IP ranges authorized for switch configuration changes.'}, {'field': 'ChangeControlWindow', 'description': 'Scheduled maintenance periods during which interface configuration changes are authorized.'}]

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.383000+00:00	2026-10-13 17:48:03.255000+00:00
description	Monitor asset alarms which may help identify a loss of communications. Consider correlating alarms with other data sources that indicate traffic has been blocked, such as network traffic. In cases where alternative methods of communicating with outstations exist, alarms may still be visible even if Ethernet messages are blocked. Monitor for a loss of network communications, which may indicate this technique is being used. Monitor for lack of operational process data which may help identify a loss of communications. This will not directly detect the technique’s execution but instead may provide additional evidence that the technique has been used and may complement other detections. Monitor application logs for changes to settings and other events associated with network protocols that may be used to block communications. Monitor for the termination of processes or services associated with ICS automation protocols and application software which could help detect blocked communications.	Real-time monitoring identifies a Windows network-adapter disable or administrative interface-down event on an ICS gateway or protocol-converter host outside the approved network-maintenance window. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--4c12c1c8-bcef-4daf-8e5b-fca235f71d9e', 'name': 'Operational Databases', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'WinEventLog:System', 'channel': 'network adapter disabled on Industrial Control Systems (ICS) gateway host by process not in authorized network admins'}
x_mitre_platforms[0]	None	Windows

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'Network Traffic', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--931b3fc6-ad68-42a8-9018-e98515eedc95', 'name': 'Databases', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'Application Log', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--61f1d40e-f3d0-4cc6-aa2d-937b6204194f', 'name': 'Process', 'channel': 'None'}

[AN2055] Analytic 2055

Current version: 1.0

	Old Description			New Description
t	1	Monitor asset alarms which may help identify a loss of commu	t	1	Real-time monitoring identifies wireless controller manageme
	>	nications. Consider correlating alarms with other data sourc		>	nt log entries showing Service Set Identifier (SSID) or Medi
	>	es that indicate traffic has been blocked, such as network t		>	a Access Control (MAC) address filter configuration changes
	>	raffic. In cases where alternative methods of communicating		>	for the Industrial Control System (ICS) wireless network fro
	>	with outstations exist, alarms may still be visible even if		>	m an account not in the authorized wireless admins. OT opera
	>	Wi-Fi messages are blocked. Monitor for a loss of network c		>	tional-fidelity gate: Alert only when the action is not attr
	>	ommunications, which may indicate this technique is being us		>	ibutable to an authorized operator/engineering source for th
	>	ed. Monitor for lack of operational process data which may		>	e specific target and function, and it is either outside an
	>	help identify a loss of communications. This will not direct		>	approved change/maintenance window or lacks matching change-
	>	ly detect the technique’s execution, but instead may provide		>	control context; where telemetry permits, require corroborat
	>	additional evidence that the technique has been used and ma		>	ing device, configuration, or process-state effect. Suppress
	>	y complement other detections. Monitor application logs for		>	activity that fully matches approved maintenance, commissio
	>	changes to settings and other events associated with networ		>	ning, failover, recovery, or tested control procedures.
	>	k protocols that may be used to block communications. Monit
	>	or for the termination of processes or services associated w
	>	ith ICS automation protocols and application software which
	>	could help detect blocked communications.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ApprovedWirelessAdminList', 'description': 'Accounts/sources authorized to modify wireless infrastructure configuration.'}, {'field': 'DeauthTimeWindow', 'description': 'Time window within which multiple deauthentication events are considered a coordinated mass event.'}, {'field': 'MassDeauthThreshold', 'description': 'Number of simultaneously deauthenticated enrolled devices that constitutes a mass event.'}]

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.375000+00:00	2026-10-13 17:47:22.362000+00:00
description	Monitor asset alarms which may help identify a loss of communications. Consider correlating alarms with other data sources that indicate traffic has been blocked, such as network traffic. In cases where alternative methods of communicating with outstations exist, alarms may still be visible even if Wi-Fi messages are blocked. Monitor for a loss of network communications, which may indicate this technique is being used. Monitor for lack of operational process data which may help identify a loss of communications. This will not directly detect the technique’s execution, but instead may provide additional evidence that the technique has been used and may complement other detections. Monitor application logs for changes to settings and other events associated with network protocols that may be used to block communications. Monitor for the termination of processes or services associated with ICS automation protocols and application software which could help detect blocked communications.	Real-time monitoring identifies wireless controller management log entries showing Service Set Identifier (SSID) or Media Access Control (MAC) address filter configuration changes for the Industrial Control System (ICS) wireless network from an account not in the authorized wireless admins. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--4c12c1c8-bcef-4daf-8e5b-fca235f71d9e', 'name': 'Operational Databases', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'WinEventLog:Application', 'channel': 'wireless controller management log: SSID or MAC filter config change from account not in authorized wireless admins'}
x_mitre_platforms[0]	None	Windows

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a', 'name': 'Network Traffic', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--931b3fc6-ad68-42a8-9018-e98515eedc95', 'name': 'Databases', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'Application Log', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--61f1d40e-f3d0-4cc6-aa2d-937b6204194f', 'name': 'Process', 'channel': 'None'}

[AN2056] Analytic 2056

Current version: 1.0

	Old Description			New Description
t	1	Monitor device alarms for program downloads, although not al	t	1	Real-time monitoring identifies an Industrial Control System
	>	l devices produce such alarms. Monitor for protocol functio		>	(ICS) protocol session reading back the complete program, c
	>	ns related to program download or modification. Program down		>	onfiguration, and data block set from a field device in a si
	>	loads may be observable in ICS automation protocols and remo		>	ngle session from a source not in the approved engineering w
	>	te management protocols. Consult asset management systems t		>	orkstation list, distinguished from a partial Program Upload
	>	o understand expected program versions. Monitor devices con		>	by the comprehensiveness of the read. OT operational-fideli
	>	figuration logs which may contain alerts that indicate wheth		>	ty gate: Alert only when the action is not attributable to a
	>	er a program download has occurred. Devices may maintain app		>	n authorized operator/engineering source for the specific ta
	>	lication logs that indicate whether a full program download,		>	rget and function, and it is either outside an approved chan
	>	online edit, or program append function has occurred.		>	ge/maintenance window or lacks matching change-control conte
				>	xt; where telemetry permits, require corroborating device, c
				>	onfiguration, or process-state effect. Suppress activity tha
				>	t fully matches approved maintenance, commissioning, failove
				>	r, recovery, or tested control procedures.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'BackupWindowSchedule', 'description': 'Scheduled periods during which routine full backups are expected.'}, {'field': 'EngineeringWorkstationList', 'description': 'IP allowlist of workstations authorized to perform full program uploads.'}, {'field': 'FullUploadSizeThreshold', 'description': 'Byte count threshold distinguishing a full program upload from a partial/diagnostic read.'}]

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.383000+00:00	2026-10-13 17:47:07.989000+00:00
description	Monitor device alarms for program downloads, although not all devices produce such alarms. Monitor for protocol functions related to program download or modification. Program downloads may be observable in ICS automation protocols and remote management protocols. Consult asset management systems to understand expected program versions. Monitor devices configuration logs which may contain alerts that indicate whether a program download has occurred. Devices may maintain application logs that indicate whether a full program download, online edit, or program append function has occurred.	Real-time monitoring identifies an Industrial Control System (ICS) protocol session reading back the complete program, configuration, and data block set from a field device in a single session from a source not in the approved engineering workstation list, distinguished from a partial Program Upload by the comprehensiveness of the read. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9d56be63-3501-4dd3-bb5f-63c580833298', 'name': 'Operational Databases', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'NSM:Content', 'channel': 'S7comm Upload ALL or Common Industrial Protocol (CIP) full program upload from source not in engineering workstation list, bytes_recv exceeding full upload size threshold'}
x_mitre_platforms[0]	None	Embedded
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'Traffic', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'engineeringworkstation:ApplicationLog', 'channel': 'full upload session outside backup window schedule without documented backup purpose'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--b05a614b-033c-4578-b4f2-c63a9feee706', 'name': 'Asset', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'Application Log', 'channel': 'None'}

[AN2057] Analytic 2057

Current version: 1.0

	Old Description			New Description
t	1	Monitor device alarms for program downloads, although not al	t	1	Real-time monitoring identifies an Industrial Control System
	>	l devices produce such alarms. Monitor for protocol functio		>	(ICS) protocol session adding new program blocks or routine
	>	ns related to program download or modification. Program down		>	s to an existing controller program without replacing existi
	>	loads may be observable in ICS automation protocols and remo		>	ng logic, from a source not in the approved engineering work
	>	te management protocols. Consult asset management systems t		>	station list, correlated against the device's program invent
	>	o understand expected program versions. Monitor devices con		>	ory showing a size increase without a corresponding planned
	>	figuration logs which may contain alerts that indicate wheth		>	update. OT operational-fidelity gate: Alert only when the ac
	>	er a program download has occurred. Devices may maintain app		>	tion is not attributable to an authorized operator/engineeri
	>	lication logs that indicate whether a full program download,		>	ng source for the specific target and function, and it is ei
	>	online edit, or program append function has occurred.		>	ther outside an approved change/maintenance window or lacks
				>	matching change-control context; where telemetry permits, re
				>	quire corroborating device, configuration, or process-state
				>	effect. Suppress activity that fully matches approved mainte
				>	nance, commissioning, failover, recovery, or tested control
				>	procedures.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'EngineeringWorkstationList', 'description': 'IP allowlist of workstations authorized to append program blocks.'}]

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.376000+00:00	2026-10-13 17:44:07.110000+00:00
description	Monitor device alarms for program downloads, although not all devices produce such alarms. Monitor for protocol functions related to program download or modification. Program downloads may be observable in ICS automation protocols and remote management protocols. Consult asset management systems to understand expected program versions. Monitor devices configuration logs which may contain alerts that indicate whether a program download has occurred. Devices may maintain application logs that indicate whether a full program download, online edit, or program append function has occurred.	Real-time monitoring identifies an Industrial Control System (ICS) protocol session adding new program blocks or routines to an existing controller program without replacing existing logic, from a source not in the approved engineering workstation list, correlated against the device's program inventory showing a size increase without a corresponding planned update. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9d56be63-3501-4dd3-bb5f-63c580833298', 'name': 'Operational Databases', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b05a614b-033c-4578-b4f2-c63a9feee706', 'name': 'assetinventory:ProgramSize', 'channel': 'device program size/block count increases without corresponding change ticket reference'}
x_mitre_platforms[0]	None	Embedded
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'Traffic', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'NSM:Content', 'channel': 'download of block address not previously present in device program inventory, from source not in engineering workstation list'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--b05a614b-033c-4578-b4f2-c63a9feee706', 'name': 'Asset', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'Application Log', 'channel': 'None'}

[AN2058] Analytic 2058

Current version: 1.0

	Old Description			New Description
t	1	Monitor device alarms for program downloads, although not al	t	1	Real-time monitoring identifies an Industrial Control System
	>	l devices produce such alarms. Monitor for protocol functio		>	(ICS) online-edit command sequence (incremental program mod
	>	ns related to program download or modification. Program down		>	ification while the device remains in RUN mode) from a sourc
	>	loads may be observable in ICS automation protocols and remo		>	e not in the approved engineering workstation list, outside
	>	te management protocols. Consult asset management systems t		>	a scheduled change-control window. OT operational-fidelity g
	>	o understand expected program versions. Monitor devices con		>	ate: Alert only when the action is not attributable to an au
	>	figuration logs which may contain alerts that indicate wheth		>	thorized operator/engineering source for the specific target
	>	er a program download has occurred. Devices may maintain app		>	and function, and it is either outside an approved change/m
	>	lication logs that indicate whether a full program download,		>	aintenance window or lacks matching change-control context;
	>	online edit, or program append function has occurred.		>	where telemetry permits, require corroborating device, confi
				>	guration, or process-state effect. Suppress activity that fu
				>	lly matches approved maintenance, commissioning, failover, r
				>	ecovery, or tested control procedures.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'ChangeControlWindow', 'description': 'Scheduled maintenance periods during which online edits are authorized.'}, {'field': 'EngineeringWorkstationList', 'description': 'IP allowlist of workstations authorized to perform online edits.'}]

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.376000+00:00	2026-10-13 17:47:08.790000+00:00
description	Monitor device alarms for program downloads, although not all devices produce such alarms. Monitor for protocol functions related to program download or modification. Program downloads may be observable in ICS automation protocols and remote management protocols. Consult asset management systems to understand expected program versions. Monitor devices configuration logs which may contain alerts that indicate whether a program download has occurred. Devices may maintain application logs that indicate whether a full program download, online edit, or program append function has occurred.	Real-time monitoring identifies an Industrial Control System (ICS) online-edit command sequence (incremental program modification while the device remains in RUN mode) from a source not in the approved engineering workstation list, outside a scheduled change-control window. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--9d56be63-3501-4dd3-bb5f-63c580833298', 'name': 'Operational Databases', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'NSM:Content', 'channel': 'online block edit service from source not in engineering workstation list outside change control window, with device remaining in RUN mode throughout'}
x_mitre_platforms[0]	None	Embedded
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c', 'name': 'Traffic', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'engineeringworkstation:ApplicationLog', 'channel': 'online edit session logged without corresponding change ticket reference'}

iterable_item_removed
STIX Field	Old value	New Value
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--b05a614b-033c-4578-b4f2-c63a9feee706', 'name': 'Asset', 'channel': 'None'}
x_mitre_log_source_references	{'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'Application Log', 'channel': 'None'}

[AN2066] Analytic 2066

Current version: 1.0

	Old Description			New Description
t	1	Monitor for newly constructed drive letters or mount points	t	1	Real-time monitoring identifies a field device loading a mod
	>	to removable media. Monitor for newly executed processes tha		>	ified autorun image (boot read-only memory, bootloader firmw
	>	t execute from removable media after it is mounted or when i		>	are) detected by a discrepancy between the device's declared
	>	nitiated by a user.		>	firmware hash and the authorized firmware inventory hash, w
				>	ith post-reboot device behavior diverging from expected (une
				>	xpected protocols active, unanticipated network connections)
				>	. OT operational-fidelity gate: Alert only when execution vi
				>	olates an approved signer/hash/path/parent/process or tool a
				>	llowlist, or originates from an unauthorized user/tool, and
				>	is tied to an OT asset or follow-on OT-relevant action. Supp
				>	ress vendor-signed software, approved engineering utilities,
				>	diagnostics, patching, backup, and documented maintenance.

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_mutable_elements		[{'field': 'AuthorizedICSSoftwareInventory', 'description': 'Inventory of binaries legitimately authorized to be referenced by autorun/startup mechanisms on ICS hosts.'}, {'field': 'AutorunModificationWindow', 'description': 'Time window correlating removable media insertion with a subsequent autorun configuration change.'}]

values_changed
STIX Field	Old value	New Value
modified	2026-05-12 16:30:18.376000+00:00	2026-10-13 17:44:01.245000+00:00
description	Monitor for newly constructed drive letters or mount points to removable media. Monitor for newly executed processes that execute from removable media after it is mounted or when initiated by a user.	Real-time monitoring identifies a field device loading a modified autorun image (boot read-only memory, bootloader firmware) detected by a discrepancy between the device's declared firmware hash and the authorized firmware inventory hash, with post-reboot device behavior diverging from expected (unexpected protocols active, unanticipated network connections). OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.
x_mitre_log_source_references[0]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d6e6b3b-4aa8-40e1-8c47-91db0f313d9f', 'name': 'Drive', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--b9d031bb-d150-4fc6-8025-688201bf3ffd', 'name': 'assetinventory:FirmwareHash', 'channel': 'device firmware hash does not match authorized firmware inventory following a reboot event'}
x_mitre_platforms[0]	None	Embedded
x_mitre_log_source_references[1]	{'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'Process', 'channel': 'None'}	{'x_mitre_data_component_ref': 'x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba', 'name': 'NSM:Connections', 'channel': 'device establishes new network connections or activates protocols not seen in pre-reboot baseline'}