1. Home
  2. Matrices
  3. Mobile
  4. iOS

iOS Matrix

Below are the tactics and techniques representing the MITRE ATT&CK® iOS platform. The techniques below are known to target mobile devices running iOS operating systems. The Matrix contains information for the iOS platform.

View on the ATT&CK® Navigator
Version Permalink
Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command and Control Exfiltration Impact
7 techniques 3 techniques 3 techniques 2 techniques 9 techniques 4 techniques 7 techniques 2 techniques 10 techniques 8 techniques 2 techniques 3 techniques
Application Versioning
Drive-By Compromise
Exploitation for Initial Access
Lockscreen Bypass
Phishing
Replication Through Removable Media
Supply Chain Compromise (3)
=
Command and Scripting Interpreter (1)
=
Exploitation for Client Execution
Scheduled Task/Job
Boot or Logon Initialization Scripts
Compromise Client Software Binary
Scheduled Task/Job
Exploitation for Privilege Escalation
Process Injection (1)
=
Application Versioning
Download New Code at Runtime
Execution Guardrails (1)
=
Indicator Removal on Host (1)
=
Masquerading (1)
=
Obfuscated Files or Information (1)
=
Process Injection (1)
=
Subvert Trust Controls (1)
=
Virtualization/Sandbox Evasion (1)
=
Clipboard Data
Credentials from Password Store (1)
=
Input Capture (2)
=
Steal Application Access Token (1)
=
File and Directory Discovery
Location Tracking (2)
=
Network Service Scanning
Process Discovery
Software Discovery (1)
=
System Information Discovery
System Network Configuration Discovery (2)
=
Exploitation of Remote Services
Replication Through Removable Media
Adversary-in-the-Middle
Archive Collected Data
Audio Capture
Clipboard Data
Data from Local System
Input Capture (2)
=
Location Tracking (2)
=
Protected User Data (4)
=
Stored Application Data
Video Capture
Application Layer Protocol (1)
=
Dynamic Resolution (1)
=
Encrypted Channel (3)
=
Ingress Tool Transfer
Non-Standard Port
Out of Band Data
Remote Access Software
Web Service (3)
=
Exfiltration Over Alternative Protocol (1)
=
Exfiltration Over C2 Channel
Endpoint Denial of Service
Generate Traffic from Victim
Network Denial of Service
Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command and Control Exfiltration Impact
7 techniques 3 techniques 3 techniques 2 techniques 9 techniques 4 techniques 7 techniques 2 techniques 10 techniques 8 techniques 2 techniques 3 techniques
Application Versioning
Drive-By Compromise
Exploitation for Initial Access
Lockscreen Bypass
Phishing
Replication Through Removable Media
=
Supply Chain Compromise (3)
=
Command and Scripting Interpreter (1)
Exploitation for Client Execution
Scheduled Task/Job
Boot or Logon Initialization Scripts
Compromise Client Software Binary
Scheduled Task/Job
Exploitation for Privilege Escalation
=
Process Injection (1)
Application Versioning
Download New Code at Runtime
=
Execution Guardrails (1)
=
Indicator Removal on Host (1)
=
Masquerading (1)
=
Obfuscated Files or Information (1)
=
Process Injection (1)
=
Subvert Trust Controls (1)
=
Virtualization/Sandbox Evasion (1)
Clipboard Data
=
Credentials from Password Store (1)
=
Input Capture (2)
=
Steal Application Access Token (1)
File and Directory Discovery
=
Location Tracking (2)
Network Service Scanning
Process Discovery
=
Software Discovery (1)
System Information Discovery
=
System Network Configuration Discovery (2)
Exploitation of Remote Services
Replication Through Removable Media
Adversary-in-the-Middle
Archive Collected Data
Audio Capture
Clipboard Data
Data from Local System
=
Input Capture (2)
=
Location Tracking (2)
=
Protected User Data (4)
Stored Application Data
Video Capture
=
Application Layer Protocol (1)
=
Dynamic Resolution (1)
=
Encrypted Channel (3)
Ingress Tool Transfer
Non-Standard Port
Out of Band Data
Remote Access Software
=
Web Service (3)
=
Exfiltration Over Alternative Protocol (1)
Exfiltration Over C2 Channel
Endpoint Denial of Service
Generate Traffic from Victim
Network Denial of Service