The sub-techniques beta is now live! Read the release blog post for more info.

Access Calendar Entries

An adversary could call standard operating system APIs from a malicious application to gather calendar entry data, or with escalated privileges could directly access files containing calendar data.

ID: T1435
Tactic Type: Post-Adversary Device Access
Tactic: Collection
Platform: Android, iOS
MTC ID: APP-13
Version: 1.0
Created: 25 October 2017
Last Modified: 17 October 2018

Procedure Examples

Name Description
Exodus

Exodus Two can exfiltrate calendar events. [4]

FlexiSpy

FlexiSpy can collect the device calendars.[1]

Monokle

Monokle can retrieve calendar event information including the event name, when and where it is taking place, and the description. [5]

Pegasus for Android

Pegasus for Android accesses calendar entries.[2]

Stealth Mango

Stealth Mango uploads calendar events and reminders.[3]

Mitigations

Mitigation Description
Application Vetting

On Android, accessing device calendar data requires that the app hold the READ_CALENDAR permission. Apps that request this permission could be closely scrutinized to ensure that the request is appropriate. On iOS, the app vetting process can determine whether apps access device calendar data, with extra scrutiny applied to any that do so.

Detection

On both Android (6.0 and up) and iOS, the user can view which applications have permission to access calendar information through the device settings screen, and the user can choose to revoke the permissions.

References