| ID | Name |
|---|---|
| T1636.001 | Calendar Entries |
| T1636.002 | Call Log |
| T1636.003 | Contact List |
| T1636.004 | SMS Messages |
Adversaries may utilize standard operating system APIs to gather calendar entry data. On Android, this can be accomplished using the Calendar Content Provider. On iOS, this can be accomplished using the EventKit framework.
If the device has been jailbroken or rooted, an adversary may be able to access Calendar Entries without the user’s knowledge or approval.
| ID | Name | Description |
|---|---|---|
| S0405 | Exodus | |
| S0408 | FlexiSpy | |
| S0407 | Monokle |
Monokle can retrieve calendar event information including the event name, when and where it is taking place, and the description.[3] |
| S0316 | Pegasus for Android |
Pegasus for Android accesses calendar entries.[4] |
| S0328 | Stealth Mango |
Stealth Mango uploads calendar events and reminders.[5] |
| S1082 | Sunbird |
| ID | Mitigation | Description |
|---|---|---|
| M1011 | User Guidance |
Calendar access is an uncommonly needed permission, so users should be instructed to use extra scrutiny when granting access to their device calendar. |
| ID | Data Source | Data Component | Detects |
|---|---|---|---|
| DS0041 | Application Vetting | Permissions Requests |
Application vetting services could look for |
| DS0042 | User Interface | System Settings |
On both Android and iOS, the user can manage which applications have permission to access calendar information through the device settings screen, revoke the permission if necessary. |