| ID | Name |
|---|---|
| T1636.001 | Calendar Entries |
| T1636.002 | Call Log |
| T1636.003 | Contact List |
| T1636.004 | SMS Messages |
| T1636.005 | Accounts |
Adversaries may utilize standard operating system APIs to gather account data. On Android, this can be accomplished by using the AccountManager API. For example, adversaries may use the getAccounts() method to list all accounts.[1] On iOS, this can be accomplished by using the Keychain services.
If the device has been jailbroken or rooted, adversaries may be able to access Accounts without the users’ knowledge or approval.
| ID | Name | Description |
|---|---|---|
| S1243 | DCHSpy |
DCHSpy has collected account names and their types from the device.[2] |
| S1241 | RatMilad |
RatMilad has collected account names and their types from the compromised device.[3] |
| ID | Mitigation | Description |
|---|---|---|
| M1006 | Use Recent OS Version |
OS feature updates often enhance security and privacy around permissions. |
| M1011 | User Guidance |
Access to accounts is an uncommonly needed permission, so users should be instructed to use extra scrutiny when granting access to their accounts. |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0635 | Detection of Accounts | AN1708 |
Monitor for API calls that are related to the AccountManager API on Android and Keychain services on iOS. |
| AN1709 |
Monitor for API calls that are related to the AccountManager API on Android and Keychain services on iOS. |