MITRE ATT&CKtechnique

T1409 Stored Application Data

Published 2017-10-25 Modified 2026-05-12 Official page ↗
Domain
mobile
Tactics
Collection
Platforms
Android, iOS
Version
3.1
Created
2017-10-25

Description

Adversaries may try to access and collect application data resident on the device. Adversaries often target popular applications, such as Facebook, WeChat, and Gmail. Due to mobile OS sandboxing, this technique is only possible in three scenarios: • An application stores files in unprotected external storage • An application stores files in its internal storage directory with insecure permissions (e.g. 777) • The adversary gains root permissions on the device

Related

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (1)

  • M1006 Use Recent OS Version mitigation

Referenced by MITRE ATT&CK · uses (32)

  • S9006 VajraSpy software (malware)
  • S1243 DCHSpy software (malware)
  • C0054 Operation Triangulation campaign
  • S1185 LightSpy software (malware)
  • S1128 HilalRAT software (malware)
  • S1103 FlixOnline software (malware)
  • S1092 Escobar software (malware)
  • S1093 FlyTrap software (malware)
  • S1082 Sunbird software (malware)
  • S1079 BOULDSPY software (malware)
  • S1077 Hornbill software (malware)
  • S1067 FluBot software (malware)
  • S1062 S.O.V.A. software (malware)
  • S0655 BusyGasper software (malware)
  • S0577 FrozenCell software (malware)
  • S0550 DoubleAgent software (malware)
  • S0551 GoldenEagle software (malware)
  • S0529 CarbonSteal software (malware)
  • S0509 FakeSpy software (malware)
  • S0505 Desert Scorpion software (malware)
  • S0485 Mandrake software (malware)
  • S0408 FlexiSpy software (tool)
  • S0405 Exodus software (malware)
  • S0399 Pallas software (malware)
  • S0324 SpyDealer software (malware)
  • S0327 Skygofree software (malware)
  • S0329 Tangelo software (malware)
  • S0289 Pegasus for iOS software (malware)
  • S0295 RCSAndroid software (malware)
  • S0311 YiSpecter software (malware)
Show all 32 ›

References