MITRE ATT&CKtechnique

T1517 Access Notifications

Published 2019-09-15 Modified 2026-05-12 Official page ↗
Domain
mobile
Tactics
Collection, Credential Access
Platforms
Android
Version
1.2
Created
2019-09-15

Description

Adversaries may collect data within notifications sent by the operating system or other applications. Notifications may contain sensitive data such as one-time authentication codes sent over SMS, email, or other mediums. In the case of Credential Access, adversaries may attempt to intercept one-time code sent to the device. Adversaries can also dismiss notifications to prevent the user from noticing that the notification has arrived and can trigger action buttons contained within notifications.

Related

Tactic · MITRE ATT&CK (2)

Referenced by MITRE ATT&CK · mitigates (3)

  • M1011 User Guidance mitigation
  • M1012 Enterprise Policy mitigation
  • M1013 Application Developer Guidance mitigation

Referenced by MITRE ATT&CK · uses (15)

  • S9006 VajraSpy software (malware)
  • C0033 C0033 campaign
  • S1195 SpyC23 software (malware)
  • S1103 FlixOnline software (malware)
  • S1092 Escobar software (malware)
  • S1083 Chameleon software (malware)
  • S1077 Hornbill software (malware)
  • S1067 FluBot software (malware)
  • S1061 AbstractEmu software (malware)
  • S1062 S.O.V.A. software (malware)
  • S1055 SharkBot software (malware)
  • S0489 WolfRAT software (malware)
  • S0485 Mandrake software (malware)
  • S0432 Bread software (malware)
  • S0425 Corona Updates software (malware)

References