MITRE ATT&CKsub-technique
T1628.003 Conceal Multimedia Files
- Domain
- mobile
- Tactics
- Defense Evasion
- Platforms
- Android
- Version
- 1.0
- Created
- 2024-02-20
Description
Adversaries may attempt to hide multimedia files from the user. By doing so, adversaries may conceal captured files, such as pictures, videos and/or screenshots, then later exfiltrate those files.
Specific to Android devices, if the `.nomedia` file is present in a folder, multimedia files in that folder will not be visible to the user in the Gallery application. Additionally, other applications are asked not to scan the folder with the `.nomedia` file, effectively making the folder appear invisible to the user.
This technique is often used by stalkerware and spyware applications.
Related
Subtechnique of · MITRE ATT&CK (1)
- T1628 Hide Artifacts technique
Tactic · MITRE ATT&CK (1)
- TA0030 Defense Evasion tactic
Referenced by MITRE ATT&CK · mitigates (1)
- M1059 Do Not Mitigate mitigation
Referenced by MITRE ATT&CK · uses (1)
- G0112 Windshift group