MITRE ATT&CKsub-technique

T1636.001 Calendar Entries

Published 2022-04-01 Modified 2025-10-24 Official page ↗
Domain
mobile
Tactics
Collection
Platforms
Android, iOS
Version
1.1
Created
2022-04-01

Description

Adversaries may utilize standard operating system APIs to gather calendar entry data. On Android, this can be accomplished using the Calendar Content Provider. On iOS, this can be accomplished using the `EventKit` framework. If the device has been jailbroken or rooted, an adversary may be able to access Calendar Entries without the user’s knowledge or approval.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1636 Protected User Data technique

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (1)

  • M1011 User Guidance mitigation

Referenced by MITRE ATT&CK · uses (6)

  • S1082 Sunbird software (malware)
  • S0407 Monokle software (malware)
  • S0408 FlexiSpy software (tool)
  • S0405 Exodus software (malware)
  • S0328 Stealth Mango software (malware)
  • S0316 Pegasus for Android software (malware)

References