MITRE ATT&CKsub-technique

T1655.001 Match Legitimate Name or Location

Published 2023-07-12 Modified 2026-05-12 Official page ↗
Domain
mobile
Tactics
Defense Evasion
Platforms
Android, iOS
Version
1.0
Created
2023-07-12

Description

Adversaries may match or approximate the name or location of legitimate files or resources when naming/placing them. This is done for the sake of evading defenses and observation. This may be done by giving artifacts the name and icon of a legitimate, trusted application (i.e., Settings), or using a package name that matches legitimate, trusted applications (i.e., `com.google.android.gm`). Adversaries may also use the same icon of the file or application they are trying to mimic.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1655 Masquerading technique

Tactic · MITRE ATT&CK (1)

  • TA0030 Defense Evasion tactic

Referenced by MITRE ATT&CK · mitigates (1)

  • M1011 User Guidance mitigation

Referenced by MITRE ATT&CK · uses (46)

  • S9040 NGate software (malware)
  • S9005 DocSwap software (malware)
  • S1243 DCHSpy software (malware)
  • S1231 GodFather software (malware)
  • S1214 Android/SpyAgent software (malware)
  • C0033 C0033 campaign
  • G1028 APT-C-23 group
  • S1126 Phenakite software (malware)
  • S1195 SpyC23 software (malware)
  • S1094 BRATA software (malware)
  • G1019 MoustachedBouncer group
  • S1083 Chameleon software (malware)
  • S1079 BOULDSPY software (malware)
  • S1080 Fakecalls software (malware)
  • S1077 Hornbill software (malware)
  • S0577 FrozenCell software (malware)
  • S0558 Tiktok Pro software (malware)
  • S0555 CHEMISTGAMES software (malware)
  • S0549 SilkBean software (malware)
  • S0550 DoubleAgent software (malware)
  • S0551 GoldenEagle software (malware)
  • S0544 HenBox software (malware)
  • S0539 Red Alert 2.0 software (malware)
  • S0540 Asacub software (malware)
  • S0536 GPlayed software (malware)
  • S0529 CarbonSteal software (malware)
  • S0522 Exobot software (malware)
  • S0524 AndroidOS/MalLocker.B software (malware)
  • S0525 Android/AdDisplay.Ashas software (malware)
  • S0509 FakeSpy software (malware)
Show all 46 ›

References