adpare
75 lines
4.1 KiB
JSON
75 lines
4.1 KiB
JSON
{
|
|
"type": "bundle",
|
|
"id": "bundle--d25ac6cb-e461-478b-be1e-050d3e8263ef",
|
|
"spec_version": "2.0",
|
|
"objects": [
|
|
{
|
|
"type": "x-mitre-analytic",
|
|
"id": "x-mitre-analytic--77c81bf1-beef-429a-a426-a716b489383a",
|
|
"created": "2025-10-21T15:10:28.402Z",
|
|
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
|
|
"revoked": false,
|
|
"external_references": [
|
|
{
|
|
"source_name": "mitre-attack",
|
|
"url": "https://attack.mitre.org/detectionstrategies/DET0655#AN1742",
|
|
"external_id": "AN1742"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
|
|
],
|
|
"modified": "2026-04-09T20:37:17.277Z",
|
|
"name": "Analytic 1742",
|
|
"description": "The defender correlates managed-app runtime behavior indicative of command or shell invocation with subsequent spawned process or shell-like execution effects, then raises confidence when the resulting activity produces local artifacts or network communication outside expected user context. Because direct shell-process visibility can be weaker on iOS in many enterprise deployments, the analytic anchors first on process-creation or lower-level OS API effects where mobile telemetry can observe them, then on lifecycle context and post-execution network or file behavior. Confidence is strongest when the same app shows command invocation followed by process execution and immediate follow-on effects.",
|
|
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
|
|
"x_mitre_deprecated": false,
|
|
"x_mitre_version": "1.1",
|
|
"x_mitre_attack_spec_version": "3.3.0",
|
|
"x_mitre_domains": [
|
|
"mobile-attack"
|
|
],
|
|
"x_mitre_platforms": [
|
|
"iOS"
|
|
],
|
|
"x_mitre_log_source_references": [
|
|
{
|
|
"x_mitre_data_component_ref": "x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077",
|
|
"name": "MobileEDR:telemetry",
|
|
"channel": "Managed app invokes lower-level OS process-launch or command-execution behavior before file or network effects, including interpreter-like execution flow where visible to sensor"
|
|
},
|
|
{
|
|
"x_mitre_data_component_ref": "x-mitre-data-component--685f917a-e95e-4ba0-ade1-c7d354dae6e0",
|
|
"name": "MobileEDR:telemetry",
|
|
"channel": "Application spawns shell, command interpreter, or command-executing child process with arguments during command-execution phase"
|
|
}
|
|
],
|
|
"x_mitre_mutable_elements": [
|
|
{
|
|
"field": "TimeWindow",
|
|
"description": "Correlation window between command-execution indication, process effects, and follow-on file or network behavior"
|
|
},
|
|
{
|
|
"field": "AllowedAppList",
|
|
"description": "Managed apps legitimately expected to perform debugging, remote support, or enterprise automation tasks"
|
|
},
|
|
{
|
|
"field": "AllowedProcessPatterns",
|
|
"description": "Expected process-launch or helper-execution patterns for approved managed apps"
|
|
},
|
|
{
|
|
"field": "ForegroundStateRequired",
|
|
"description": "Whether command-execution behavior should occur only during active user-driven workflows"
|
|
},
|
|
{
|
|
"field": "ArtifactPathPatterns",
|
|
"description": "Expected temporary or output file locations for approved app behavior"
|
|
},
|
|
{
|
|
"field": "UplinkBytesThreshold",
|
|
"description": "Minimum outbound volume after command execution to treat network behavior as meaningful"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
} |