Claude Skills by CyberStrikeus

Adversaries may exploit software vulnerabilities to gain initial access to a mobile device.

Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence.

Adversaries may modify applications installed on a device to establish persistent access to a victim.

Adversaries may establish persistence using system mechanisms that trigger execution based on specific events.

Adversaries may establish persistence using system mechanisms that trigger execution based on specific events.

Adversaries may execute their own malicious payloads by hijacking the way an operating system runs applications.

Adversaries may execute their own malicious payloads by hijacking the way operating systems run applications.

Adversaries may modify system software binaries to establish persistent access to devices.

Adversaries may exploit software vulnerabilities in order to elevate privileges.

Adversaries may abuse Android’s device administration API to obtain a higher degree of control over the device.

Adversaries may circumvent mechanisms designed to control elevated privileges to gain higher-level permissions.

Adversaries may use steganography techniques in order to prevent the detection of hidden information.

Adversaries may perform software packing to conceal their code.

Adversaries may attempt to make a payload or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the device or in transit.

Adversaries may download and execute dynamic code not included in the original application package after installation.

A malicious application can inject input to the user interface to mimic user interaction through the abuse of Android's accessibility APIs.

Adversaries may abuse Android's `startForeground()` API method to maintain continuous sensor access.

Adversaries may use Android’s Native Development Kit (NDK) to write native functions that can achieve execution of binaries or functions.

Adversaries may use a compromised device as a proxy server to the Internet.

Adversaries may utilize hooking to hide the presence of artifacts associated with their behaviors to evade detection.

Adversaries may use a device’s geographical location to limit certain malicious behaviors.

Adversaries may use execution guardrails to constrain execution or actions based on adversary supplied and environment specific conditions that are expected to be present on the target.

A malicious application could suppress its icon from being displayed to the user in the application launcher.

Adversaries may attempt to avoid detection by hiding malicious behavior from the user.

Adversaries may attempt to hide multimedia files from the user.

Adversaries may attempt to hide artifacts associated with their behaviors to evade detection.

Adversaries may abuse the Android device administration API to prevent the user from uninstalling a target application.

An adversary may seek to inhibit user interaction by locking the legitimate user out of the device.

Adversaries may disable security tools to avoid potential detection of their tools and activities.

Adversaries may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms.

Adversaries may include functionality in malware that uninstalls the malicious application from the device.

Adversaries may wipe a device or delete individual files in order to manipulate external outcomes or hide activity.

An adversary could use knowledge of the techniques used by security software to evade detection.

Adversaries may delete, alter, or hide generated artifacts on a device, including files, jailbreak status, or the malicious application itself.

Adversaries may inject malicious code into processes via ptrace (process trace) system calls in order to evade process-based defenses as well as possibly elevate privileges.

Adversaries may inject code into processes in order to evade process-based defenses or even elevate privileges.

Adversaries may modify code signing policies to enable execution of applications signed with unofficial or unknown keys.

Adversaries may undermine security controls that will either warn users of untrusted activity or prevent execution of untrusted applications.

Adversaries may employ various system checks to detect and avoid virtualization and analysis environments.

Adversaries may employ various means to detect and avoid virtualization and analysis environments.

Adversaries may match or approximate the name or location of legitimate files or resources when naming/placing them.

Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools.

Adversaries may carry out malicious operations using virtualization solutions to escape from Android sandboxes and to avoid detection.

Adversaries may mimic common operating system GUI components to prompt users for sensitive information with a seemingly legitimate prompt.

Adversaries may collect keychain data from an iOS device to acquire credentials.

Adversaries may search common password storage locations to obtain user credentials.

Adversaries may register Uniform Resource Identifiers (URIs) to intercept sensitive data.

Adversaries can steal user application access tokens as a means of acquiring credentials to access remote systems and resources.

Adversaries may attempt to get a listing of security applications and configurations that are installed on a device.

Adversaries may attempt to get a listing of applications that are installed on a device.