T1407 Download New Code at Runtime

Mobile

Adversaries may download and execute dynamic code not included in the original application package after installation. This technique is primarily used to evade static analysis checks and pre-publication scans in official app stores. In some cases, more advanced dynamic or behavioral analysis techniques could detect this behavior. However, in conjunction with Execution Guardrails techniques, detecting malicious code downloaded after installation could be difficult. On Android, dynamic code could include native code, Dalvik code, or JavaScript code that utilizes Android WebView’s `JavascriptInterface` capability. On iOS, dynamic code could be downloaded and executed through 3rd party libraries such as JSPatch.

platforms

Platforms this applies to.

AndroidiOS

mitigations

ATT&CK mitigations that reduce this.

M1006Use Recent OS Version

detected by (6)

Data components that detect this.

groups (1)

Threat groups associated with this.

G0112Windshift

source

Where this definition is published.

MITRE ATT&CK