T1517 Access Notifications
MobileAdversaries may collect data within notifications sent by the operating system or other applications. Notifications may contain sensitive data such as one-time authentication codes sent over SMS, email, or other mediums. In the case of Credential Access, adversaries may attempt to intercept one-time code sent to the device. Adversaries can also dismiss notifications to prevent the user from noticing that the notification has arrived and can trigger action buttons contained within notifications.
01
platforms
Platforms this applies to.
Android
02
mitigations
ATT&CK mitigations that reduce this.
03
detected by (3)
Data components that detect this.
04
software (14)
Malware and tools associated with this.
05
campaigns (1)
Campaigns that use this.
06
source
Where this definition is published.