aol.pm

Exploitation for Privilege Escalation

Technique · ATTACK:mobile:T1404

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:mobile:T1404",
  "title": "Exploitation for Privilege Escalation",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1404",
  "snapshot": "mobile-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--351c0927-2fc1-4a2c-ad84-cbbee7eb8172",
  "external_id": "T1404",
  "domain": "mobile",
  "created": "2017-10-25T14:48:29.405Z",
  "modified": "2025-10-24T17:48:38.088Z",
  "version": "2.1",
  "aliases": [

  ],
  "tactics": [
    "privilege-escalation"
  ],
  "source_references": [
    {
      "source_name": "NIST Mobile Threat Catalogue",
      "url": "https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-26.html",
      "external_id": "APP-26"
    }
  ]
}

Explicit source assertions (22)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:mobile:S0293 → uses → ATTACK:mobile:T1404

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--02b3c8fe-1539-4c77-b67e-07fa8a22c91e

Lookout-BrainTest

ATTACK:mobile:S0463 → uses → ATTACK:mobile:T1404

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0bb6f851-4302-4936-a98e-d23feecb234d

Volexity Insomnia

ATTACK:mobile:C0054 → uses → ATTACK:mobile:T1404

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0c077d44-1c79-473c-8623-d6267ab47f34

SecureList OpTriangulation 21Jun2023

ATTACK:mobile:M1001 → mitigates → ATTACK:mobile:T1404

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--13518e48-bb32-4ee3-9cd0-e5f367a2fb2d

ATTACK:mobile:S1061 → uses → ATTACK:mobile:T1404

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--25655385-5b0d-4700-a59f-d5d043625b84

lookout_abstractemu_1021

ATTACK:mobile:M1002 → mitigates → ATTACK:mobile:T1404

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--268c12df-d3bc-46fa-99e9-32caab50b175

ATTACK:mobile:S0494 → uses → ATTACK:mobile:T1404

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--27c8d474-f3f8-4a0e-a317-7e57b9de620c

Google Security Zen

ATTACK:mobile:S0405 → uses → ATTACK:mobile:T1404

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3bf5a566-986b-478c-b2da-e57caf261378

SWB Exodus March 2019

ATTACK:mobile:S0316 → uses → ATTACK:mobile:T1404

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3d24d88e-a0ab-42c6-8e8f-11f721082bba

Lookout-PegasusAndroid

ATTACK:mobile:S0289 → uses → ATTACK:mobile:T1404

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--63e67cba-4eae-4495-8897-2610103a0c41

Lookout-Pegasus

ATTACK:mobile:S0440 → uses → ATTACK:mobile:T1404

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--96490f73-d8ef-4c6b-9a3a-3c66fc963306

CheckPoint Agent Smith

ATTACK:mobile:S0550 → uses → ATTACK:mobile:T1404

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a501b700-250f-4e9a-a20f-656ae9bf90f9

Lookout Uyghur Campaign

ATTACK:mobile:S0290 → uses → ATTACK:mobile:T1404

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--aa8e45c2-4276-451b-b1eb-59c396bf720a

Gooligan Citation

ATTACK:mobile:S0182 → uses → ATTACK:mobile:T1404

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--be39c012-7201-4757-8cd6-c855bc945a9e

Lookout Dark Caracal Jan 2018

ATTACK:mobile:S0420 → uses → ATTACK:mobile:T1404

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cce5d90f-edff-454d-bafa-caf33b71ed6c

SecureList DVMap June 2017

ATTACK:mobile:M1010 → mitigates → ATTACK:mobile:T1404

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d6be8665-afbb-4be5-a56a-493af01b120a

ATTACK:mobile:S0322 → uses → ATTACK:mobile:T1404

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d87b468e-f610-4e95-8dfb-8cf029f0e891

ArsTechnica-HummingBad

ATTACK:mobile:S0324 → uses → ATTACK:mobile:T1404

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d8d773ab-b0e3-484b-bdb8-c1a1ab48d218

PaloAlto-SpyDealer

ATTACK:mobile:S0327 → uses → ATTACK:mobile:T1404

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dfe6d454-1a24-4c42-97eb-4ddfd1dbb09b

Kaspersky-Skygofree

ATTACK:mobile:S1185 → uses → ATTACK:mobile:T1404

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e515259a-63b1-4ac8-bbec-4b0103d0a79a

LinkedIn Dmitry LightSpy 2025 · Threatfabric LightSpy 2024

ATTACK:mobile:S1126 → uses → ATTACK:mobile:T1404

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ed6ebdd2-0095-4241-b3fc-7fc22366ec0d

fb_arid_viper

ATTACK:mobile:S0294 → uses → ATTACK:mobile:T1404

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f0851531-e554-4658-920c-f2342632c19a

Lookout-Adware

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.