Input Capture
Technique · ATTACK:mobile:T1417
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:mobile:T1417",
"title": "Input Capture",
"type": "Technique",
"source_url": "https://attack.mitre.org/techniques/T1417",
"snapshot": "mobile-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--a8c31121-852b-46bd-9ba4-674ae5afe7ad",
"external_id": "T1417",
"domain": "mobile",
"created": "2017-10-25T14:48:27.660Z",
"modified": "2025-10-24T17:49:11.864Z",
"version": "2.3",
"aliases": [
],
"tactics": [
"collection",
"credential-access"
],
"source_references": [
{
"source_name": "NIST Mobile Threat Catalogue",
"url": "https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-31.html",
"external_id": "APP-31"
},
{
"source_name": "NIST Mobile Threat Catalogue",
"url": "https://pages.nist.gov/mobile-threat-catalogue/authentication-threats/AUT-13.html",
"external_id": "AUT-13"
}
]
}Explicit source assertions (8)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:mobile:M1012 → mitigates → ATTACK:mobile:T1417
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0fd34764-8a5d-43da-9bdf-5a0b7e436936
Samsung KeyboardsATTACK:mobile:S1225 → uses → ATTACK:mobile:T1417
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1659ff92-3a84-4cc3-84dc-42dcc8a91dc4
TrendMicro_CherryBlos_July2023ATTACK:mobile:T1417.002 → subtechnique-of → ATTACK:mobile:T1417
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--465b7a4a-32d5-475c-9fb9-6335c44fb0d1
ATTACK:mobile:M1011 → mitigates → ATTACK:mobile:T1417
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--51f75dd5-b584-482f-8f7f-dbee2d5cf6f3
ATTACK:mobile:M1006 → mitigates → ATTACK:mobile:T1417
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--86170d29-0e41-44d0-94b0-de7d23718302
Android 12 FeaturesATTACK:mobile:S1126 → uses → ATTACK:mobile:T1417
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--922fa6eb-7274-477c-821e-ae6684c08934
fb_arid_viperATTACK:mobile:T1417.001 → subtechnique-of → ATTACK:mobile:T1417
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d09a4d42-45bd-4b2a-aef4-3aa3982115ad
ATTACK:mobile:S1231 → uses → ATTACK:mobile:T1417
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f8312ce3-3533-46e7-bf93-90541f9b5c69
ZimperiumOrtegaPratapagiri_GodFather_Jun2025