/System/Library/LaunchAgents, /Library/LaunchAgents, and ~/Library/LaunchAgents.(Citation: AppleDocs Launch Agent Daemons)(Citation: OSX Keydnap malware) (Citation: Antiquated Mac Malware) Property list files use the Label, ProgramArguments , and RunAtLoad keys to identify the Launch Agent's name, executable location, and execution time.(Citation: OSX.Dok Malware) Launch Agents are often installed to perform updates to programs, launch user specified programs at login, or to conduct other developer tasks.\n\n Launch Agents can also be executed using the [Launchctl](https://attack.mitre.org/techniques/T1569/001) command.\n \nAdversaries may install a new Launch Agent that executes at login by placing a .plist file into the appropriate folders with the RunAtLoad or KeepAlive keys set to true.(Citation: Sofacy Komplex Trojan)(Citation: Methods of Mac Malware Persistence) The Launch Agent name may be disguised by using a name from the related operating system or benign software. Launch Agents are created with user level privileges and execute with user level permissions.(Citation: OSX Malware Detection)(Citation: OceanLotus for OS X) ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "privilege-escalation"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1543/001",
"external_id": "T1543.001"
},
{
"source_name": "AppleDocs Launch Agent Daemons",
"description": "Apple. (n.d.). Creating Launch Daemons and Agents. Retrieved July 10, 2017.",
"url": "https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html"
},
{
"source_name": "OSX Keydnap malware",
"description": "Marc-Etienne M.Leveille. (2016, July 6). New OSX/Keydnap malware is hungry for credentials. Retrieved July 3, 2017.",
"url": "https://www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-hungry-credentials/"
},
{
"source_name": "Antiquated Mac Malware",
"description": "Thomas Reed. (2017, January 18). New Mac backdoor using antiquated code. Retrieved July 5, 2017.",
"url": "https://blog.malwarebytes.com/threat-analysis/2017/01/new-mac-backdoor-using-antiquated-code/"
},
{
"source_name": "OSX.Dok Malware",
"description": "Thomas Reed. (2017, July 7). New OSX.Dok malware intercepts web traffic. Retrieved July 10, 2017.",
"url": "https://blog.malwarebytes.com/threat-analysis/2017/04/new-osx-dok-malware-intercepts-web-traffic/"
},
{
"source_name": "Sofacy Komplex Trojan",
"description": "Dani Creus, Tyler Halfpop, Robert Falcone. (2016, September 26). Sofacy's 'Komplex' OS X Trojan. Retrieved July 8, 2017.",
"url": "https://researchcenter.paloaltonetworks.com/2016/09/unit42-sofacys-komplex-os-x-trojan/"
},
{
"source_name": "Methods of Mac Malware Persistence",
"description": "Patrick Wardle. (2014, September). Methods of Malware Persistence on Mac OS X. Retrieved July 5, 2017.",
"url": "https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf"
},
{
"source_name": "OSX Malware Detection",
"description": "Patrick Wardle. (2016, February 29). Let's Play Doctor: Practical OS X Malware Detection & Analysis. Retrieved July 10, 2017.",
"url": "https://www.synack.com/wp-content/uploads/2016/03/RSA_OSX_Malware.pdf"
},
{
"source_name": "OceanLotus for OS X",
"description": "Eddie Lee. (2016, February 17). OceanLotus for OS X - an Application Bundle Pretending to be an Adobe Flash Update. Retrieved July 5, 2017.",
"url": "https://www.alienvault.com/blogs/labs-research/oceanlotus-for-os-x-an-application-bundle-pretending-to-be-an-adobe-flash-update"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_data_sources": [
"File: File Creation",
"File: File Modification",
"Command: Command Execution",
"Service: Service Creation",
"Service: Service Modification"
],
"x_mitre_detection": "Monitor Launch Agent creation through additional plist files and utilities such as Objective-See\u2019s KnockKnock application. Launch Agents also require files on disk for persistence which can also be monitored via other file monitoring applications.\n\nEnsure Launch Agent's ProgramArguments key pointing to executables located in the /tmp or /shared folders are in alignment with enterprise policy. Ensure all Launch Agents with the RunAtLoad key set to true are in alignment with policy. ",
"x_mitre_is_subtechnique": true,
"x_mitre_permissions_required": [
"Administrator",
"User"
],
"x_mitre_platforms": [
"macOS"
],
"x_mitre_version": "1.3",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2021-11-03 20:11:51.687000+00:00\", \"old_value\": \"2021-10-15 07:41:40.262000+00:00\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.3\", \"old_value\": \"1.2\"}}}",
"previous_version": "1.2",
"version_change": "1.2 \u2192 1.3",
"changelog_mitigations": {
"shared": [],
"new": [],
"dropped": [
"M1018: User Account Management"
]
},
"changelog_detections": {
"shared": [
"DS0017: Command (Command Execution)",
"DS0019: Service (Service Creation)",
"DS0019: Service (Service Modification)",
"DS0022: File (File Creation)",
"DS0022: File (File Modification)"
],
"new": [],
"dropped": []
}
}
],
"other_version_changes": [],
"patches": [
{
"type": "attack-pattern",
"id": "attack-pattern--106c0cf6-bf73-4601-9aa8-0945c2715ec5",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-01-10 16:03:18.865000+00:00",
"modified": "2021-11-03 20:11:52.175000+00:00",
"name": "Create or Modify System Process",
"description": "Adversaries may create or modify system-level processes to repeatedly execute malicious payloads as part of persistence. When operating systems boot up, they can start processes that perform background system functions. On Windows and Linux, these system processes are referred to as services. (Citation: TechNet Services) On macOS, launchd processes known as [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) and [Launch Agent](https://attack.mitre.org/techniques/T1543/001) are run to finish system initialization and load user specific parameters.(Citation: AppleDocs Launch Agent Daemons) \n\nAdversaries may install new services, daemons, or agents that can be configured to execute at startup or a repeatable interval in order to establish persistence. Similarly, adversaries may modify existing services, daemons, or agents to achieve the same effect. \n\nServices, daemons, or agents may be created with administrator privileges but executed under root/SYSTEM privileges. Adversaries may leverage this functionality to create or modify system processes in order to escalate privileges. (Citation: OSX Malware Detection). ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "privilege-escalation"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1543",
"external_id": "T1543"
},
{
"source_name": "TechNet Services",
"description": "Microsoft. (n.d.). Services. Retrieved June 7, 2016.",
"url": "https://technet.microsoft.com/en-us/library/cc772408.aspx"
},
{
"source_name": "AppleDocs Launch Agent Daemons",
"description": "Apple. (n.d.). Creating Launch Daemons and Agents. Retrieved July 10, 2017.",
"url": "https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html"
},
{
"source_name": "OSX Malware Detection",
"description": "Patrick Wardle. (2016, February 29). Let's Play Doctor: Practical OS X Malware Detection & Analysis. Retrieved July 10, 2017.",
"url": "https://www.synack.com/wp-content/uploads/2016/03/RSA_OSX_Malware.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_data_sources": [
"Service: Service Creation",
"Service: Service Modification",
"Process: Process Creation",
"Process: OS API Execution",
"Command: Command Execution",
"Windows Registry: Windows Registry Key Creation",
"Windows Registry: Windows Registry Key Modification",
"File: File Creation",
"File: File Modification"
],
"x_mitre_detection": "Monitor for changes to system processes that do not correlate with known software, patch cycles, etc., including by comparing results against a trusted system baseline. New, benign system processes may be created during installation of new software. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement. \n\nCommand-line invocation of tools capable of modifying services may be unusual, depending on how systems are typically used in a particular environment. Look for abnormal process call trees from known services and for execution of other commands that could relate to Discovery or other adversary techniques. \n\nMonitor for changes to files associated with system-level processes.",
"x_mitre_is_subtechnique": false,
"x_mitre_platforms": [
"Windows",
"macOS",
"Linux"
],
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2021-11-03 20:11:52.175000+00:00\", \"old_value\": \"2021-10-15 07:41:41.496000+00:00\"}}}",
"previous_version": "1.0",
"changelog_mitigations": {
"shared": [
"M1018: User Account Management",
"M1022: Restrict File and Directory Permissions",
"M1033: Limit Software Installation",
"M1047: Audit"
],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [
"DS0009: Process (OS API Execution)",
"DS0009: Process (Process Creation)",
"DS0017: Command (Command Execution)",
"DS0019: Service (Service Creation)",
"DS0019: Service (Service Modification)",
"DS0022: File (File Creation)",
"DS0022: File (File Modification)",
"DS0024: Windows Registry (Windows Registry Key Creation)",
"DS0024: Windows Registry (Windows Registry Key Modification)"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--4933e63b-9b77-476e-ab29-761bc5b7d15a",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2021-10-05 01:15:06.293000+00:00",
"modified": "2021-11-01 18:09:09.670000+00:00",
"name": "Reflective Code Loading",
"description": "Adversaries may reflectively load code into a process in order to conceal the execution of malicious payloads. Reflective loading involves allocating then executing payloads directly within the memory of the process, vice creating a thread or process backed by a file path on disk. Reflectively loaded payloads may be compiled binaries, anonymous files (only present in RAM), or just snubs of fileless executable code (ex: position-independent shellcode).(Citation: Introducing Donut)(Citation: S1 Custom Shellcode Tool)(Citation: Stuart ELF Memory)(Citation: 00sec Droppers)(Citation: Mandiant BYOL)\n\nReflective code injection is very similar to [Process Injection](https://attack.mitre.org/techniques/T1055) except that the \u201cinjection\u201d loads code into the processes\u2019 own memory instead of that of a separate process. Reflective loading may evade process-based detections since the execution of the arbitrary code may be masked within a legitimate or otherwise benign process. Reflectively loading payloads directly into memory may also avoid creating files or other artifacts on disk, while also enabling malware to keep these payloads encrypted (or otherwise obfuscated) until execution.(Citation: Stuart ELF Memory)(Citation: 00sec Droppers)(Citation: Intezer ACBackdoor)(Citation: S1 Old Rat New Tricks)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-evasion"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1620",
"external_id": "T1620"
},
{
"source_name": "Introducing Donut",
"description": "The Wover. (2019, May 9). Donut - Injecting .NET Assemblies as Shellcode. Retrieved October 4, 2021.",
"url": "https://thewover.github.io/Introducing-Donut/"
},
{
"source_name": "S1 Custom Shellcode Tool",
"description": "Bunce, D. (2019, October 31). Building A Custom Tool For Shellcode Analysis. Retrieved October 4, 2021.",
"url": "https://www.sentinelone.com/blog/building-a-custom-tool-for-shellcode-analysis/"
},
{
"source_name": "Stuart ELF Memory",
"description": "Stuart. (2018, March 31). In-Memory-Only ELF Execution (Without tmpfs). Retrieved October 4, 2021.",
"url": "https://magisterquis.github.io/2018/03/31/in-memory-only-elf-execution.html"
},
{
"source_name": "00sec Droppers",
"description": "0x00pico. (2017, September 25). Super-Stealthy Droppers. Retrieved October 4, 2021.",
"url": "https://0x00sec.org/t/super-stealthy-droppers/3715"
},
{
"source_name": "Mandiant BYOL",
"description": "Kirk, N. (2018, June 18). Bring Your Own Land (BYOL) \u2013 A Novel Red Teaming Technique. Retrieved October 4, 2021.",
"url": "https://www.mandiant.com/resources/bring-your-own-land-novel-red-teaming-technique"
},
{
"source_name": "Intezer ACBackdoor",
"description": "Sanmillan, I. (2019, November 18). ACBackdoor: Analysis of a New Multiplatform Backdoor. Retrieved October 4, 2021.",
"url": "https://www.intezer.com/blog/research/acbackdoor-analysis-of-a-new-multiplatform-backdoor/"
},
{
"source_name": "S1 Old Rat New Tricks",
"description": "Landry, J. (2016, April 21). Teaching an old RAT new tricks. Retrieved October 4, 2021.",
"url": "https://www.sentinelone.com/blog/teaching-an-old-rat-new-tricks/"
},
{
"source_name": "MDSec Detecting DOTNET",
"description": "MDSec Research. (n.d.). Detecting and Advancing In-Memory .NET Tradecraft. Retrieved October 4, 2021.",
"url": "https://www.mdsec.co.uk/2020/06/detecting-and-advancing-in-memory-net-tradecraft/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_contributors": [
"Jo\u00e3o Paulo de A. Filho, @Hug1nN__",
"Joas Antonio dos Santos, @C0d3Cr4zy",
"Shlomi Salem, SentinelOne",
"Lior Ribak, SentinelOne",
"Rex Guo, @Xiaofei_REX, Confluera"
],
"x_mitre_data_sources": [
"Script: Script Execution",
"Process: OS API Execution",
"Module: Module Load"
],
"x_mitre_defense_bypassed": [
"Application control",
"Anti-virus"
],
"x_mitre_detection": "Monitor for code artifacts associated with reflectively loading code, such as the abuse of .NET functions such as Assembly.Load() and [Native API](https://attack.mitre.org/techniques/T1106) functions such as CreateThread(), memfd_create(), execve(), and/or execveat().(Citation: 00sec Droppers)(Citation: S1 Old Rat New Tricks)\n\nMonitor for artifacts of abnormal process execution. For example, a common signature related to reflective code loading on Windows is mechanisms related to the .NET Common Language Runtime (CLR) -- such as mscor.dll, mscoree.dll, and clr.dll -- loading into abnormal processes (such as notepad.exe). Similarly, AMSI / ETW traces can be used to identify signs of arbitrary code execution from within the memory of potentially compromised processes.(Citation: MDSec Detecting DOTNET)(Citation: Introducing Donut)\n\nAnalyze process behavior to determine if a process is performing actions it usually does not, such as opening network connections, reading files, or other suspicious actions that could relate to post-compromise behavior. ",
"x_mitre_is_subtechnique": false,
"x_mitre_permissions_required": [
"User"
],
"x_mitre_platforms": [
"macOS",
"Linux",
"Windows"
],
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2021-11-01 18:09:09.670000+00:00\", \"old_value\": \"2021-10-17 15:13:55.615000+00:00\"}, \"root['x_mitre_contributors'][3]\": {\"new_value\": \"Lior Ribak, SentinelOne\", \"old_value\": \"Lior Ribak , SentinelOne\"}}}",
"previous_version": "1.0",
"changelog_mitigations": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [
"DS0009: Process (OS API Execution)",
"DS0011: Module (Module Load)",
"DS0012: Script (Script Execution)"
],
"new": [],
"dropped": []
}
}
],
"revocations": [],
"deprecations": [],
"deletions": []
},
"software": {
"additions": [],
"major_version_changes": [],
"minor_version_changes": [],
"other_version_changes": [],
"patches": [
{
"type": "malware",
"id": "malware--67fc172a-36fa-4a35-88eb-4ba730ed52a6",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:32:15.994000+00:00",
"modified": "2021-11-01 21:12:14.638000+00:00",
"name": "BS2005",
"description": "[BS2005](https://attack.mitre.org/software/S0014) is malware that was used by [Ke3chang](https://attack.mitre.org/groups/G0004) in spearphishing campaigns since at least 2011. (Citation: Mandiant Operation Ke3chang November 2014)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S0014",
"external_id": "S0014"
},
{
"source_name": "Mandiant Operation Ke3chang November 2014",
"description": "Villeneuve, N., Bennett, J. T., Moran, N., Haq, T., Scott, M., & Geers, K. (2014). OPERATION \u201cKE3CHANG\u201d: Targeted Attacks Against Ministries of Foreign Affairs. Retrieved November 12, 2014.",
"url": "https://www.mandiant.com/resources/operation-ke3chang-targeted-attacks-against-ministries-of-foreign-affairs"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"BS2005"
],
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2021-11-01 21:12:14.638000+00:00\", \"old_value\": \"2020-03-30 15:02:35.427000+00:00\"}, \"root['description']\": {\"new_value\": \"[BS2005](https://attack.mitre.org/software/S0014) is malware that was used by [Ke3chang](https://attack.mitre.org/groups/G0004) in spearphishing campaigns since at least 2011. (Citation: Mandiant Operation Ke3chang November 2014)\", \"old_value\": \"[BS2005](https://attack.mitre.org/software/S0014) is malware that was used by [Ke3chang](https://attack.mitre.org/groups/G0004) in spearphishing campaigns since at least 2011. (Citation: Villeneuve et al 2014)\"}, \"root['external_references'][1]['source_name']\": {\"new_value\": \"Mandiant Operation Ke3chang November 2014\", \"old_value\": \"Villeneuve et al 2014\"}, \"root['external_references'][1]['url']\": {\"new_value\": \"https://www.mandiant.com/resources/operation-ke3chang-targeted-attacks-against-ministries-of-foreign-affairs\", \"old_value\": \"https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-operation-ke3chang.pdf\"}}}",
"previous_version": "1.1",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | [BS2005](https://attack.mitre.org/software/S0014) is malware | t | 1 | [BS2005](https://attack.mitre.org/software/S0014) is malware |
| > | that was used by [Ke3chang](https://attack.mitre.org/groups | > | that was used by [Ke3chang](https://attack.mitre.org/groups | ||
| > | /G0004) in spearphishing campaigns since at least 2011. (Cit | > | /G0004) in spearphishing campaigns since at least 2011. (Cit | ||
| > | ation: Villeneuve et al 2014) | > | ation: Mandiant Operation Ke3chang November 2014) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | [Ke3chang](https://attack.mitre.org/groups/G0004) is a threa | t | 1 | [Ke3chang](https://attack.mitre.org/groups/G0004) is a threa |
| > | t group attributed to actors operating out of China. [Ke3cha | > | t group attributed to actors operating out of China. [Ke3cha | ||
| > | ng](https://attack.mitre.org/groups/G0004) has targeted seve | > | ng](https://attack.mitre.org/groups/G0004) has targeted seve | ||
| > | ral industries, including oil, government, military, and mor | > | ral industries, including oil, government, military, and mor | ||
| > | e. (Citation: Villeneuve et al 2014) (Citation: NCC Group AP | > | e.(Citation: Mandiant Operation Ke3chang November 2014)(Cita | ||
| > | T15 Alive and Strong) (Citation: APT15 Intezer June 2018) | > | tion: NCC Group APT15 Alive and Strong)(Citation: APT15 Inte | ||
| > | zer June 2018) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | [Orangeworm](https://attack.mitre.org/groups/G0071) is a gro | t | 1 | [Orangeworm](https://attack.mitre.org/groups/G0071) is a gro |
| > | up that has targeted organizations in the healthcare sector | > | up that has targeted organizations in the healthcare sector | ||
| > | in the United States, Europe, and Asia since at least 2015, | > | in the United States, Europe, and Asia since at least 2015, | ||
| > | likely for the purpose of corporate espionage. (Citation: Sy | > | likely for the purpose of corporate espionage.(Citation: Sym | ||
| > | mantec Orangeworm April 2018) | > | antec Orangeworm April 2018) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | An adversary could attempt to install insecure or malicious | t | 1 | An adversary could attempt to install insecure or malicious |
| > | configuration settings on the mobile device, through means s | > | configuration settings on the mobile device, through means s | ||
| > | uch as phishing emails or text messages either directly cont | > | uch as phishing emails or text messages either directly cont | ||
| > | aining the configuration settings as an attachment, or conta | > | aining the configuration settings as an attachment, or conta | ||
| > | ining a web link to the configuration settings. The device u | > | ining a web link to the configuration settings. The device u | ||
| > | ser may be tricked into installing the configuration setting | > | ser may be tricked into installing the configuration setting | ||
| > | s through social engineering techniques (Citation: Symantec- | > | s through social engineering techniques (Citation: Symantec- | ||
| > | iOSProfile). For example, an unwanted Certification Authori | > | iOSProfile). For example, an unwanted Certification Authori | ||
| > | ty (CA) certificate could be placed in the device's trusted | > | ty (CA) certificate could be placed in the device's trusted | ||
| > | certificate store, increasing the device's susceptibility to | > | certificate store, increasing the device's susceptibility to | ||
| > | man-in-the-middle network attacks seeking to eavesdrop on o | > | adversary-in-the-middle network attacks seeking to eavesdro | ||
| > | r manipulate the device's network communication ([Eavesdrop | > | p on or manipulate the device's network communication ([Eave | ||
| > | on Insecure Network Communication](https://attack.mitre.org/ | > | sdrop on Insecure Network Communication](https://attack.mitr | ||
| > | techniques/T1439) and [Manipulate Device Communication](http | > | e.org/techniques/T1439) and [Manipulate Device Communication | ||
| > | s://attack.mitre.org/techniques/T1463)). On iOS, malicious | > | ](https://attack.mitre.org/techniques/T1463)). On iOS, mali | ||
| > | Configuration Profiles could contain unwanted Certification | > | cious Configuration Profiles could contain unwanted Certific | ||
| > | Authority (CA) certificates or other insecure settings such | > | ation Authority (CA) certificates or other insecure settings | ||
| > | as unwanted proxy server or VPN settings to route the device | > | such as unwanted proxy server or VPN settings to route the | ||
| > | 's network traffic through an adversary's system. The device | > | device's network traffic through an adversary's system. The | ||
| > | could also potentially be enrolled into a malicious Mobile | > | device could also potentially be enrolled into a malicious M | ||
| > | Device Management (MDM) system (Citation: Talos-MDM). | > | obile Device Management (MDM) system (Citation: Talos-MDM). |