Adversaries may modify system software binaries to establish persistent access to devices. System software binaries are used by the underlying operating system and users over adb or terminal emulators.
Adversaries may make modifications to client software binaries to carry out malicious tasks when those binaries are executed. For example, malware may come with a pre-compiled malicious binary intended to overwrite the genuine one on the device. Since these binaries may be routinely executed by the system or user, the adversary can leverage this for persistent access to the device.
| ID | Name | Description |
|---|---|---|
| S0293 | BrainTest |
BrainTest uses root privileges (if available) to copy an additional Android app package (APK) to /system/priv-app to maintain persistence even after a factory reset.[1] |
| S0655 | BusyGasper |
BusyGasper can abuse existing root access to copy components into the system partition.[2] |
| S0550 | DoubleAgent |
DoubleAgent has used exploits to root devices and install additional malware on the system partition.[3] |
| S0407 | Monokle |
Monokle can remount the system partition as read/write to install attacker-specified certificates.[4] |
| S0316 | Pegasus for Android |
Pegasus for Android attempts to modify the device's system partition.[5] |
| S0289 | Pegasus for iOS |
Pegasus for iOS modifies the system partition to maintain persistence.[6] |
| S0294 | ShiftyBug |
ShiftyBug is auto-rooting adware that embeds itself as a system application, making it nearly impossible to remove.[7] |
| S0324 | SpyDealer |
SpyDealer maintains persistence by installing an Android application package (APK) on the system partition.[8] |
| ID | Mitigation | Description |
|---|---|---|
| M1002 | Attestation |
Device attestation could detect devices with unauthorized or unsafe modifications. |
| M1003 | Lock Bootloader |
A locked bootloader could prevent unauthorized modifications of protected operating system files. |
| M1001 | Security Updates |
Security updates frequently contain fixes for vulnerabilities that could be leveraged to modify protected operating system files. |
| M1004 | System Partition Integrity |
Android includes system partition integrity mechanisms that could detect unauthorized modifications. |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0712 | Detection of Compromise Client Software Binary | AN1838 |
For Android, detect Compromise Client Software Binary from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate File Metadata via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: file hash changes for binary at $SystemBinaryPaths$ relative to known-good baseline — hash deviation confirms modification]; File Modification via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: write() to path IN $SystemBinaryPaths$ by process NOT IN $TrustedUpdateSources$]; Process Creation via Application Vetting / Managed Device Telemetry [execve() of modified binary (hash != baseline) — execution of modified binary is the persistence activation]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone. |
| AN1839 |
For iOS, detect Compromise Client Software Binary by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate File Metadata via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: MDM supervised integrity_check=fail following jailbreak detection — integrity check failure on supervised Jamf/Intune enrolled device indicates filesystem modifications beyond passive jailbreak presence]; Host Status via Apple MDM [DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries]; Network Traffic Flow via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone. |