cyberstrikeus T1430.001 Remote Device Management Services
Sub-technique of: T1430
High-Level Description
An adversary may use access to cloud services (e.g. Google's Android Device Manager or Apple iCloud's Find my iPhone) or to an enterprise mobility management (EMM)/mobile device management (MDM) server console to track the location of mobile devices managed by the service.
Kill Chain Phase
- Collection (TA0035)
- Discovery (TA0032)
Platforms: Android, iOS
What to Check
- Identify if Remote Device Management Services technique is applicable to target mobile environment
- Check Android devices for indicators of Remote Device Management Services
- Check iOS devices for indicators of Remote Device Management Services
- Verify mitigations are bypassed or absent (2 known mitigations)
- Assess detection coverage (1 detection strategies)
How to Test
Identify Attack Surface
Determine if the target mobile environment is susceptible to Remote Device Management Services by examining the target platforms (Android, iOS).
Assess Existing Defenses
Review whether mitigations for T1430.001 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Remediation Guide
M1011 User Guidance
Users should protect their account credentials and enable multi-factor authentication options when available.
M1012 Enterprise Policy
If devices are enrolled using Apple User Enrollment or using a profile owner enrollment mode for Android, device controls prevent the enterprise from accessing the device’s physical location. This is typically used for a Bring Your Own Device (BYOD) deployment.
Detection
Detection of Remote Device Management Services
Risk Assessment
| Finding | Severity | Impact |
|---|---|---|
| Remote Device Management Services technique applicable | Low | Collection |
CWE Categories
| CWE ID | Title |
|---|---|
| CWE-200 | Exposure of Sensitive Information |