Mapping Zero-Click Attack Behavior into MITRE ATT&CK Mobile: A Systematic Process

A zero-click attack is a sophisticated class of attacks where a smartphone device can be compromised remotely without any user interaction. Recently, there have been traces of successful zero-click attacks on iPhones by Pegasus, hacking spyware that can infect billions of phones running either iOS or Android operating systems. However, there is a lack of behavioral profile for a zero-click attack, which is critical for a response and prevention plan and security awareness. To that end, we aim to devise and apply a systematic process that leverages CISA-MITRE-ATT&CK-Mapping-Guide and MITRE ATT&CK framework for mapping zero-click cyber threat intelligence reports into the MITRE ATT&CK matrix. Based on the forensic data, we have created a zero-click attack behavioral profile that consists of 65 techniques and 13 different tactics. To validate our mapping results, we compared our mapping results with a MITRE ATT&CK analyst expert from the cybersecurity industry and we found many similarities between the two mappings. The proposed process was not difficult to follow and apply by novice analysts. The created profile has the potential to provide knowledge for detection and protection. Also, the device process has the potential to assist novice team members in mapping cyber threat intelligence into the MITRE ATT&CK framework.