Input Injection
Where this stands
No Sigma rule can address this — the telemetry MITRE names has no Sigma logsource behind it.
Sigma has no logsource taxonomy for mobile platforms. MITRE's telemetry here is mobile EDR and device APIs, which no Sigma rule can address.
What the technique is
A malicious application can inject input to the user interface to mimic user interaction through the abuse of Android's accessibility APIs. Input Injection can be achieved using any of the following methods: Mimicking user clicks on the screen, for example to steal money from a user's PayPal account. Injecting global actions, such as GLOBAL_ACTION_BACK (programatically mimicking a physical back button press), to trigger actions on behalf of the user. Inserting input into text fields on behalf of the user. This method is used legitimately to auto-fill text fields by applications such as password managers.
Read it on attack.mitre.orgWhat MITRE says you would watch
- AN1666
The defender correlates Android accessibility or UI-automation-capable behavior from an app identity with injected user-interface actions occurring on behalf of the user in another foreground application. The strongest Android evidence is accessibility-enabled or similarly privileged app behavior that triggers programmatic clicks, global actions, or text insertion into another app's active UI, especially when those actions occur without matching user touch interaction, while the injecting app is backgrounded or foreground-service-only, or when the target foreground app belongs to a sensitive category such as banking, payments, identity, communications, or enterprise access. […]
Technique names and descriptions © MITRE ATT&CK®, CC BY 4.0. Not endorsed by MITRE.