Foreground Persistence

Technique · ATTACK:mobile:T1541

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:mobile:T1541",
  "title": "Foreground Persistence",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1541",
  "snapshot": "mobile-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--648f8051-1a35-46d3-b1d8-3a3f5cf2cc8e",
  "external_id": "T1541",
  "domain": "mobile",
  "created": "2019-11-19T17:32:20.373Z",
  "modified": "2026-05-12T15:12:00.636Z",
  "version": "2.1",
  "aliases": [

  ],
  "tactics": [
    "defense-evasion",
    "persistence"
  ],
  "source_references": [
    {
      "source_name": "Android-SensorsOverview",
      "url": "https://developer.android.com/guide/topics/sensors/sensors_overview#sensors-practices"
    },
    {
      "source_name": "Android-ForegroundServices",
      "url": "https://developer.android.com/guide/components/services.html#Foreground"
    },
    {
      "source_name": "TrendMicro-Yellow Camera",
      "url": "https://blog.trendmicro.com/trendlabs-security-intelligence/fake-photo-beautification-apps-on-google-play-can-read-sms-verification-code-to-trigger-wireless-application-protocol-wap-carrier-billing/"
    },
    {
      "source_name": "BlackHat Sutter Android Foreground 2019",
      "url": "https://i.blackhat.com/eu-19/Thursday/eu-19-Sutter-Simple-Spyware-Androids-Invisible-Foreground-Services-And-How-To-Abuse-Them.pdf"
    },
    {
      "source_name": "NIST Mobile Threat Catalogue",
      "url": "https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-19.html",
      "external_id": "APP-19"
    }
  ]
}

Explicit source assertions (7)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.