T1636.001 Calendar Entries
Adversaries may utilize standard operating system APIs to gather calendar entry data. On Android, this can be accomplished using the Calendar Content Provider. On iOS, this can be accomplished using the EventKit framework.
If the device has been jailbroken or rooted, an adversary may be able to access Calendar Entries without the user’s knowledge or approval.
| Item | Value |
|---|---|
| ID | T1636.001 |
| Sub-techniques | T1636.001, T1636.002, T1636.003, T1636.004, T1636.005 |
| Tactics | TA0035 |
| Platforms | Android, iOS |
| Version | 1.1 |
| Created | 01 April 2022 |
| Last Modified | 24 October 2025 |
Procedure Examples
| ID | Name | Description |
|---|---|---|
| S0405 | Exodus | Exodus Two can exfiltrate calendar events.2 |
| S0408 | FlexiSpy | FlexiSpy can collect the device calendars.1 |
| S0407 | Monokle | Monokle can retrieve calendar event information including the event name, when and where it is taking place, and the description.5 |
| S0316 | Pegasus for Android | Pegasus for Android accesses calendar entries.4 |
| S0328 | Stealth Mango | Stealth Mango uploads calendar events and reminders.3 |
| S1082 | Sunbird | Sunbird can exfiltrate calendar information.6 |
Mitigations
| ID | Mitigation | Description |
|---|---|---|
| M1011 | User Guidance | Calendar access is an uncommonly needed permission, so users should be instructed to use extra scrutiny when granting access to their device calendar. |
References
-
Actis B. (2017, April 22). FlexSpy Application Analysis. Retrieved September 4, 2019. ↩
-
Security Without Borders. (2019, March 29). Exodus: New Android Spyware Made in Italy. Retrieved November 17, 2024. ↩
-
Lookout. (n.d.). Stealth Mango & Tangelo. Retrieved September 27, 2018. ↩
-
Mike Murray. (2017, April 3). Pegasus for Android: the other side of the story emerges. Retrieved April 16, 2017. ↩
-
Bauer A., Kumar A., Hebeisen C., et al. (2019, July). Monokle: The Mobile Surveillance Tooling of the Special Technology Center. Retrieved September 4, 2019. ↩
-
Apurva Kumar, Kristin Del Rosso. (2021, February 10). Novel Confucius APT Android Spyware Linked to India-Pakistan Conflict. Retrieved June 9, 2023. ↩