MITRE ATT&CKtechnique

T1418 Software Discovery

Published 2017-10-25 Modified 2026-05-12 Official page ↗
Domain
mobile
Tactics
Discovery
Platforms
Android, iOS
Version
2.1
Created
2017-10-25

Description

Adversaries may attempt to get a listing of applications that are installed on a device. Adversaries may use the information from Software Discovery during automated discovery to shape follow-on behaviors, including whether or not to fully infect the target and/or attempts specific actions. Adversaries may attempt to enumerate applications for a variety of reasons, such as figuring out what security measures are present or to identify the presence of target applications.

Related

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (2)

  • M1011 User Guidance mitigation
  • M1006 Use Recent OS Version mitigation

Referenced by MITRE ATT&CK · subtechnique of (1)

  • T1418.001 Security Software Discovery sub-technique

Referenced by MITRE ATT&CK · uses (52)

  • S9006 VajraSpy software (malware)
  • S9005 DocSwap software (malware)
  • S9004 Crocodilus software (malware)
  • S1241 RatMilad software (malware)
  • S1231 GodFather software (malware)
  • S1225 CherryBlos software (malware)
  • C0054 Operation Triangulation campaign
  • S1215 Binary Validator software (malware)
  • S1216 TriangleDB software (malware)
  • S1185 LightSpy software (malware)
  • C0033 C0033 campaign
  • S1083 Chameleon software (malware)
  • S1082 Sunbird software (malware)
  • S1079 BOULDSPY software (malware)
  • S1077 Hornbill software (malware)
  • S1069 TangleBot software (malware)
  • S1061 AbstractEmu software (malware)
  • S1062 S.O.V.A. software (malware)
  • S0558 Tiktok Pro software (malware)
  • S0550 DoubleAgent software (malware)
  • S0551 GoldenEagle software (malware)
  • S0545 TERRACOTTA software (malware)
  • S0544 HenBox software (malware)
  • S0539 Red Alert 2.0 software (malware)
  • S0536 GPlayed software (malware)
  • S0535 Golden Cup software (malware)
  • S0529 CarbonSteal software (malware)
  • S0525 Android/AdDisplay.Ashas software (malware)
  • S0509 FakeSpy software (malware)
  • S0505 Desert Scorpion software (malware)
Show all 52 ›

References