MITRE ATT&CKtechnique

T1420 File and Directory Discovery

Published 2017-10-25 Modified 2026-05-12 Official page ↗
Domain
mobile
Tactics
Discovery
Platforms
Android, iOS
Version
1.2
Created
2017-10-25

Description

Adversaries may enumerate files and directories or search in specific device locations for desired information within a filesystem. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including deciding if the adversary should fully infect the target and/or attempt specific actions. On Android, Linux file permissions and SELinux policies typically stringently restrict what can be accessed by apps without taking advantage of a privilege escalation exploit. The contents of the external storage directory are generally visible, which could present concerns if sensitive data is inappropriately stored there. iOS's security architecture generally restricts the ability to perform any type of File and Directory Discovery without use of escalated privileges.

Related

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (1)

  • M1006 Use Recent OS Version mitigation

Referenced by MITRE ATT&CK · uses (21)

  • S9030 SameCoin software (malware)
  • S9006 VajraSpy software (malware)
  • S9005 DocSwap software (malware)
  • S1241 RatMilad software (malware)
  • S1225 CherryBlos software (malware)
  • C0054 Operation Triangulation campaign
  • S1216 TriangleDB software (malware)
  • C0033 C0033 campaign
  • S1095 AhRat software (malware)
  • S1092 Escobar software (malware)
  • S1077 Hornbill software (malware)
  • C0016 Operation Dust Storm campaign
  • S0577 FrozenCell software (malware)
  • S0558 Tiktok Pro software (malware)
  • S0549 SilkBean software (malware)
  • S0550 DoubleAgent software (malware)
  • S0551 GoldenEagle software (malware)
  • S0535 Golden Cup software (malware)
  • S0529 CarbonSteal software (malware)
  • S0505 Desert Scorpion software (malware)
  • G0112 Windshift group

References