MITRE ATT&CKtechnique

T1421 System Network Connections Discovery

Published 2017-10-25 Modified 2025-10-24 Official page ↗
Domain
mobile
Tactics
Discovery
Platforms
Android
Version
2.1
Created
2017-10-25

Description

Adversaries may attempt to get a listing of network connections to or from the compromised device they are currently accessing or from remote systems by querying for information over the network. This is typically accomplished by utilizing device APIs to collect information about nearby networks, such as Wi-Fi, Bluetooth, and cellular tower connections. On Android, this can be done by querying the respective APIs: • `WifiInfo` for information about the current Wi-Fi connection, as well as nearby Wi-Fi networks. Querying the `WiFiInfo` API requires the application to hold the `ACCESS_FINE_LOCATION` permission. • `BluetoothAdapter` for information about Bluetooth devices, which also requires the application to hold several permissions granted by the user at runtime. • For Android versions prior to Q, applications can use the `TelephonyManager.getNeighboringCellInfo()` method. For Q and later, applications can use the `TelephonyManager.getAllCellInfo()` method. Both methods require the application hold the `ACCESS_FINE_LOCATION` permission.

Related

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · uses (10)

  • S9040 NGate software (malware)
  • S1185 LightSpy software (malware)
  • C0033 C0033 campaign
  • S0509 FakeSpy software (malware)
  • S0506 ViperRAT software (malware)
  • S0407 Monokle software (malware)
  • S0408 FlexiSpy software (tool)
  • S0405 Exodus software (malware)
  • S0399 Pallas software (malware)
  • S0289 Pegasus for iOS software (malware)