MITRE ATT&CKtechnique

T1422 System Network Configuration Discovery

Published 2017-10-25 Modified 2026-05-12 Official page ↗
Domain
mobile
Tactics
Discovery
Platforms
Android, iOS
Version
2.4
Created
2017-10-25

Description

Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of devices they access or through information discovery of remote systems. Adversaries may use the information from System Network Configuration Discovery during automated discovery to shape follow-on behaviors, including determining certain access within the target network and what actions to do next. On Android, details of onboard network interfaces are accessible to apps through the `java.net.NetworkInterface` class. Previously, the Android `TelephonyManager` class could be used to gather telephony-related device identifiers, information such as the IMSI, IMEI, and phone number. However, starting with Android 10, only preloaded, carrier, the default SMS, or device and profile owner applications can access the telephony-related device identifiers. On iOS, gathering network configuration information is not possible without root access. Adversaries may use the information from System Network Configuration Discovery during automated discovery to shape follow-on behaviors, including determining certain access within the target network and what actions to do next.

Related

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (1)

  • M1006 Use Recent OS Version mitigation

Referenced by MITRE ATT&CK · subtechnique of (2)

  • T1422.002 Wi-Fi Discovery sub-technique
  • T1422.001 Internet Connection Discovery sub-technique

Referenced by MITRE ATT&CK · uses (48)

  • S9005 DocSwap software (malware)
  • S1241 RatMilad software (malware)
  • S1231 GodFather software (malware)
  • C0054 Operation Triangulation campaign
  • S1215 Binary Validator software (malware)
  • S1216 TriangleDB software (malware)
  • S1214 Android/SpyAgent software (malware)
  • S1185 LightSpy software (malware)
  • G1028 APT-C-23 group
  • S1093 FlyTrap software (malware)
  • S1082 Sunbird software (malware)
  • S1079 BOULDSPY software (malware)
  • S1077 Hornbill software (malware)
  • S1061 AbstractEmu software (malware)
  • S1056 TianySpy software (malware)
  • S0577 FrozenCell software (malware)
  • S0545 TERRACOTTA software (malware)
  • S0540 Asacub software (malware)
  • S0536 GPlayed software (malware)
  • S0535 Golden Cup software (malware)
  • S0529 CarbonSteal software (malware)
  • S0522 Exobot software (malware)
  • S0509 FakeSpy software (malware)
  • S0506 ViperRAT software (malware)
  • S0489 WolfRAT software (malware)
  • S0490 XLoader for iOS software (malware)
  • S0478 EventBot software (malware)
  • S0463 INSOMNIA software (malware)
  • S0432 Bread software (malware)
  • S0425 Corona Updates software (malware)
Show all 48 ›

References