MITRE ATT&CKsub-technique

T1422.001 Internet Connection Discovery

Published 2024-02-20 Modified 2024-02-20 Official page ↗
Domain
mobile
Tactics
Discovery
Platforms
Android, iOS
Version
1.0
Created
2024-02-20

Description

Adversaries may check for Internet connectivity on compromised systems. This may be performed during automated discovery and can be accomplished in numerous ways such as using `adb shell netstat` for Android. Adversaries may use the results and responses from these requests to determine if the mobile devices are capable of communicating with adversary-owned C2 servers before attempting to connect to them. The results may also be used to identify routes, redirectors, and proxy servers.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1422 System Network Configuration Discovery technique

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (1)

  • M1009 Encrypt Network Traffic mitigation

Referenced by MITRE ATT&CK · uses (19)

  • S1093 FlyTrap software (malware)
  • S1079 BOULDSPY software (malware)
  • S1077 Hornbill software (malware)
  • S1061 AbstractEmu software (malware)
  • S1056 TianySpy software (malware)
  • S0545 TERRACOTTA software (malware)
  • S0540 Asacub software (malware)
  • S0529 CarbonSteal software (malware)
  • S0522 Exobot software (malware)
  • S0509 FakeSpy software (malware)
  • S0506 ViperRAT software (malware)
  • S0478 EventBot software (malware)
  • S0463 INSOMNIA software (malware)
  • S0425 Corona Updates software (malware)
  • S0427 TrickMo software (malware)
  • S0407 Monokle software (malware)
  • S0405 Exodus software (malware)
  • S0326 RedDrop software (malware)
  • S0316 Pegasus for Android software (malware)

References