MITRE ATT&CKtechnique

T1424 Process Discovery

Published 2017-10-25 Modified 2025-10-24 Official page ↗
Domain
mobile
Tactics
Discovery
Platforms
Android, iOS
Version
2.1
Created
2017-10-25

Description

Adversaries may attempt to get information about running processes on a device. Information obtained could be used to gain an understanding of common software/applications running on devices within a network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Recent Android security enhancements have made it more difficult to obtain a list of running processes. On Android 7 and later, there is no way for an application to obtain the process list without abusing elevated privileges. This is due to the Android kernel utilizing the `hidepid` mount feature. Prior to Android 7, applications could utilize the `ps` command or examine the `/proc` directory on the device. In iOS, applications have previously been able to use the `sysctl` command to obtain a list of running processes. This functionality has been removed in later iOS versions.

Related

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (2)

  • M1002 Attestation mitigation
  • M1006 Use Recent OS Version mitigation

Referenced by MITRE ATT&CK · uses (13)

  • S1225 CherryBlos software (malware)
  • C0054 Operation Triangulation campaign
  • S1215 Binary Validator software (malware)
  • S1216 TriangleDB software (malware)
  • S1185 LightSpy software (malware)
  • S1055 SharkBot software (malware)
  • S0544 HenBox software (malware)
  • S0489 WolfRAT software (malware)
  • S0440 Agent Smith software (malware)
  • S0422 Anubis software (malware)
  • S0421 GolfSpy software (malware)
  • S0411 Rotexy software (malware)
  • S0311 YiSpecter software (malware)

References