Home/ATT&CK Technique/Software Discovery
MOBILE ATT&CK

Software Discovery

T1418 · discovery

Adversaries may attempt to get a listing of applications that are installed on a device. Adversaries may use the information from Software Discovery during automated discovery to shape follow-on behaviors, including whether or not to fully infect the target and/or attempts specific actions. Adversaries may attempt to enumerate applications for a variety of reasons, such as figuring out what security measures are present or to identify the presence of target applications.

AndroidiOS
◆

Actors Using This

3
italyCy4Gate
italyeSurv
italyNegg Group
◈

Likely Attack Path

Techniques the same actors pair with this one distinctively - those showing up among actors who use this technique noticeably more than across all actors (lift > 1.15), grouped by kill-chain phase. The × is that lift multiplier; the shared-actor count is in the tooltip. A near-universal technique pairs with everything at baseline, so its list is short by design.
initial-access earlier
T1458 · Replication Through Removable Media ×59.50
defense-evasion earlier
T1406 · Obfuscated Files or Information ×59.50T1628.001 · Suppress Application Icon ×59.50
collection later
T1414 · Clipboard Data ×59.50T1512 · Video Capture ×59.50T1513 · Screen Capture ×59.50T1517 · Access Notifications ×59.50T1636.001 · Calendar Entries ×47.60T1636.002 · Call Log ×47.60T1636.003 · Contact List ×47.60T1636.004 · SMS Messages ×47.60T1409 · Stored Application Data ×21.64T1430.001 · Remote Device Management Services ×21.64T1429 · Audio Capture ×18.31T1430 · Location Tracking ×11.90
◈

Detection Coverage

0/6 layers
Coverage across standard detection surfaces. Rows marked none have no rule of that type mapped. Some are real blind spots worth closing; others are simply not applicable to this technique (e.g. YARA matches malware files, not network behaviour).
Behavioral / log (Sigma) none
Analytics (MITRE CAR) none
Runtime / container (Falco) none
File / malware (YARA) none
Network (Suricata/Snort) none
Vuln scan (Nuclei) none
Intelligence Graph · click any node to traverse
CVETechnique ActorTool Family
drag to reposition · click any node to traverse · button top-right enlarges
External lookups - second-class, for what we don’t hold ourselves
MITRE ATT&CKAtomic Red Teamcar (MITRE)
Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities
Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs
Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures
Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1
About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service
threatengine.sh  ·  Open-source threat intelligence platform  ·  100+ authoritative sources  ·  Every fact traces to its origin