Skip to content

Software Discovery

Technique · ATTACK:mobile:T1418

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:mobile:T1418",
  "title": "Software Discovery",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1418",
  "snapshot": "mobile-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--198ce408-1470-45ee-b47f-7056050d4fc2",
  "external_id": "T1418",
  "domain": "mobile",
  "created": "2017-10-25T14:48:28.067Z",
  "modified": "2026-05-12T15:12:00.622Z",
  "version": "2.1",
  "aliases": [

  ],
  "tactics": [
    "discovery"
  ],
  "source_references": [
    {
      "source_name": "NIST Mobile Threat Catalogue",
      "url": "https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-12.html",
      "external_id": "APP-12"
    }
  ]
}

Explicit source assertions (55)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:mobile:C0054 → uses → ATTACK:mobile:T1418

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--01563962-2ccb-4bbc-8ef7-512a950ea47c

SecureList OpTriangulation 21Jun2023

ATTACK:mobile:S1062 → uses → ATTACK:mobile:T1418

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--046acda0-91de-4385-bcfb-157570d8e51d

cleafy_sova_1122

ATTACK:mobile:S1241 → uses → ATTACK:mobile:T1418

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--052576f4-0b54-44be-840d-a9c8bb7cb980

ZimperiumGupta_RatMilad_Oct2022

ATTACK:mobile:T1418.001 → subtechnique-of → ATTACK:mobile:T1418

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--17adf4c2-e278-41fc-9183-cda5c8b74de7

ATTACK:mobile:S0505 → uses → ATTACK:mobile:T1418

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1b7be26d-cb1d-497b-94bf-a34f11ed66c9

Lookout Desert Scorpion

ATTACK:mobile:S1069 → uses → ATTACK:mobile:T1418

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--22041a01-75e7-4ff6-8768-ad45188c53c7

cloudmark_tanglebot_0921

ATTACK:mobile:S1225 → uses → ATTACK:mobile:T1418

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2305ceb7-f237-42bb-9a45-e245d8f82cde

TrendMicro_CherryBlos_July2023

ATTACK:mobile:S0399 → uses → ATTACK:mobile:T1418

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2341fdfa-9699-4798-a35a-2cc4f150cd14

Lookout Dark Caracal Jan 2018

ATTACK:mobile:S0489 → uses → ATTACK:mobile:T1418

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--33316f49-f1fb-453a-9ba7-d6889982a010

ATTACK:mobile:S0509 → uses → ATTACK:mobile:T1418

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3ca453a4-bd78-4087-a93f-9261fb2e3f00

Cybereason FakeSpy

ATTACK:mobile:S1216 → uses → ATTACK:mobile:T1418

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3ee5c123-416f-4d02-920d-ce44be7f11a5

SecureList OpTriangulation 21Jun2023

ATTACK:mobile:S0529 → uses → ATTACK:mobile:T1418

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--43eeee7f-339a-4f6e-9df3-ccbf08ecf358

Lookout Uyghur Campaign

ATTACK:mobile:S0403 → uses → ATTACK:mobile:T1418

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4e7a1b10-0f68-4a48-a13d-0c7bc13fb819

Kaspersky Riltok June 2019

ATTACK:mobile:S0427 → uses → ATTACK:mobile:T1418

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4efa4953-7854-4144-8837-d7831ccbe35d

SecurityIntelligence TrickMo

ATTACK:mobile:S0418 → uses → ATTACK:mobile:T1418

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--50bab448-fee6-49e9-a296-498fe06eacc7

SecureList - ViceLeaker 2019

ATTACK:mobile:S0536 → uses → ATTACK:mobile:T1418

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--50f03c00-5488-49fe-a527-a8776e526523

ATTACK:mobile:S0544 → uses → ATTACK:mobile:T1418

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5417959b-9478-49fb-b779-3c82a10ad080

Palo Alto HenBox

ATTACK:mobile:S0478 → uses → ATTACK:mobile:T1418

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5a2bff26-f5e5-41f9-b3da-a558988ef3f3

Cybereason EventBot

ATTACK:mobile:S0424 → uses → ATTACK:mobile:T1418

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5b5586b9-75ee-476f-b3eb-49878254302c

Google Triada June 2019

ATTACK:mobile:S1083 → uses → ATTACK:mobile:T1418

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6315b6ec-35f8-4b28-8603-664664311a33

cyble_chameleon_0423

ATTACK:mobile:S0463 → uses → ATTACK:mobile:T1418

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6a715733-cde6-4903-b967-35562b584c6f

Google Project Zero Insomnia

ATTACK:mobile:S0440 → uses → ATTACK:mobile:T1418

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6a821e14-8247-408b-af37-9cecbba616ec

CheckPoint Agent Smith

ATTACK:mobile:S1215 → uses → ATTACK:mobile:T1418

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6bdc24f1-36a7-4cf8-8a3e-f7f36840a7b2

SecureList OpTriangulation 23Oct2023

ATTACK:mobile:S0422 → uses → ATTACK:mobile:T1418

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6c35f99c-153d-4023-a29a-821488ce5418

ATTACK:mobile:S0479 → uses → ATTACK:mobile:T1418

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6f30b02b-5d88-453d-af1e-305a75bfaf87

ESET DEFENSOR ID

ATTACK:mobile:C0033 → uses → ATTACK:mobile:T1418

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--717feaf1-493b-4a3e-b886-40652f41168d

welivesec_strongpity

ATTACK:mobile:S0525 → uses → ATTACK:mobile:T1418

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--77efa84c-5ef0-4554-b774-2dbfcca74087

WeLiveSecurity AdDisplayAshas

ATTACK:mobile:M1011 → mitigates → ATTACK:mobile:T1418

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--828417ec-c444-41c8-95b4-c339c5ecf62b

ATTACK:mobile:S0558 → uses → ATTACK:mobile:T1418

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8b27a786-b4d9-4014-a249-3725442f9f1d

Zscaler TikTok Spyware

ATTACK:mobile:S1077 → uses → ATTACK:mobile:T1418

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8bcc9da8-c390-4151-b72d-30604820673e

lookout_hornbill_sunbird_0221

ATTACK:mobile:S1061 → uses → ATTACK:mobile:T1418

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8d72c224-0cf5-4b9b-a98a-76ee3a406803

lookout_abstractemu_1021

ATTACK:mobile:S0411 → uses → ATTACK:mobile:T1418

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8ec03f4c-5ed8-4c25-956c-3ee6c777a5cc

securelist rotexy 2018

ATTACK:mobile:S0423 → uses → ATTACK:mobile:T1418

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a04dfb58-b7d3-4abe-9f4a-fad4f7158965

ThreatFabric Ginp

ATTACK:mobile:S0545 → uses → ATTACK:mobile:T1418

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a1fac829-275a-409a-9060-e7bd7c63057e

WhiteOps TERRACOTTA

ATTACK:mobile:S1082 → uses → ATTACK:mobile:T1418

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a466f8f0-c9da-46d1-80d0-b8654e727526

lookout_hornbill_sunbird_0221

ATTACK:mobile:S0421 → uses → ATTACK:mobile:T1418

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a9689f2c-ad8f-4861-8cad-d78e07fd1530

Trend Micro Bouncing Golf 2019

ATTACK:mobile:S0480 → uses → ATTACK:mobile:T1418

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b24553a7-01c7-49b2-b1e0-fb961e788de2

Threat Fabric Cerberus

ATTACK:mobile:M1006 → mitigates → ATTACK:mobile:T1418

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b247a4f6-3629-4123-84b0-c7c5b3e7e37e

Android Package Visibility

ATTACK:mobile:S0485 → uses → ATTACK:mobile:T1418

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--baa82c0a-b51c-4d4a-ae1d-6d6fd637f78d

Bitdefender Mandrake

ATTACK:mobile:S1231 → uses → ATTACK:mobile:T1418

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c3e1aa57-a721-488f-8ac7-4fcb0f987153

MerkleScience_Godfather_April2023 · ZimperiumOrtegaPratapagiri_GodFather_Jun2025

ATTACK:mobile:S0408 → uses → ATTACK:mobile:T1418

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c58a26af-cc4c-41a2-b884-9a4fa8a2ad5c

FlexiSpy-Features

ATTACK:mobile:S0551 → uses → ATTACK:mobile:T1418

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cda58372-ae70-4716-8baf-cc06cb884ad6

Lookout Uyghur Campaign

ATTACK:mobile:S0535 → uses → ATTACK:mobile:T1418

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d562ed4d-ac4d-476b-872e-9e228c580889

Symantec GoldenCup

ATTACK:mobile:S1079 → uses → ATTACK:mobile:T1418

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dcf01e96-1498-4ebf-b46f-d4f4eb796f23

lookout_bouldspy_0423

ATTACK:mobile:S0311 → uses → ATTACK:mobile:T1418

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e0c3afc8-4b23-45fc-89cf-2cafbb51291e

paloalto_yispecter_1015

ATTACK:mobile:S9004 → uses → ATTACK:mobile:T1418

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e43098c9-bbdf-4330-baf2-1d04f93255ba

ThreatFabric_Crocodilus_March2025

ATTACK:mobile:S9005 → uses → ATTACK:mobile:T1418

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e964979d-7664-4897-8fcc-4f67ed494a37

S2W_DocSwap_Mar2025

ATTACK:mobile:S0550 → uses → ATTACK:mobile:T1418

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e9c5deb9-30d4-4bc3-98ca-6089d4b74b1e

Lookout Uyghur Campaign

ATTACK:mobile:S1185 → uses → ATTACK:mobile:T1418

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ec30f169-9cf3-45c3-9a02-cda318107ba9

LinkedIn Dmitry LightSpy 2025 · MelikovBlackBerry LightSpy 2024 · Threatfabric LightSpy 2023 · Threatfabric LightSpy 2024

ATTACK:mobile:S0539 → uses → ATTACK:mobile:T1418

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f4cc3b3a-284d-4a2d-9ab8-e7fa916c4012

Sophos Red Alert 2.0

ATTACK:mobile:S0328 → uses → ATTACK:mobile:T1418

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f552ee2f-5e6a-47a1-b6a5-d5e5594feb0d

Lookout-StealthMango

ATTACK:mobile:S9006 → uses → ATTACK:mobile:T1418

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f5b153b3-9392-4c5a-aa96-ae7efb9f7ad9

K7Dhanalakshmi_VajraSpy_April2022 · ESET_VajraSpy_Feb2024

ATTACK:mobile:S0316 → uses → ATTACK:mobile:T1418

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f5fab17b-43e7-46ff-bdea-eb8c52a0c6c3

Lookout-PegasusAndroid

ATTACK:mobile:S0407 → uses → ATTACK:mobile:T1418

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f65087b4-adf2-4292-a711-7ae829e91397

Lookout-Monokle

ATTACK:mobile:S0405 → uses → ATTACK:mobile:T1418

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fc22c1f0-6888-43c0-ac7e-ee3d21feafc4

SWB Exodus March 2019

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.