aol.pm

Process Discovery

Technique · ATTACK:mobile:T1424

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:mobile:T1424",
  "title": "Process Discovery",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1424",
  "snapshot": "mobile-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--1b51f5bc-b97a-498a-8dbd-bc6b1901bf19",
  "external_id": "T1424",
  "domain": "mobile",
  "created": "2017-10-25T14:48:33.926Z",
  "modified": "2025-10-24T17:48:28.244Z",
  "version": "2.1",
  "aliases": [

  ],
  "tactics": [
    "discovery"
  ],
  "source_references": [
    {
      "source_name": "Android-SELinuxChanges",
      "url": "https://code.google.com/p/android/issues/detail?id=205565"
    }
  ]
}

Explicit source assertions (15)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:mobile:M1006 → mitigates → ATTACK:mobile:T1424

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--024f9ee4-cb7d-49f4-b180-ad1e5e168a4c

ATTACK:mobile:S1225 → uses → ATTACK:mobile:T1424

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--18c212f3-8c21-427c-9654-ebffbf33fac7

TrendMicro_CherryBlos_July2023

ATTACK:mobile:S1055 → uses → ATTACK:mobile:T1424

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--23a67f24-a8eb-4e31-acf1-11cb5e9f88b2

nccgroup_sharkbot_0322

ATTACK:mobile:S0422 → uses → ATTACK:mobile:T1424

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--35453bbb-c9b3-4421-8452-95efdd290d21

Zimperium z9

ATTACK:mobile:S1216 → uses → ATTACK:mobile:T1424

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4667e169-d85a-4d0c-9da7-2fe22d1ba873

SecureList OpTriangulation 21Jun2023

ATTACK:mobile:S0311 → uses → ATTACK:mobile:T1424

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4a608d3b-aa02-4563-8b6b-c64a491856f5

paloalto_yispecter_1015

ATTACK:mobile:S0440 → uses → ATTACK:mobile:T1424

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5107be8a-b5fc-4442-af0d-2c92e086a912

CheckPoint Agent Smith

ATTACK:mobile:S1185 → uses → ATTACK:mobile:T1424

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--526099a3-132d-430f-9559-fc067e39b227

LinkedIn Dmitry LightSpy 2025 · Threatfabric LightSpy 2024

ATTACK:mobile:C0054 → uses → ATTACK:mobile:T1424

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--618ec7db-fb08-4693-905b-49e9e2a0ad95

SecureList OpTriangulation 21Jun2023

ATTACK:mobile:S0544 → uses → ATTACK:mobile:T1424

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9d264e84-27b2-4867-82c8-55486a969d7c

Palo Alto HenBox

ATTACK:mobile:S0411 → uses → ATTACK:mobile:T1424

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9d4c1d68-3cc8-4cf9-b3ee-1525d0ce32de

securelist rotexy 2018

ATTACK:mobile:S0489 → uses → ATTACK:mobile:T1424

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a1814198-1f91-41d4-a413-d55e1a66c8e9

Talos-WolfRAT

ATTACK:mobile:M1002 → mitigates → ATTACK:mobile:T1424

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a8bf6bbd-88f0-4725-ba4f-3b9317dca388

ATTACK:mobile:S1215 → uses → ATTACK:mobile:T1424

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--adbacfe1-1d78-4652-b32c-4d31a0c33ef3

SecureList OpTriangulation 23Oct2023

ATTACK:mobile:S0421 → uses → ATTACK:mobile:T1424

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cd6a9777-a8fd-43ca-91dc-cafc7d4b7df3

Trend Micro Bouncing Golf 2019

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.