{"source_checked_on":"2026-10-19","schema_version":1,"key":"mobile/T1418","id":"T1418","name":"Software Discovery","domain":"mobile","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1418","source_file":{"file":"mobile.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/mobile-attack/mobile-attack-20.0.json","sha256":"824f7d8a37e7893b29e4c6ca6d87b5fbbf3b228ec6384f1a69ee20d523ff59e5","bytes":6095145},"source_object_sha256":"4e0055295bfb8b92d565ab1eed0a93e1433b412dbcfeab44fea731c5b582e9b4","description":"Adversaries may attempt to get a listing of applications that are installed on a device. Adversaries may use the information from [Software Discovery](https://attack.mitre.org/techniques/T1418) during automated discovery to shape follow-on behaviors, including whether or not to fully infect the target and/or attempts specific actions. \n\n \n\nAdversaries may attempt to enumerate applications for a variety of reasons, such as figuring out what security measures are present or to identify the presence of target applications. ","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1418","external_id":"T1418"},{"source_name":"NIST Mobile Threat Catalogue","url":"https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-12.html","external_id":"APP-12"}],"platforms":["Android","iOS"],"environments":["mobile"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[{"key":"mobile/T1418.001","id":"T1418.001","name":"Security Software Discovery","page":"techniques/mobile/T1418.001/"}],"telemetry":[{"id":"DC0112","name":"API Calls","page":"telemetry/DC0112/","kind":"attack_component","category":"Mobile lab instrumentation","description":"Instrumented mobile API calls and results relevant to an application behavior.","collection_focus":"Instrument selected APIs in the owned test app or approved research build; log caller, API, sanitized argument class and return status.","providers":[{"name":"Android logcat","scope":"Permitted logs from a consented test device/emulator; output depends on build, permissions and instrumentation.","source_id":"android_logs"},{"name":"Android dumpsys","scope":"Point-in-time service/package state on an authorized development device.","source_id":"android_state"},{"name":"Instrumented test application","scope":"Own-app permission, API and state callbacks; not universal visibility into other apps.","source_id":"android_permissions"}],"configuration":["Use a disposable emulator or owned development device with approved debugging. Record OS/API level, app version and instrumentation privileges.","Collect only relevant logcat buffers/tags and service snapshots; add explicit own-app instrumentation for events absent from OS logs.","Forward sanitized logs and compare before/after state. Remove test data and revoke debugging access after the lab session."],"configuration_example":null,"required_fields":["package","api","result","thread"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0112","collector":"illustrative-lab-collector","observation":{"package":"test.example.lab","api":"android.hardware.camera2.CameraManager.openCamera","result":"permission_denied","thread":"main"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Android tooling does not imply iOS coverage. Standard mobile apps cannot observe all other apps or protected OS internals; MDM status is not full API, filesystem or content telemetry.","sources":[{"id":"android_logs","title":"Android logcat and access limits","url":"https://developer.android.com/tools/logcat"},{"id":"android_state","title":"Android dumpsys","url":"https://developer.android.com/tools/dumpsys"},{"id":"android_permissions","title":"Android runtime permission requests","url":"https://developer.android.com/training/permissions/requesting"}],"association":"attack_component","anomaly_design":"Per owned device, app version and permission state: unexpected API/permission changes, background activity and network destinations. OS privacy restrictions and emulator differences limit observability."},{"id":"DC0123","name":"Application State","page":"telemetry/DC0123/","kind":"attack_component","category":"Mobile lab instrumentation","description":"Application state and lifecycle observations such as foreground/background transitions.","collection_focus":"Instrument the owned app lifecycle and corroborate permitted service snapshots; distinguish app events from inferred gateway activity.","providers":[{"name":"Android logcat","scope":"Permitted logs from a consented test device/emulator; output depends on build, permissions and instrumentation.","source_id":"android_logs"},{"name":"Android dumpsys","scope":"Point-in-time service/package state on an authorized development device.","source_id":"android_state"},{"name":"Instrumented test application","scope":"Own-app permission, API and state callbacks; not universal visibility into other apps.","source_id":"android_permissions"}],"configuration":["Use a disposable emulator or owned development device with approved debugging. Record OS/API level, app version and instrumentation privileges.","Collect only relevant logcat buffers/tags and service snapshots; add explicit own-app instrumentation for events absent from OS logs.","Forward sanitized logs and compare before/after state. Remove test data and revoke debugging access after the lab session."],"configuration_example":null,"required_fields":["package","state_before","state_after","source"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0123","collector":"illustrative-lab-collector","observation":{"package":"test.example.lab","state_before":"background","state_after":"foreground","source":"own_app_callback"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Android tooling does not imply iOS coverage. Standard mobile apps cannot observe all other apps or protected OS internals; MDM status is not full API, filesystem or content telemetry.","sources":[{"id":"android_logs","title":"Android logcat and access limits","url":"https://developer.android.com/tools/logcat"},{"id":"android_state","title":"Android dumpsys","url":"https://developer.android.com/tools/dumpsys"},{"id":"android_permissions","title":"Android runtime permission requests","url":"https://developer.android.com/training/permissions/requesting"}],"association":"attack_component","anomaly_design":"Per owned device, app version and permission state: unexpected API/permission changes, background activity and network destinations. OS privacy restrictions and emulator differences limit observability."},{"id":"DC0082","name":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component","category":"Endpoint activity","description":"Creation of an endpoint network connection linked to a process.","collection_focus":"Enable scoped Sysmon NetworkConnect (3), disabled by default, or a platform-equivalent process-aware network sensor.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_guid","destination_ip","destination_port","protocol","initiated"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"mobile/T1418","id":"T1418","name":"Software Discovery","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"source_url":"https://attack.mitre.org/techniques/T1418","technique_page":"techniques/mobile/T1418/","page":"detections/mobile/T1418/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0600","name":"Detection of Software Discovery","url":"https://attack.mitre.org/detectionstrategies/DET0600","stix_id":"x-mitre-detection-strategy--69ceab63-17ce-4e42-b247-055a180e6c2b","relationship_id":"relationship--42e5e24c-eeb3-46f3-99f1-81015cd4f34e","description":"","analytics":[{"id":"AN1646","name":"Analytic 1646","guidance":"For Android, detect Software Discovery by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: PackageManager.getInstalledPackages() or getInstalledApplications() called by app NOT IN $AppEnumAllowList$]; Application State via Android Enterprise / EMM [Managed package inventory/status and package metadata]; Network Connection Creation via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.","url":"https://attack.mitre.org/detectionstrategies/DET0600#AN1646","platforms":["Android"],"tuning":[{"field":"AppEnumAllowList","description":"MDM agent, system diagnostic apps. Minimal."},{"field":"AppCDNList","description":"Per-app CDN. Derive by measurement."},{"field":"FollowOnWindow","description":"Default 120s. Tightening: 30s."}],"log_sources":[{"component_id":"DC0112","component":"API Calls","name":"mobile:DynamicAnalysis","channel":"Dynamic API/runtime trace: PackageManager.getInstalledPackages() or getInstalledApplications() called by app NOT IN $AppEnumAllowList$","platforms":["Android"],"analytic_id":"AN1646","source_url":"https://attack.mitre.org/detectionstrategies/DET0600#AN1646","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0112/"},{"component_id":"DC0123","component":"Application State","name":"android:EMM","channel":"Managed package inventory/status and package metadata","platforms":["Android"],"analytic_id":"AN1646","source_url":"https://attack.mitre.org/detectionstrategies/DET0600#AN1646","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0123/"},{"component_id":"DC0082","component":"Network Connection Creation","name":"android:EnterpriseNetworkLog","channel":"DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata","platforms":["Android"],"analytic_id":"AN1646","source_url":"https://attack.mitre.org/detectionstrategies/DET0600#AN1646","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"}]},{"id":"AN1647","name":"Analytic 1647","guidance":"For iOS, detect Software Discovery by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: UIApplication.canOpenURL() called > $URLProbeThreshold$ times with schemes NOT declared in app's LSApplicationQueriesSchemes within $ProbeWindow$]; Application State via Apple MDM [InstalledApplicationList / ManagedApplicationList]; Network Connection Creation via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.","url":"https://attack.mitre.org/detectionstrategies/DET0600#AN1647","platforms":["iOS"],"tuning":[{"field":"URLProbeThreshold","description":"Default 10 undeclared scheme probes within window. iOS enforces 50-probe limit total."},{"field":"ProbeWindow","description":"Default 30s."},{"field":"AppCDNList","description":"Per-app CDN. Derive by measurement."},{"field":"FollowOnWindow","description":"Default 120s."}],"log_sources":[{"component_id":"DC0112","component":"API Calls","name":"mobile:DynamicAnalysis","channel":"Dynamic API/runtime trace: UIApplication.canOpenURL() called > $URLProbeThreshold$ times with schemes NOT declared in app's LSApplicationQueriesSchemes within $ProbeWindow$","platforms":["iOS"],"analytic_id":"AN1647","source_url":"https://attack.mitre.org/detectionstrategies/DET0600#AN1647","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0112/"},{"component_id":"DC0123","component":"Application State","name":"iOS:MDM","channel":"InstalledApplicationList / ManagedApplicationList","platforms":["iOS"],"analytic_id":"AN1647","source_url":"https://attack.mitre.org/detectionstrategies/DET0600#AN1647","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0123/"},{"component_id":"DC0082","component":"Network Connection Creation","name":"iOS:NetworkExtension","channel":"NEFilterFlow / per-app VPN / secure-web-gateway flow metadata","platforms":["iOS"],"analytic_id":"AN1647","source_url":"https://attack.mitre.org/detectionstrategies/DET0600#AN1647","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"}]}]}],"telemetry_references":[{"id":"DC0112","name":"API Calls","tag":"API Calls","page":"telemetry/DC0112/","kind":"attack_component"},{"id":"DC0123","name":"Application State","tag":"Application State","page":"telemetry/DC0123/","kind":"attack_component"},{"id":"DC0082","name":"Network Connection Creation","tag":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S0408","name":"FlexiSpy","page":"tools/S0408/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S0408","name":"FlexiSpy","page":"tools/S0408/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"software":[{"id":"S0311","name":"YiSpecter","url":"https://attack.mitre.org/software/S0311","kind":"malware","description":"[YiSpecter](https://attack.mitre.org/software/S0311) has collected information about installed applications.(Citation: paloalto_yispecter_1015)","relationship_id":"relationship--e0c3afc8-4b23-45fc-89cf-2cafbb51291e","references":[{"source_name":"paloalto_yispecter_1015","description":"Claud Xiao. (2015, October 4). YiSpecter: First iOS Malware That Attacks Non-jailbroken Apple iOS Devices by Abusing Private APIs. Retrieved March 3, 2023.","url":"https://unit42.paloaltonetworks.com/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/"}]},{"id":"S0316","name":"Pegasus for Android","url":"https://attack.mitre.org/software/S0316","kind":"malware","description":"[Pegasus for Android](https://attack.mitre.org/software/S0316) accesses the list of installed applications.(Citation: Lookout-PegasusAndroid)","relationship_id":"relationship--f5fab17b-43e7-46ff-bdea-eb8c52a0c6c3","references":[{"source_name":"Lookout-PegasusAndroid","description":"Mike Murray. (2017, April 3). Pegasus for Android: the other side of the story emerges. Retrieved April 16, 2017.","url":"https://blog.lookout.com/blog/2017/04/03/pegasus-android/"}]},{"id":"S0328","name":"Stealth Mango","url":"https://attack.mitre.org/software/S0328","kind":"malware","description":"[Stealth Mango](https://attack.mitre.org/software/S0328) uploads information about installed packages.(Citation: Lookout-StealthMango)","relationship_id":"relationship--f552ee2f-5e6a-47a1-b6a5-d5e5594feb0d","references":[{"source_name":"Lookout-StealthMango","description":"Lookout. (n.d.). Stealth Mango & Tangelo. Retrieved September 27, 2018.","url":"https://info.lookout.com/rs/051-ESQ-475/images/lookout-stealth-mango-srr-us.pdf"}]},{"id":"S0399","name":"Pallas","url":"https://attack.mitre.org/software/S0399","kind":"malware","description":"[Pallas](https://attack.mitre.org/software/S0399) retrieves a list of all applications installed on the device.(Citation: Lookout Dark Caracal Jan 2018)","relationship_id":"relationship--2341fdfa-9699-4798-a35a-2cc4f150cd14","references":[{"source_name":"Lookout Dark Caracal Jan 2018","description":"Blaich, A., et al. (2018, January 18). Dark Caracal: Cyber-espionage at a Global Scale. Retrieved April 11, 2018.","url":"https://info.lookout.com/rs/051-ESQ-475/images/Lookout_Dark-Caracal_srr_20180118_us_v.1.0.pdf"}]},{"id":"S0403","name":"Riltok","url":"https://attack.mitre.org/software/S0403","kind":"malware","description":"[Riltok](https://attack.mitre.org/software/S0403) can retrieve a list of installed applications. Installed application names are then checked against an adversary-defined list of targeted applications.(Citation: Kaspersky Riltok June 2019)","relationship_id":"relationship--4e7a1b10-0f68-4a48-a13d-0c7bc13fb819","references":[{"source_name":"Kaspersky Riltok June 2019","description":"Tatyana Shishkova. (2019, June 25). Riltok mobile Trojan: A banker with global reach. Retrieved August 7, 2019.","url":"https://securelist.com/mobile-banker-riltok/91374/"}]},{"id":"S0405","name":"Exodus","url":"https://attack.mitre.org/software/S0405","kind":"malware","description":" [Exodus](https://attack.mitre.org/software/S0405) Two can obtain a list of installed applications.(Citation: SWB Exodus March 2019) ","relationship_id":"relationship--fc22c1f0-6888-43c0-ac7e-ee3d21feafc4","references":[{"source_name":"SWB Exodus March 2019","description":"Security Without Borders. (2019, March 29). Exodus: New Android Spyware Made in Italy. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20200314194610/https://securitywithoutborders.org/blog/2019/03/29/exodus.html"}]},{"id":"S0407","name":"Monokle","url":"https://attack.mitre.org/software/S0407","kind":"malware","description":"[Monokle](https://attack.mitre.org/software/S0407) can list applications installed on the device.(Citation: Lookout-Monokle)","relationship_id":"relationship--f65087b4-adf2-4292-a711-7ae829e91397","references":[{"source_name":"Lookout-Monokle","description":"Bauer A., Kumar A., Hebeisen C., et al. (2019, July). Monokle: The Mobile Surveillance Tooling of the Special Technology Center. Retrieved September 4, 2019.","url":"https://www.lookout.com/documents/threat-reports/lookout-discovers-monokle-threat-report.pdf"}]},{"id":"S0408","name":"FlexiSpy","url":"https://attack.mitre.org/software/S0408","kind":"tool","description":" [FlexiSpy](https://attack.mitre.org/software/S0408) can retrieve a list of installed applications.(Citation: FlexiSpy-Features) ","relationship_id":"relationship--c58a26af-cc4c-41a2-b884-9a4fa8a2ad5c","references":[{"source_name":"FlexiSpy-Features","description":"FlexiSpy. (n.d.). FlexiSpy Monitoring Features. Retrieved September 4, 2019.","url":"https://www.flexispy.com/en/features-overview.htm"}]},{"id":"S0411","name":"Rotexy","url":"https://attack.mitre.org/software/S0411","kind":"malware","description":"[Rotexy](https://attack.mitre.org/software/S0411) retrieves a list of installed applications and sends it to the command and control server.(Citation: securelist rotexy 2018)","relationship_id":"relationship--8ec03f4c-5ed8-4c25-956c-3ee6c777a5cc","references":[{"source_name":"securelist rotexy 2018","description":"T. Shishkova, L. Pikman. (2018, November 22).  The Rotexy mobile Trojan – banker and ransomware. Retrieved September 23, 2019.","url":"https://securelist.com/the-rotexy-mobile-trojan-banker-and-ransomware/88893/"}]},{"id":"S0418","name":"ViceLeaker","url":"https://attack.mitre.org/software/S0418","kind":"malware","description":"[ViceLeaker](https://attack.mitre.org/software/S0418) can obtain a list of installed applications.(Citation: SecureList - ViceLeaker 2019)","relationship_id":"relationship--50bab448-fee6-49e9-a296-498fe06eacc7","references":[{"source_name":"SecureList - ViceLeaker 2019","description":"GReAT. (2019, June 26).  ViceLeaker Operation: mobile espionage targeting Middle East. Retrieved November 21, 2019.","url":"https://securelist.com/fanning-the-flames-viceleaker-operation/90877/"}]},{"id":"S0421","name":"GolfSpy","url":"https://attack.mitre.org/software/S0421","kind":"malware","description":"[GolfSpy](https://attack.mitre.org/software/S0421) can obtain a list of installed applications.(Citation: Trend Micro Bouncing Golf 2019)","relationship_id":"relationship--a9689f2c-ad8f-4861-8cad-d78e07fd1530","references":[{"source_name":"Trend Micro Bouncing Golf 2019","description":"E. Xu, G. Guo. (2019, June 28).  Mobile Cyberespionage Campaign ‘Bouncing Golf’ Affects Middle East. Retrieved January 27, 2020.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/mobile-cyberespionage-campaign-bouncing-golf-affects-middle-east/"}]},{"id":"S0422","name":"Anubis","url":"https://attack.mitre.org/software/S0422","kind":"malware","description":"[Anubis](https://attack.mitre.org/software/S0422) can collect a list of installed applications to compare to a list of targeted applications.(Citation: Cofense Anubis)","relationship_id":"relationship--6c35f99c-153d-4023-a29a-821488ce5418","references":[{"source_name":"Cofense Anubis","description":"M. Feller. (2020, February 5). Infostealer, Keylogger, and Ransomware in One: Anubis Targets More than 250 Android Applications. Retrieved September 25, 2024.","url":"https://web.archive.org/web/20231222134431/https://cofense.com/blog/infostealer-keylogger-ransomware-one-anubis-targets-250-android-applications/"}]},{"id":"S0423","name":"Ginp","url":"https://attack.mitre.org/software/S0423","kind":"malware","description":"[Ginp](https://attack.mitre.org/software/S0423) can obtain a list of installed applications.(Citation: ThreatFabric Ginp)","relationship_id":"relationship--a04dfb58-b7d3-4abe-9f4a-fad4f7158965","references":[{"source_name":"ThreatFabric Ginp","description":"ThreatFabric. (2019, November). Ginp - A malware patchwork borrowing from Anubis. Retrieved April 8, 2020.","url":"https://www.threatfabric.com/blogs/ginp_a_malware_patchwork_borrowing_from_anubis.html"}]},{"id":"S0424","name":"Triada","url":"https://attack.mitre.org/software/S0424","kind":"malware","description":"[Triada](https://attack.mitre.org/software/S0424) is able to modify code within the com.android.systemui application to gain access to `GET_REAL_TASKS` permissions. This permission enables access to information about applications currently on the foreground and other recently used apps.(Citation: Google Triada June 2019) ","relationship_id":"relationship--5b5586b9-75ee-476f-b3eb-49878254302c","references":[{"source_name":"Google Triada June 2019","description":"Lukasz Siewierski. (2019, June 6). PHA Family Highlights: Triada. Retrieved July 16, 2019.","url":"https://security.googleblog.com/2019/06/pha-family-highlights-triada.html"}]},{"id":"S0427","name":"TrickMo","url":"https://attack.mitre.org/software/S0427","kind":"malware","description":"[TrickMo](https://attack.mitre.org/software/S0427) can collect a list of installed applications.(Citation: SecurityIntelligence TrickMo)","relationship_id":"relationship--4efa4953-7854-4144-8837-d7831ccbe35d","references":[{"source_name":"SecurityIntelligence TrickMo","description":"P. Asinovsky. (2020, March 24). TrickBot Pushing a 2FA Bypass App to Bank Customers in Germany. Retrieved April 24, 2020.","url":"https://securityintelligence.com/posts/trickbot-pushing-a-2fa-bypass-app-to-bank-customers-in-germany/"}]},{"id":"S0440","name":"Agent Smith","url":"https://attack.mitre.org/software/S0440","kind":"malware","description":"[Agent Smith](https://attack.mitre.org/software/S0440) obtains the device’s application list.(Citation: CheckPoint Agent Smith)","relationship_id":"relationship--6a821e14-8247-408b-af37-9cecbba616ec","references":[{"source_name":"CheckPoint Agent Smith","description":"A. Hazum, F. He, I. Marom, B. Melnykov, A. Polkovnichenko. (2019, July 10). Agent Smith: A New Species of Mobile Malware. Retrieved May 7, 2020.","url":"https://research.checkpoint.com/2019/agent-smith-a-new-species-of-mobile-malware/"}]},{"id":"S0463","name":"INSOMNIA","url":"https://attack.mitre.org/software/S0463","kind":"malware","description":"[INSOMNIA](https://attack.mitre.org/software/S0463) can obtain a list of installed non-Apple applications.(Citation: Google Project Zero Insomnia)","relationship_id":"relationship--6a715733-cde6-4903-b967-35562b584c6f","references":[{"source_name":"Google Project Zero Insomnia","description":"I. Beer. (2019, August 29). Implant Teardown. Retrieved June 2, 2020.","url":"https://googleprojectzero.blogspot.com/2019/08/implant-teardown.html"}]},{"id":"S0478","name":"EventBot","url":"https://attack.mitre.org/software/S0478","kind":"malware","description":"[EventBot](https://attack.mitre.org/software/S0478) can collect a list of installed applications.(Citation: Cybereason EventBot)","relationship_id":"relationship--5a2bff26-f5e5-41f9-b3da-a558988ef3f3","references":[{"source_name":"Cybereason EventBot","description":"D. Frank, L. Rochberger, Y. Rimmer, A. Dahan. (2020, April 30). EventBot: A New Mobile Banking Trojan is Born. Retrieved June 26, 2020.","url":"https://www.cybereason.com/blog/eventbot-a-new-mobile-banking-trojan-is-born"}]},{"id":"S0479","name":"DEFENSOR ID","url":"https://attack.mitre.org/software/S0479","kind":"malware","description":"[DEFENSOR ID](https://attack.mitre.org/software/S0479) can retrieve a list of installed applications.(Citation: ESET DEFENSOR ID)","relationship_id":"relationship--6f30b02b-5d88-453d-af1e-305a75bfaf87","references":[{"source_name":"ESET DEFENSOR ID","description":"L. Stefanko. (2020, May 22). Insidious Android malware gives up all malicious features but one to gain stealth. Retrieved June 26, 2020.","url":"https://www.welivesecurity.com/2020/05/22/insidious-android-malware-gives-up-all-malicious-features-but-one-gain-stealth/"}]},{"id":"S0480","name":"Cerberus","url":"https://attack.mitre.org/software/S0480","kind":"malware","description":"[Cerberus](https://attack.mitre.org/software/S0480) can obtain a list of installed applications.(Citation: Threat Fabric Cerberus)","relationship_id":"relationship--b24553a7-01c7-49b2-b1e0-fb961e788de2","references":[{"source_name":"Threat Fabric Cerberus","description":"Threat Fabric. (2019, August). Cerberus - A new banking Trojan from the underworld. Retrieved June 26, 2020.","url":"https://www.threatfabric.com/blogs/cerberus-a-new-banking-trojan-from-the-underworld.html"}]},{"id":"S0485","name":"Mandrake","url":"https://attack.mitre.org/software/S0485","kind":"malware","description":"[Mandrake](https://attack.mitre.org/software/S0485) can obtain a list of installed applications.(Citation: Bitdefender Mandrake)","relationship_id":"relationship--baa82c0a-b51c-4d4a-ae1d-6d6fd637f78d","references":[{"source_name":"Bitdefender Mandrake","description":"R. Gevers, M. Tivadar, R. Bleotu, A. M. Barbatei, et al.. (2020, May 14). Uprooting Mandrake: The Story of an Advanced Android Spyware Framework That Went Undetected for 4 Years. Retrieved July 15, 2020.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/329/Bitdefender-PR-Whitepaper-Mandrake-creat4464-en-EN-interactive.pdf"}]},{"id":"S0489","name":"WolfRAT","url":"https://attack.mitre.org/software/S0489","kind":"malware","description":"[WolfRAT](https://attack.mitre.org/software/S0489) can obtain a list of installed applications.(Citation: Talos-WolfRAT)","relationship_id":"relationship--33316f49-f1fb-453a-9ba7-d6889982a010","references":[{"source_name":"Talos-WolfRAT","description":"W. Mercer, P. Rascagneres, V. Ventura. (2020, May 19).  The wolf is back... . Retrieved July 20, 2020.","url":"https://blog.talosintelligence.com/2020/05/the-wolf-is-back.html"}]},{"id":"S0505","name":"Desert Scorpion","url":"https://attack.mitre.org/software/S0505","kind":"malware","description":"[Desert Scorpion](https://attack.mitre.org/software/S0505) can obtain a list of installed applications.(Citation: Lookout Desert Scorpion)","relationship_id":"relationship--1b7be26d-cb1d-497b-94bf-a34f11ed66c9","references":[{"source_name":"Lookout Desert Scorpion","description":"A. Blaich, M. Flossman. (2018, April 16). Lookout finds new surveillanceware in Google Play with ties to known threat actor targeting the Middle East. Retrieved September 11, 2020.","url":"https://blog.lookout.com/desert-scorpion-google-play"}]},{"id":"S0509","name":"FakeSpy","url":"https://attack.mitre.org/software/S0509","kind":"malware","description":"[FakeSpy](https://attack.mitre.org/software/S0509) can collect a list of installed applications.(Citation: Cybereason FakeSpy)","relationship_id":"relationship--3ca453a4-bd78-4087-a93f-9261fb2e3f00","references":[{"source_name":"Cybereason FakeSpy","description":"O. Almkias. (2020, July 1). FakeSpy Masquerades as Postal Service Apps Around the World. Retrieved September 15, 2020.","url":"https://www.cybereason.com/blog/fakespy-masquerades-as-postal-service-apps-around-the-world"}]},{"id":"S0525","name":"Android/AdDisplay.Ashas","url":"https://attack.mitre.org/software/S0525","kind":"malware","description":"[Android/AdDisplay.Ashas](https://attack.mitre.org/software/S0525) has checked to see how many apps are installed, and specifically if Facebook or FB Messenger are installed.(Citation: WeLiveSecurity AdDisplayAshas)","relationship_id":"relationship--77efa84c-5ef0-4554-b774-2dbfcca74087","references":[{"source_name":"WeLiveSecurity AdDisplayAshas","description":"L. Stefanko. (2019, October 24). Tracking down the developer of Android adware affecting millions of users. Retrieved October 29, 2020.","url":"https://www.welivesecurity.com/2019/10/24/tracking-down-developer-android-adware/"}]},{"id":"S0529","name":"CarbonSteal","url":"https://attack.mitre.org/software/S0529","kind":"malware","description":"[CarbonSteal](https://attack.mitre.org/software/S0529) has looked for specific applications, such as MiCode.(Citation: Lookout Uyghur Campaign)","relationship_id":"relationship--43eeee7f-339a-4f6e-9df3-ccbf08ecf358","references":[{"source_name":"Lookout Uyghur Campaign","description":"A. Kumar, K. Del Rosso, J. Albrecht, C. Hebeisen. (2020, June 1). Mobile APT Surveillance Campaigns Targeting Uyghurs - A collection of long-running Android tooling connected to a Chinese mAPT actor. Retrieved November 10, 2020.","url":"https://www.lookout.com/documents/threat-reports/us/lookout-uyghur-malware-tr-us.pdf"}]},{"id":"S0535","name":"Golden Cup","url":"https://attack.mitre.org/software/S0535","kind":"malware","description":"[Golden Cup](https://attack.mitre.org/software/S0535) can obtain a list of installed applications.(Citation: Symantec GoldenCup)","relationship_id":"relationship--d562ed4d-ac4d-476b-872e-9e228c580889","references":[{"source_name":"Symantec GoldenCup","description":"R. Iarchy, E. Rynkowski. (2018, July 5). GoldenCup: New Cyber Threat Targeting World Cup Fans. Retrieved October 29, 2020.","url":"https://symantec-enterprise-blogs.security.com/blogs/expert-perspectives/goldencup-new-cyber-threat-targeting-world-cup-fans"}]},{"id":"S0536","name":"GPlayed","url":"https://attack.mitre.org/software/S0536","kind":"malware","description":"[GPlayed](https://attack.mitre.org/software/S0536) can collect a list of installed applications.(Citation: Talos GPlayed)","relationship_id":"relationship--50f03c00-5488-49fe-a527-a8776e526523","references":[{"source_name":"Talos GPlayed","description":"V. Ventura. (2018, October 11).  GPlayed Trojan - .Net playing with Google Market . Retrieved November 24, 2020.","url":"https://blog.talosintelligence.com/2018/10/gplayedtrojan.html"}]},{"id":"S0539","name":"Red Alert 2.0","url":"https://attack.mitre.org/software/S0539","kind":"malware","description":"[Red Alert 2.0](https://attack.mitre.org/software/S0539) can obtain the running application.(Citation: Sophos Red Alert 2.0)","relationship_id":"relationship--f4cc3b3a-284d-4a2d-9ab8-e7fa916c4012","references":[{"source_name":"Sophos Red Alert 2.0","description":"J. Chandraiah. (2018, July 23). Red Alert 2.0: Android Trojan targets security-seekers. Retrieved December 14, 2020.","url":"https://news.sophos.com/en-us/2018/07/23/red-alert-2-0-android-trojan-targets-security-seekers/"}]},{"id":"S0544","name":"HenBox","url":"https://attack.mitre.org/software/S0544","kind":"malware","description":"[HenBox](https://attack.mitre.org/software/S0544) can obtain a list of running apps.(Citation: Palo Alto HenBox)","relationship_id":"relationship--5417959b-9478-49fb-b779-3c82a10ad080","references":[{"source_name":"Palo Alto HenBox","description":"A. Hinchliffe, M. Harbison, J. Miller-Osborn, et al. (2018, March 13). HenBox: The Chickens Come Home to Roost. Retrieved September 9, 2019.","url":"https://unit42.paloaltonetworks.com/unit42-henbox-chickens-come-home-roost/"}]},{"id":"S0545","name":"TERRACOTTA","url":"https://attack.mitre.org/software/S0545","kind":"malware","description":"[TERRACOTTA](https://attack.mitre.org/software/S0545) can obtain a list of installed apps.(Citation: WhiteOps TERRACOTTA)","relationship_id":"relationship--a1fac829-275a-409a-9060-e7bd7c63057e","references":[{"source_name":"WhiteOps TERRACOTTA","description":"Satori Threat Intelligence and Research Team. (2020, August). TERRACOTTA Android Malware: A Technical Study. Retrieved December 18, 2020.","url":"https://www.whiteops.com/blog/terracotta-android-malware-a-technical-study"}]},{"id":"S0550","name":"DoubleAgent","url":"https://attack.mitre.org/software/S0550","kind":"malware","description":"[DoubleAgent](https://attack.mitre.org/software/S0550) has accessed the list of installed apps.(Citation: Lookout Uyghur Campaign)","relationship_id":"relationship--e9c5deb9-30d4-4bc3-98ca-6089d4b74b1e","references":[{"source_name":"Lookout Uyghur Campaign","description":"A. Kumar, K. Del Rosso, J. Albrecht, C. Hebeisen. (2020, June 1). Mobile APT Surveillance Campaigns Targeting Uyghurs - A collection of long-running Android tooling connected to a Chinese mAPT actor. Retrieved November 10, 2020.","url":"https://www.lookout.com/documents/threat-reports/us/lookout-uyghur-malware-tr-us.pdf"}]},{"id":"S0551","name":"GoldenEagle","url":"https://attack.mitre.org/software/S0551","kind":"malware","description":"[GoldenEagle](https://attack.mitre.org/software/S0551) has collected a list of installed application names.(Citation: Lookout Uyghur Campaign)","relationship_id":"relationship--cda58372-ae70-4716-8baf-cc06cb884ad6","references":[{"source_name":"Lookout Uyghur Campaign","description":"A. Kumar, K. Del Rosso, J. Albrecht, C. Hebeisen. (2020, June 1). Mobile APT Surveillance Campaigns Targeting Uyghurs - A collection of long-running Android tooling connected to a Chinese mAPT actor. Retrieved November 10, 2020.","url":"https://www.lookout.com/documents/threat-reports/us/lookout-uyghur-malware-tr-us.pdf"}]},{"id":"S0558","name":"Tiktok Pro","url":"https://attack.mitre.org/software/S0558","kind":"malware","description":"[Tiktok Pro](https://attack.mitre.org/software/S0558) can obtain a list of installed applications.(Citation: Zscaler TikTok Spyware)","relationship_id":"relationship--8b27a786-b4d9-4014-a249-3725442f9f1d","references":[{"source_name":"Zscaler TikTok Spyware","description":"S. Desai. (2020, September 8). TikTok Spyware. Retrieved January 5, 2021.","url":"https://www.zscaler.com/blogs/security-research/tiktok-spyware"}]},{"id":"S1061","name":"AbstractEmu","url":"https://attack.mitre.org/software/S1061","kind":"malware","description":"[AbstractEmu](https://attack.mitre.org/software/S1061) can obtain a list of installed applications.(Citation: lookout_abstractemu_1021)","relationship_id":"relationship--8d72c224-0cf5-4b9b-a98a-76ee3a406803","references":[{"source_name":"lookout_abstractemu_1021","description":"P Shunk, K Balaam. (2021, October 28). Rooting Malware Makes a Comeback: Lookout Discovers Global Campaign. Retrieved February 6, 2023.","url":"https://www.lookout.com/blog/lookout-discovers-global-rooting-malware-campaign"}]},{"id":"S1062","name":"S.O.V.A.","url":"https://attack.mitre.org/software/S1062","kind":"malware","description":"[S.O.V.A.](https://attack.mitre.org/software/S1062) can search for installed applications that match a list of targets.(Citation: cleafy_sova_1122)","relationship_id":"relationship--046acda0-91de-4385-bcfb-157570d8e51d","references":[{"source_name":"cleafy_sova_1122","description":"Francesco Lubatti, Federico Valentini. (2022, November 8). SOVA malware is back and is evolving rapidly. Retrieved March 30, 2023.","url":"https://www.cleafy.com/cleafy-labs/sova-malware-is-back-and-is-evolving-rapidly"}]},{"id":"S1069","name":"TangleBot","url":"https://attack.mitre.org/software/S1069","kind":"malware","description":"[TangleBot](https://attack.mitre.org/software/S1069) can obtain a list of installed applications.(Citation: cloudmark_tanglebot_0921)","relationship_id":"relationship--22041a01-75e7-4ff6-8768-ad45188c53c7","references":[{"source_name":"cloudmark_tanglebot_0921","description":"Felipe Naves, Andrew Conway, W. Stuart Jones, Adam McNeil . (2021, September 23). TangleBot: New Advanced SMS Malware Targets Mobile Users Across U.S. and Canada with COVID-19 Lures. Retrieved February 28, 2023.","url":"https://www.cloudmark.com/en/blog/malware/tanglebot-new-advanced-sms-malware-targets-mobile-users-across-us-and-canada-covid-19"}]},{"id":"S1077","name":"Hornbill","url":"https://attack.mitre.org/software/S1077","kind":"malware","description":"[Hornbill](https://attack.mitre.org/software/S1077) can search for installed applications such as WhatsApp.(Citation: lookout_hornbill_sunbird_0221) ","relationship_id":"relationship--8bcc9da8-c390-4151-b72d-30604820673e","references":[{"source_name":"lookout_hornbill_sunbird_0221","description":"Apurva Kumar, Kristin Del Rosso. (2021, February 10). Novel Confucius APT Android Spyware Linked to India-Pakistan Conflict. Retrieved June 9, 2023.","url":"https://www.lookout.com/blog/lookout-discovers-novel-confucius-apt-android-spyware-linked-to-india-pakistan-conflict"}]},{"id":"S1079","name":"BOULDSPY","url":"https://attack.mitre.org/software/S1079","kind":"malware","description":"[BOULDSPY](https://attack.mitre.org/software/S1079) can retrieve the list of installed applications.(Citation: lookout_bouldspy_0423)","relationship_id":"relationship--dcf01e96-1498-4ebf-b46f-d4f4eb796f23","references":[{"source_name":"lookout_bouldspy_0423","description":"Kyle Schmittle, Alemdar Islamoglu, Paul Shunk, Justin Albrecht. (2023, April 27). Lookout Discovers Android Spyware Tied to Iranian Police Targeting Minorities: BouldSpy. Retrieved July 21, 2023.","url":"https://www.lookout.com/blog/iranian-spyware-bouldspy"}]},{"id":"S1082","name":"Sunbird","url":"https://attack.mitre.org/software/S1082","kind":"malware","description":"[Sunbird](https://attack.mitre.org/software/S1082) can exfiltrate a list of installed applications.(Citation: lookout_hornbill_sunbird_0221)","relationship_id":"relationship--a466f8f0-c9da-46d1-80d0-b8654e727526","references":[{"source_name":"lookout_hornbill_sunbird_0221","description":"Apurva Kumar, Kristin Del Rosso. (2021, February 10). Novel Confucius APT Android Spyware Linked to India-Pakistan Conflict. Retrieved June 9, 2023.","url":"https://www.lookout.com/blog/lookout-discovers-novel-confucius-apt-android-spyware-linked-to-india-pakistan-conflict"}]},{"id":"S1083","name":"Chameleon","url":"https://attack.mitre.org/software/S1083","kind":"malware","description":"[Chameleon](https://attack.mitre.org/software/S1083) has read the name of application packages.(Citation: cyble_chameleon_0423)","relationship_id":"relationship--6315b6ec-35f8-4b28-8603-664664311a33","references":[{"source_name":"cyble_chameleon_0423","description":"Cyble Research & Intelligence Labs. (2023, April 13). Banking Trojan targeting mobile users in Australia and Poland. Retrieved August 16, 2023.","url":"https://cyble.com/blog/chameleon-a-new-android-malware-spotted-in-the-wild/"}]},{"id":"S1185","name":"LightSpy","url":"https://attack.mitre.org/software/S1185","kind":"malware","description":"[LightSpy](https://attack.mitre.org/software/S1185) has accessed a list of installed applications.(Citation: MelikovBlackBerry LightSpy 2024)(Citation: Threatfabric LightSpy 2023)(Citation: Threatfabric LightSpy 2024)(Citation: LinkedIn Dmitry LightSpy 2025) ","relationship_id":"relationship--ec30f169-9cf3-45c3-9a02-cda318107ba9","references":[{"source_name":"LinkedIn Dmitry LightSpy 2025","description":"Dmitry Bestuzhev. (2025, April 7). The Coordinated Kill Switch: LightSpy's iOS Destructive Plugin Architecture Manages Device Disablement. Retrieved April 14, 2025.","url":"https://www.linkedin.com/pulse/coordinated-kill-switch-lightspys-ios-destructive-plugin-bestuzhev-zhoye/"},{"source_name":"MelikovBlackBerry LightSpy 2024","description":"Melikov, D. (2024, April 11). LightSpy Returns: Renewed Espionage Campaign Targets Southern Asia, Possibly India. Retrieved January 14, 2025.","url":"https://blogs.blackberry.com/en/2024/04/lightspy-returns-renewed-espionage-campaign-targets-southern-asia-possibly-india"},{"source_name":"Threatfabric LightSpy 2023","description":"ThreatFabric. (2023, October 2). LightSpy mAPT Mobile Payment System Attack. Retrieved January 17, 2025.","url":"https://www.threatfabric.com/blogs/lightspy-mapt-mobile-payment-system-attack"},{"source_name":"Threatfabric LightSpy 2024","description":"ThreatFabric. (2024, October 29). LightSpy: Implant for iOS. Retrieved January 30, 2025.","url":"https://www.threatfabric.com/blogs/lightspy-implant-for-ios"}]},{"id":"S1215","name":"Binary Validator","url":"https://attack.mitre.org/software/S1215","kind":"malware","description":"[Binary Validator](https://attack.mitre.org/software/S1215) has obtained a list of installed applications.(Citation: SecureList OpTriangulation 23Oct2023) ","relationship_id":"relationship--6bdc24f1-36a7-4cf8-8a3e-f7f36840a7b2","references":[{"source_name":"SecureList OpTriangulation 23Oct2023","description":"Kucherin, G., et al. (2023, October 23). The outstanding stealth of Operation Triangulation. Retrieved April 18, 2024.","url":"https://securelist.com/triangulation-validators-modules/110847/"}]},{"id":"S1216","name":"TriangleDB","url":"https://attack.mitre.org/software/S1216","kind":"malware","description":"[TriangleDB](https://attack.mitre.org/software/S1216) has obtained a list of installed applications.(Citation: SecureList OpTriangulation 21Jun2023) ","relationship_id":"relationship--3ee5c123-416f-4d02-920d-ce44be7f11a5","references":[{"source_name":"SecureList OpTriangulation 21Jun2023","description":"Kucherin, G., et al. (2023, June 21). Dissecting TriangleDB, a Triangulation spyware implant. Retrieved April 18, 2024.","url":"https://securelist.com/triangledb-triangulation-implant/110050/"}]},{"id":"S1225","name":"CherryBlos","url":"https://attack.mitre.org/software/S1225","kind":"malware","description":"[CherryBlos](https://attack.mitre.org/software/S1225) has obtained a list of installed cryptocurrency wallet applications.(Citation: TrendMicro_CherryBlos_July2023)  ","relationship_id":"relationship--2305ceb7-f237-42bb-9a45-e245d8f82cde","references":[{"source_name":"TrendMicro_CherryBlos_July2023","description":"Trend Micro Research. (2023, July 28). Related CherryBlos and FakeTrade Android Malware Involved in Scam Campaigns. Retrieved March 28, 2025.","url":"https://www.trendmicro.com/en_us/research/23/g/cherryblos-and-faketrade-android-malware-involved-in-scam-campai.html"}]},{"id":"S1231","name":"GodFather","url":"https://attack.mitre.org/software/S1231","kind":"malware","description":"[GodFather](https://attack.mitre.org/software/S1231) has gathered a list of installed applications.(Citation: ZimperiumOrtegaPratapagiri_GodFather_Jun2025)(Citation: MerkleScience_Godfather_April2023) ","relationship_id":"relationship--c3e1aa57-a721-488f-8ac7-4fcb0f987153","references":[{"source_name":"MerkleScience_Godfather_April2023","description":"Merkle Science. (2023, April 25). The Godfather Android Malware: Threat under the lens. Retrieved July 16, 2025.","url":"https://www.merklescience.com/blog/the-godfather-android-malware-threat-under-the-lens"},{"source_name":"ZimperiumOrtegaPratapagiri_GodFather_Jun2025","description":"Ortega, F. Pratapagiri, V. (2025, June 18). Your Mobile App, Their Playground: The Dark Side of Virtualization. Retrieved July 16, 2025.","url":"https://zimperium.com/blog/your-mobile-app-their-playground-the-dark-side-of-the-virtualization"}]},{"id":"S1241","name":"RatMilad","url":"https://attack.mitre.org/software/S1241","kind":"malware","description":"[RatMilad](https://attack.mitre.org/software/S1241) has collected package names.(Citation: ZimperiumGupta_RatMilad_Oct2022) ","relationship_id":"relationship--052576f4-0b54-44be-840d-a9c8bb7cb980","references":[{"source_name":"ZimperiumGupta_RatMilad_Oct2022","description":"Gupta, N. (2022, October 5). We Smell A RatMilad Android Spyware. Retrieved August 27, 2025.","url":"https://zimperium.com/blog/we-smell-a-ratmilad-mobile-spyware"}]},{"id":"S9004","name":"Crocodilus","url":"https://attack.mitre.org/software/S9004","kind":"malware","description":"[Crocodilus](https://attack.mitre.org/software/S9004) has the ability to collect a list of installed applications.(Citation: ThreatFabric_Crocodilus_March2025)","relationship_id":"relationship--e43098c9-bbdf-4330-baf2-1d04f93255ba","references":[{"source_name":"ThreatFabric_Crocodilus_March2025","description":"ThreatFabric. (2025, March 28). Exposing Crocodilus: New Device Takeover Malware Targeting Android Devices. Retrieved November 24, 2025.","url":"https://www.threatfabric.com/blogs/exposing-crocodilus-new-device-takeover-malware-targeting-android-devices"}]},{"id":"S9005","name":"DocSwap","url":"https://attack.mitre.org/software/S9005","kind":"malware","description":"[DocSwap](https://attack.mitre.org/software/S9005) has the ability to send installed application information, including application name, package name, installation timestamp, icon, and properties.(Citation: S2W_DocSwap_Mar2025)","relationship_id":"relationship--e964979d-7664-4897-8fcc-4f67ed494a37","references":[{"source_name":"S2W_DocSwap_Mar2025","description":"Kim, H., S2W TALON. (2025, March 13). Detailed Analysis of DocSwap Malware Disguised as Security Document Viewer. Retrieved January 12, 2026.","url":"https://medium.com/s2wblog/detailed-analysis-of-docswap-malware-disguised-as-security-document-viewer-218a728c36ff"}]},{"id":"S9006","name":"VajraSpy","url":"https://attack.mitre.org/software/S9006","kind":"malware","description":"[VajraSpy](https://attack.mitre.org/software/S9006) has obtained and exfiltrated a list of installed applications.(Citation: ESET_VajraSpy_Feb2024)(Citation: K7Dhanalakshmi_VajraSpy_April2022) ","relationship_id":"relationship--f5b153b3-9392-4c5a-aa96-ae7efb9f7ad9","references":[{"source_name":"K7Dhanalakshmi_VajraSpy_April2022","description":"Dhanalakshmi. (2022, April 19).  VajraSpy – An Android RAT. Retrieved November 5, 2025.","url":"https://labs.k7computing.com/index.php/vajraspy-an-android-rat/"},{"source_name":"ESET_VajraSpy_Feb2024","description":"Stefanko, L. (2024, February 1). VajraSpy: A Patchwork of espionage apps. Retrieved October 27, 2025.","url":"https://www.welivesecurity.com/en/eset-research/vajraspy-patchwork-espionage-apps/"}]}],"actors":[],"mitigations":[{"id":"M1006","name":"Use Recent OS Version","url":"https://attack.mitre.org/mitigations/M1006","kind":"course-of-action","description":"Android 11 introduced privacy enhancements to package visibility, filtering results that are returned from the package manager. iOS 12 removed the private API that could previously be used to list installed applications on non-app store applications.(Citation: Android Package Visibility)","relationship_id":"relationship--b247a4f6-3629-4123-84b0-c7c5b3e7e37e","references":[{"source_name":"Android Package Visibility","description":"Google. (n.d.). Package visibility filtering on Android. Retrieved April 11, 2022.","url":"https://developer.android.com/training/package-visibility"}]},{"id":"M1011","name":"User Guidance","url":"https://attack.mitre.org/mitigations/M1011","kind":"course-of-action","description":"iOS users should be instructed to not download applications from unofficial sources, as applications distributed via the Apple App Store cannot list installed applications on a device.","relationship_id":"relationship--828417ec-c444-41c8-95b4-c339c5ecf62b","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use owned test devices or emulators, disposable app accounts and test data. Verify platform/version instrumentation; desktop test procedures do not establish mobile coverage.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1418":"/ttp-simulation/techniques/mobile/T1418/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"mobile/T1418","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0112","collector":"illustrative-lab-collector","observation":{"package":"test.example.lab","api":"android.hardware.camera2.CameraManager.openCamera","result":"permission_denied","thread":"main"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0123","collector":"illustrative-lab-collector","observation":{"package":"test.example.lab","state_before":"background","state_after":"foreground","source":"own_app_callback"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}}]}}