{"source_checked_on":"2026-10-19","schema_version":1,"key":"mobile/T1420","id":"T1420","name":"File and Directory Discovery","domain":"mobile","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1420","source_file":{"file":"mobile.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/mobile-attack/mobile-attack-20.0.json","sha256":"824f7d8a37e7893b29e4c6ca6d87b5fbbf3b228ec6384f1a69ee20d523ff59e5","bytes":6095145},"source_object_sha256":"3e311276931ad35685b5c33595abfe4a6e75f016ab03b20277010e4e2e6e0995","description":"Adversaries may enumerate files and directories or search in specific device locations for desired information within a filesystem. Adversaries may use the information from [File and Directory Discovery](https://attack.mitre.org/techniques/T1420) during automated discovery to shape follow-on behaviors, including deciding if the adversary should fully infect the target and/or attempt specific actions. \n\nOn Android, Linux file permissions and SELinux policies typically stringently restrict what can be accessed by apps without taking advantage of a privilege escalation exploit. The contents of the external storage directory are generally visible, which could present concerns if sensitive data is inappropriately stored there. iOS's security architecture generally restricts the ability to perform any type of [File and Directory Discovery](https://attack.mitre.org/techniques/T1420) without use of escalated privileges. ","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1420","external_id":"T1420"},{"source_name":"NIST Mobile Threat Catalogue","url":"https://pages.nist.gov/mobile-threat-catalogue/stack-threats/STA-41.html","external_id":"STA-41"}],"platforms":["Android","iOS"],"environments":["mobile"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0123","name":"Application State","page":"telemetry/DC0123/","kind":"attack_component","category":"Mobile lab instrumentation","description":"Application state and lifecycle observations such as foreground/background transitions.","collection_focus":"Instrument the owned app lifecycle and corroborate permitted service snapshots; distinguish app events from inferred gateway activity.","providers":[{"name":"Android logcat","scope":"Permitted logs from a consented test device/emulator; output depends on build, permissions and instrumentation.","source_id":"android_logs"},{"name":"Android dumpsys","scope":"Point-in-time service/package state on an authorized development device.","source_id":"android_state"},{"name":"Instrumented test application","scope":"Own-app permission, API and state callbacks; not universal visibility into other apps.","source_id":"android_permissions"}],"configuration":["Use a disposable emulator or owned development device with approved debugging. Record OS/API level, app version and instrumentation privileges.","Collect only relevant logcat buffers/tags and service snapshots; add explicit own-app instrumentation for events absent from OS logs.","Forward sanitized logs and compare before/after state. Remove test data and revoke debugging access after the lab session."],"configuration_example":null,"required_fields":["package","state_before","state_after","source"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0123","collector":"illustrative-lab-collector","observation":{"package":"test.example.lab","state_before":"background","state_after":"foreground","source":"own_app_callback"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Android tooling does not imply iOS coverage. Standard mobile apps cannot observe all other apps or protected OS internals; MDM status is not full API, filesystem or content telemetry.","sources":[{"id":"android_logs","title":"Android logcat and access limits","url":"https://developer.android.com/tools/logcat"},{"id":"android_state","title":"Android dumpsys","url":"https://developer.android.com/tools/dumpsys"},{"id":"android_permissions","title":"Android runtime permission requests","url":"https://developer.android.com/training/permissions/requesting"}],"association":"attack_component","anomaly_design":"Per owned device, app version and permission state: unexpected API/permission changes, background activity and network destinations. OS privacy restrictions and emulator differences limit observability."},{"id":"DC0055","name":"File Access","page":"telemetry/DC0055/","kind":"attack_component","category":"Windows and directory audit","description":"Access to file objects with user, process and access-right context.","collection_focus":"Enable Audit File System plus a narrow SACL on a lab directory; on Linux select path/syscall rules and join associated Audit records.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["path","access","actor","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0055","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","access":"read","actor":"LAB\\analyst","result":"success"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0018","name":"Host Status","page":"telemetry/DC0018/","kind":"attack_component","category":"Host state and inventory","description":"Host health and availability observations such as heartbeat, shutdown or degraded state.","collection_focus":"Collect agent heartbeat and OS health independently; record missed polls, last-seen time and monitor health.","providers":[{"name":"osquery","scope":"Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.","source_id":"osquery"},{"name":"Linux Audit plus inventory snapshots","scope":"Events explain changes; snapshots describe state at collection time.","source_id":"linux"}],"configuration":["Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.","Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.","Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset."],"configuration_example":null,"required_fields":["asset_id","status","heartbeat_age_seconds","collector_healthy"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0018","collector":"illustrative-lab-collector","observation":{"asset_id":"lab-host-1","status":"degraded","heartbeat_age_seconds":90,"collector_healthy":true}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.","sources":[{"id":"osquery","title":"osquery scheduled configuration","url":"https://github.com/osquery/osquery/blob/master/docs/wiki/deployment/configuration.md"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Compare authorized state snapshots: first-seen drivers/services/modules, unexpected configuration drift and integrity changes. Record collection cadence; absence in a sample is not evidence of deletion."},{"id":"DC0078","name":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component","category":"Network and protocol telemetry","description":"Connection/flow summaries such as endpoints, duration, byte counts and transport.","collection_focus":"Collect Zeek conn.log, Suricata flow events or exporter equivalents, including observation point and sampling settings.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"},{"name":"AWS VPC Flow Logs","scope":"IP traffic metadata alternative; no packet payload or DNS answer history, and some traffic is not logged.","source_id":"flow"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["source_ip","destination_ip","destination_port","protocol","bytes_sent","bytes_received"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"},{"id":"flow","title":"AWS VPC Flow Logs","url":"https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."}],"detection":{"key":"mobile/T1420","id":"T1420","name":"File and Directory Discovery","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"source_url":"https://attack.mitre.org/techniques/T1420","technique_page":"techniques/mobile/T1420/","page":"detections/mobile/T1420/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0682","name":"Detection of File and Directory Discovery","url":"https://attack.mitre.org/detectionstrategies/DET0682","stix_id":"x-mitre-detection-strategy--afab91d6-8af3-47cd-b899-cacfbb8cad6d","relationship_id":"relationship--2ba3af4e-97d8-45e8-93e0-8fa857944edd","description":"","analytics":[{"id":"AN1788","name":"Analytic 1788","guidance":"For Android, detect File and Directory Discovery by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application State via Android Enterprise / EMM [Managed package inventory/status and package metadata]; File Access via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: opendir() or File.listFiles() on path IN $ExternalStoragePaths$ called > $FileEnumThreshold$ times within $EnumWindow$ by app NOT IN $FileEnumAllowList$]; Network Traffic Flow via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.","url":"https://attack.mitre.org/detectionstrategies/DET0682#AN1788","platforms":["Android"],"tuning":[{"field":"ExternalStoragePaths","description":"/sdcard/, /storage/emulated/0/, /mnt/sdcard/. Vary by device."},{"field":"FileEnumThreshold","description":"Default 100 directory operations within window. Derive from baseline file manager behavior."},{"field":"EnumWindow","description":"Default 60s."},{"field":"FileEnumAllowList","description":"Approved file managers, media apps, MDM agent."},{"field":"UplinkThreshold","description":"Default 500KB."},{"field":"AppCDNList","description":"Per-app CDN. Derive by measurement."},{"field":"ExfilWindow","description":"Default 120s."}],"log_sources":[{"component_id":"DC0123","component":"Application State","name":"android:EMM","channel":"Managed package inventory/status and package metadata","platforms":["Android"],"analytic_id":"AN1788","source_url":"https://attack.mitre.org/detectionstrategies/DET0682#AN1788","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0123/"},{"component_id":"DC0055","component":"File Access","name":"mobile:ForensicArtifacts","channel":"Dynamic filesystem trace or acquired app-container/filesystem artifacts: opendir() or File.listFiles() on path IN $ExternalStoragePaths$ called > $FileEnumThreshold$ times within $EnumWindow$ by app NOT IN $FileEnumAllowList$","platforms":["Android"],"analytic_id":"AN1788","source_url":"https://attack.mitre.org/detectionstrategies/DET0682#AN1788","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0055/"},{"component_id":"DC0078","component":"Network Traffic Flow","name":"android:EnterpriseNetworkLog","channel":"DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata","platforms":["Android"],"analytic_id":"AN1788","source_url":"https://attack.mitre.org/detectionstrategies/DET0682#AN1788","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"}]},{"id":"AN1789","name":"Analytic 1789","guidance":"For iOS, detect File and Directory Discovery by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application State via Apple MDM [InstalledApplicationList / ManagedApplicationList]; Host Status via Apple MDM [DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries]; Network Traffic Flow via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.","url":"https://attack.mitre.org/detectionstrategies/DET0682#AN1789","platforms":["iOS"],"tuning":[{"field":"HighValueAppList","description":"Banking, auth, enterprise apps with sensitive local data."},{"field":"HighValueAppCount","description":"Default 2 — single app could be accidental; multiple indicates targeted environment."},{"field":"ConnectionBurstThreshold","description":"Default 5 connections to same dest within window."},{"field":"SmallRequestThreshold","description":"Default 50KB per request — file listing and small file pickups."},{"field":"ExfilWindow","description":"Default 300s after jailbreak detection."}],"log_sources":[{"component_id":"DC0123","component":"Application State","name":"iOS:MDM","channel":"InstalledApplicationList / ManagedApplicationList","platforms":["iOS"],"analytic_id":"AN1789","source_url":"https://attack.mitre.org/detectionstrategies/DET0682#AN1789","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0123/"},{"component_id":"DC0018","component":"Host Status","name":"iOS:MDM","channel":"DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries","platforms":["iOS"],"analytic_id":"AN1789","source_url":"https://attack.mitre.org/detectionstrategies/DET0682#AN1789","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0018/"},{"component_id":"DC0078","component":"Network Traffic Flow","name":"iOS:NetworkExtension","channel":"NEFilterFlow / per-app VPN / secure-web-gateway flow metadata","platforms":["iOS"],"analytic_id":"AN1789","source_url":"https://attack.mitre.org/detectionstrategies/DET0682#AN1789","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"}]}]}],"telemetry_references":[{"id":"DC0123","name":"Application State","tag":"Application State","page":"telemetry/DC0123/","kind":"attack_component"},{"id":"DC0055","name":"File Access","tag":"File Access","page":"telemetry/DC0055/","kind":"attack_component"},{"id":"DC0018","name":"Host Status","tag":"Host Status","page":"telemetry/DC0018/","kind":"attack_component"},{"id":"DC0078","name":"Network Traffic Flow","tag":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S0505","name":"Desert Scorpion","url":"https://attack.mitre.org/software/S0505","kind":"malware","description":"[Desert Scorpion](https://attack.mitre.org/software/S0505) can list files stored on external storage.(Citation: Lookout Desert Scorpion)","relationship_id":"relationship--2c9ad579-0c29-4f2a-80f3-242dc6b0bafd","references":[{"source_name":"Lookout Desert Scorpion","description":"A. Blaich, M. Flossman. (2018, April 16). Lookout finds new surveillanceware in Google Play with ties to known threat actor targeting the Middle East. Retrieved September 11, 2020.","url":"https://blog.lookout.com/desert-scorpion-google-play"}]},{"id":"S0529","name":"CarbonSteal","url":"https://attack.mitre.org/software/S0529","kind":"malware","description":"[CarbonSteal](https://attack.mitre.org/software/S0529) has searched device storage for various files, including .amr files (audio recordings) and superuser binaries.(Citation: Lookout Uyghur Campaign)","relationship_id":"relationship--ba8735ad-b9c6-4b35-9fac-d4747ab0b2ae","references":[{"source_name":"Lookout Uyghur Campaign","description":"A. Kumar, K. Del Rosso, J. Albrecht, C. Hebeisen. (2020, June 1). Mobile APT Surveillance Campaigns Targeting Uyghurs - A collection of long-running Android tooling connected to a Chinese mAPT actor. Retrieved November 10, 2020.","url":"https://www.lookout.com/documents/threat-reports/us/lookout-uyghur-malware-tr-us.pdf"}]},{"id":"S0535","name":"Golden Cup","url":"https://attack.mitre.org/software/S0535","kind":"malware","description":"[Golden Cup](https://attack.mitre.org/software/S0535) can collect a directory listing of external storage.(Citation: Symantec GoldenCup)","relationship_id":"relationship--a285f343-09c3-49af-9c18-1dccf89e9009","references":[{"source_name":"Symantec GoldenCup","description":"R. Iarchy, E. Rynkowski. (2018, July 5). GoldenCup: New Cyber Threat Targeting World Cup Fans. Retrieved October 29, 2020.","url":"https://symantec-enterprise-blogs.security.com/blogs/expert-perspectives/goldencup-new-cyber-threat-targeting-world-cup-fans"}]},{"id":"S0549","name":"SilkBean","url":"https://attack.mitre.org/software/S0549","kind":"malware","description":"[SilkBean](https://attack.mitre.org/software/S0549) can get file lists on the SD card.(Citation: Lookout Uyghur Campaign)","relationship_id":"relationship--4586277d-bebd-4717-87c6-a31a9be741ed","references":[{"source_name":"Lookout Uyghur Campaign","description":"A. Kumar, K. Del Rosso, J. Albrecht, C. Hebeisen. (2020, June 1). Mobile APT Surveillance Campaigns Targeting Uyghurs - A collection of long-running Android tooling connected to a Chinese mAPT actor. Retrieved November 10, 2020.","url":"https://www.lookout.com/documents/threat-reports/us/lookout-uyghur-malware-tr-us.pdf"}]},{"id":"S0550","name":"DoubleAgent","url":"https://attack.mitre.org/software/S0550","kind":"malware","description":"[DoubleAgent](https://attack.mitre.org/software/S0550) has searched for specific existing data directories, including the Gmail app, Dropbox app, Pictures, and thumbnails.(Citation: Lookout Uyghur Campaign)","relationship_id":"relationship--d70aaf50-29b7-4687-98ea-ffaa3fa858c0","references":[{"source_name":"Lookout Uyghur Campaign","description":"A. Kumar, K. Del Rosso, J. Albrecht, C. Hebeisen. (2020, June 1). Mobile APT Surveillance Campaigns Targeting Uyghurs - A collection of long-running Android tooling connected to a Chinese mAPT actor. Retrieved November 10, 2020.","url":"https://www.lookout.com/documents/threat-reports/us/lookout-uyghur-malware-tr-us.pdf"}]},{"id":"S0551","name":"GoldenEagle","url":"https://attack.mitre.org/software/S0551","kind":"malware","description":"[GoldenEagle](https://attack.mitre.org/software/S0551) has looked for .doc, .txt, .gif, .apk, .jpg, .png, .mp3, and .db files on external storage.(Citation: Lookout Uyghur Campaign)","relationship_id":"relationship--03038590-e0c3-4751-b6fb-8a9ffff27e1b","references":[{"source_name":"Lookout Uyghur Campaign","description":"A. Kumar, K. Del Rosso, J. Albrecht, C. Hebeisen. (2020, June 1). Mobile APT Surveillance Campaigns Targeting Uyghurs - A collection of long-running Android tooling connected to a Chinese mAPT actor. Retrieved November 10, 2020.","url":"https://www.lookout.com/documents/threat-reports/us/lookout-uyghur-malware-tr-us.pdf"}]},{"id":"S0558","name":"Tiktok Pro","url":"https://attack.mitre.org/software/S0558","kind":"malware","description":"[Tiktok Pro](https://attack.mitre.org/software/S0558) can list all hidden files in the `/DCIM/.dat/` directory.(Citation: Zscaler TikTok Spyware)","relationship_id":"relationship--b05668b9-aa06-4191-a4fa-f7e5a7804694","references":[{"source_name":"Zscaler TikTok Spyware","description":"S. Desai. (2020, September 8). TikTok Spyware. Retrieved January 5, 2021.","url":"https://www.zscaler.com/blogs/security-research/tiktok-spyware"}]},{"id":"S0577","name":"FrozenCell","url":"https://attack.mitre.org/software/S0577","kind":"malware","description":"[FrozenCell](https://attack.mitre.org/software/S0577) has searched for pdf, doc, docx, ppt, pptx, xls, and xlsx file types for exfiltration.(Citation: Lookout FrozenCell)","relationship_id":"relationship--a9e97a14-ea3c-47b1-a865-0a1edea9c81c","references":[{"source_name":"Lookout FrozenCell","description":"Michael Flossman. (2017, October 5). FrozenCell: Multi-platform surveillance campaign against Palestinians. Retrieved November 11, 2020.","url":"https://blog.lookout.com/frozencell-mobile-threat"}]},{"id":"S1077","name":"Hornbill","url":"https://attack.mitre.org/software/S1077","kind":"malware","description":"[Hornbill](https://attack.mitre.org/software/S1077) has a list of file extensions that it may use to log certain operations (creation, open, close, modification, movement, deletion) on files of those types.(Citation: lookout_hornbill_sunbird_0221)","relationship_id":"relationship--867b4929-20f2-47cd-9ab3-43a5a6ea98b5","references":[{"source_name":"lookout_hornbill_sunbird_0221","description":"Apurva Kumar, Kristin Del Rosso. (2021, February 10). Novel Confucius APT Android Spyware Linked to India-Pakistan Conflict. Retrieved June 9, 2023.","url":"https://www.lookout.com/blog/lookout-discovers-novel-confucius-apt-android-spyware-linked-to-india-pakistan-conflict"}]},{"id":"S1092","name":"Escobar","url":"https://attack.mitre.org/software/S1092","kind":"malware","description":"[Escobar](https://attack.mitre.org/software/S1092) can access external storage.(Citation: Bleeipng Computer Escobar)","relationship_id":"relationship--be8d0cd6-be77-456e-bcfb-6325cb8ba137","references":[{"source_name":"Bleeipng Computer Escobar","description":"B. Toulas. (2022, March 12). Android malware Escobar steals your Google Authenticator MFA codes. Retrieved September 28, 2023.","url":"https://www.bleepingcomputer.com/news/security/android-malware-escobar-steals-your-google-authenticator-mfa-codes/"}]},{"id":"S1095","name":"AhRat","url":"https://attack.mitre.org/software/S1095","kind":"malware","description":"[AhRat](https://attack.mitre.org/software/S1095) can enumerate files on external storage.(Citation: welivesecurity_ahrat_0523)","relationship_id":"relationship--792ae0c6-8b0c-4adf-9c7f-83ebee84bb57","references":[{"source_name":"welivesecurity_ahrat_0523","description":"Lukas Stefanko. (2023, May 23). Android app breaking bad: From legitimate screen recording to file exfiltration within a year. Retrieved December 18, 2023.","url":"https://www.welivesecurity.com/2023/05/23/android-app-breaking-bad-legitimate-screen-recording-file-exfiltration/"}]},{"id":"S1216","name":"TriangleDB","url":"https://attack.mitre.org/software/S1216","kind":"malware","description":"[TriangleDB](https://attack.mitre.org/software/S1216) has obtained a list of files using the `fts` API and has obtained files that match a specified regular expression.(Citation: SecureList OpTriangulation 21Jun2023) ","relationship_id":"relationship--8b3756f1-327a-4625-bde0-26b216ecb07a","references":[{"source_name":"SecureList OpTriangulation 21Jun2023","description":"Kucherin, G., et al. (2023, June 21). Dissecting TriangleDB, a Triangulation spyware implant. Retrieved April 18, 2024.","url":"https://securelist.com/triangledb-triangulation-implant/110050/"}]},{"id":"S1225","name":"CherryBlos","url":"https://attack.mitre.org/software/S1225","kind":"malware","description":"[CherryBlos](https://attack.mitre.org/software/S1225) has accessed media files stored in external storage and has used optical character recognition (OCR) to recognize potential mnemonic phrases in pictures.(Citation: TrendMicro_CherryBlos_July2023)  ","relationship_id":"relationship--64a55364-3ad1-40e8-92a2-58a7a71a18c9","references":[{"source_name":"TrendMicro_CherryBlos_July2023","description":"Trend Micro Research. (2023, July 28). Related CherryBlos and FakeTrade Android Malware Involved in Scam Campaigns. Retrieved March 28, 2025.","url":"https://www.trendmicro.com/en_us/research/23/g/cherryblos-and-faketrade-android-malware-involved-in-scam-campai.html"}]},{"id":"S1241","name":"RatMilad","url":"https://attack.mitre.org/software/S1241","kind":"malware","description":"[RatMilad](https://attack.mitre.org/software/S1241) has listed files and pictures on the device starting from `/mnt/sdcard/`.(Citation: ZimperiumGupta_RatMilad_Oct2022) ","relationship_id":"relationship--fc3c2496-aef9-4924-82e7-716d5149db01","references":[{"source_name":"ZimperiumGupta_RatMilad_Oct2022","description":"Gupta, N. (2022, October 5). We Smell A RatMilad Android Spyware. Retrieved August 27, 2025.","url":"https://zimperium.com/blog/we-smell-a-ratmilad-mobile-spyware"}]},{"id":"S9005","name":"DocSwap","url":"https://attack.mitre.org/software/S9005","kind":"malware","description":"[DocSwap](https://attack.mitre.org/software/S9005) has checked for the `READ_EXTERNAL_STORAGE` and `MANAGE_EXTERNAL_STORAGE` permissions.(Citation: EnkiWhiteHat_KimsukyDOCSWAP_Dec2025)(Citation: S2W_DocSwap_Mar2025)   ","relationship_id":"relationship--329b14a1-df5f-4112-b062-175ef9447728","references":[{"source_name":"EnkiWhiteHat_KimsukyDOCSWAP_Dec2025","description":"EnkiWhiteHat. (2025, December 16). Kimsuky Distributing Malicious Mobile App via QR Code. Retrieved January 8, 2026.","url":"https://www.enki.co.kr/en/media-center/blog/kimsuky-distributing-malicious-mobile-app-via-qr-code"},{"source_name":"S2W_DocSwap_Mar2025","description":"Kim, H., S2W TALON. (2025, March 13). Detailed Analysis of DocSwap Malware Disguised as Security Document Viewer. Retrieved January 12, 2026.","url":"https://medium.com/s2wblog/detailed-analysis-of-docswap-malware-disguised-as-security-document-viewer-218a728c36ff"}]},{"id":"S9006","name":"VajraSpy","url":"https://attack.mitre.org/software/S9006","kind":"malware","description":"[VajraSpy](https://attack.mitre.org/software/S9006) has searched for files with specific extensions, such as .txt, .jpg, .Om4a, .aac and .opus, before exfiltration.(Citation: ESET_VajraSpy_Feb2024)  ","relationship_id":"relationship--8e9cacb4-f265-4a4e-9f80-853c7cfa791f","references":[{"source_name":"ESET_VajraSpy_Feb2024","description":"Stefanko, L. (2024, February 1). VajraSpy: A Patchwork of espionage apps. Retrieved October 27, 2025.","url":"https://www.welivesecurity.com/en/eset-research/vajraspy-patchwork-espionage-apps/"}]},{"id":"S9030","name":"SameCoin","url":"https://attack.mitre.org/software/S9030","kind":"malware","description":"[SameCoin](https://attack.mitre.org/software/S9030) can use libexampleone.so to list files to be deleted.(Citation: Check Point Wirte NOV 2024)","relationship_id":"relationship--8186d2f5-5040-4ba4-b144-7fea7b3e9a55","references":[{"source_name":"Check Point Wirte NOV 2024","description":"Check Point. (2024, November 12). Hamas-affiliated Threat Actor WIRTE Continues its Middle East Operations and Moves to Disruptive Activity. Retrieved April 20, 2026.","url":"https://research.checkpoint.com/2024/hamas-affiliated-threat-actor-expands-to-disruptive-activity/"}]}],"actors":[{"id":"G0112","name":"Windshift","url":"https://attack.mitre.org/groups/G0112","kind":"intrusion-set","description":"[Windshift](https://attack.mitre.org/groups/G0112) has included file enumeration in the malicious apps deployed as part of Operation BULL and Operation ROCK.(Citation: BlackBerry Bahamut)","relationship_id":"relationship--383e5b12-061e-45c6-911b-b37187dd9254","references":[{"source_name":"BlackBerry Bahamut","description":"The BlackBerry Research & Intelligence Team. (2020, October). BAHAMUT: Hack-for-Hire Masters of Phishing, Fake News, and Fake Apps. Retrieved February 8, 2021.","url":"https://www.blackberry.com/us/en/pdfviewer?file=/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-spark-bahamut.pdf"}]}],"mitigations":[{"id":"M1006","name":"Use Recent OS Version","url":"https://attack.mitre.org/mitigations/M1006","kind":"course-of-action","description":"Security architecture improvements in each new version of Android and iOS make it more difficult to escalate privileges. Additionally, newer versions of Android have strengthened the sandboxing applied to applications, restricting their ability to enumerate file system contents.","relationship_id":"relationship--7260c8fe-6b3b-48a2-889f-f329fb5b4ef0","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use owned test devices or emulators, disposable app accounts and test data. Verify platform/version instrumentation; desktop test procedures do not establish mobile coverage.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1420":"/ttp-simulation/techniques/mobile/T1420/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"mobile/T1420","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0123","collector":"illustrative-lab-collector","observation":{"package":"test.example.lab","state_before":"background","state_after":"foreground","source":"own_app_callback"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0055","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","access":"read","actor":"LAB\\analyst","result":"success"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0018","collector":"illustrative-lab-collector","observation":{"asset_id":"lab-host-1","status":"degraded","heartbeat_age_seconds":90,"collector_healthy":true}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}}]}}