T1422 System Network Configuration Discovery — Attack Simulation

DC0112 collection page — Instrument selected APIs in the owned test app or approved research build; log caller, API, sanitized argument class and return status.

Providers and collection configuration

• Android logcat: Permitted logs from a consented test device/emulator; output depends on build, permissions and instrumentation.
• Android dumpsys: Point-in-time service/package state on an authorized development device.
• Instrumented test application: Own-app permission, API and state callbacks; not universal visibility into other apps.

• Use a disposable emulator or owned development device with approved debugging. Record OS/API level, app version and instrumentation privileges.
• Collect only relevant logcat buffers/tags and service snapshots; add explicit own-app instrumentation for events absent from OS logs.
• Forward sanitized logs and compare before/after state. Remove test data and revoke debugging access after the lab session.

Required normalized fields: package, api, result, thread.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0112",
  "collector": "illustrative-lab-collector",
  "observation": {
    "package": "test.example.lab",
    "api": "android.hardware.camera2.CameraManager.openCamera",
    "result": "permission_denied",
    "thread": "main"
  }
}

Visibility limits: Android tooling does not imply iOS coverage. Standard mobile apps cannot observe all other apps or protected OS internals; MDM status is not full API, filesystem or content telemetry.

DC0123 collection page — Instrument the owned app lifecycle and corroborate permitted service snapshots; distinguish app events from inferred gateway activity.

Providers and collection configuration

• Android logcat: Permitted logs from a consented test device/emulator; output depends on build, permissions and instrumentation.
• Android dumpsys: Point-in-time service/package state on an authorized development device.
• Instrumented test application: Own-app permission, API and state callbacks; not universal visibility into other apps.

• Use a disposable emulator or owned development device with approved debugging. Record OS/API level, app version and instrumentation privileges.
• Collect only relevant logcat buffers/tags and service snapshots; add explicit own-app instrumentation for events absent from OS logs.
• Forward sanitized logs and compare before/after state. Remove test data and revoke debugging access after the lab session.

Required normalized fields: package, state_before, state_after, source.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0123",
  "collector": "illustrative-lab-collector",
  "observation": {
    "package": "test.example.lab",
    "state_before": "background",
    "state_after": "foreground",
    "source": "own_app_callback"
  }
}

Visibility limits: Android tooling does not imply iOS coverage. Standard mobile apps cannot observe all other apps or protected OS internals; MDM status is not full API, filesystem or content telemetry.

DC0018 collection page — Collect agent heartbeat and OS health independently; record missed polls, last-seen time and monitor health.

Providers and collection configuration

• osquery: Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.
• Linux Audit plus inventory snapshots: Events explain changes; snapshots describe state at collection time.

• Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.
• Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.
• Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset.

Required normalized fields: asset_id, status, heartbeat_age_seconds, collector_healthy.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0018",
  "collector": "illustrative-lab-collector",
  "observation": {
    "asset_id": "lab-host-1",
    "status": "degraded",
    "heartbeat_age_seconds": 90,
    "collector_healthy": true
  }
}

Visibility limits: Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.

DC0082 collection page — Enable scoped Sysmon NetworkConnect (3), disabled by default, or a platform-equivalent process-aware network sensor.

Providers and collection configuration

• Microsoft Sysmon: Windows event-based collection; enable the event types needed below.
• Linux Audit: Linux alternative for supported system-call and file events; different semantics and fields.
• Apple Endpoint Security clients: macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.

• On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
• Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
• For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms.

Required normalized fields: process_guid, destination_ip, destination_port, protocol, initiated.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0082",
  "collector": "illustrative-lab-collector",
  "observation": {
    "process_guid": "lab-process-001",
    "destination_ip": "198.51.100.20",
    "destination_port": 443,
    "protocol": "tcp",
    "initiated": true
  }
}

Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.

DC0078 collection page — Collect Zeek conn.log, Suricata flow events or exporter equivalents, including observation point and sampling settings.

Providers and collection configuration

• Zeek: Connection and protocol metadata from traffic visible to the sensor.
• Suricata EVE: Configured flow, alert, DNS, HTTP, TLS and protocol records.
• AWS VPC Flow Logs: IP traffic metadata alternative; no packet payload or DNS answer history, and some traffic is not logged.

• Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.
• Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.
• Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection.

Required normalized fields: source_ip, destination_ip, destination_port, protocol, bytes_sent, bytes_received.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0078",
  "collector": "illustrative-lab-collector",
  "observation": {
    "source_ip": "192.0.2.10",
    "destination_ip": "198.51.100.20",
    "destination_port": 443,
    "protocol": "tcp",
    "bytes_sent": 128,
    "bytes_received": 512
  }
}

Visibility limits: Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.

MITRE detection strategy

No exact-tagged Sigma source rule was imported. This does not establish that the technique is undetectable; the MITRE guidance and collection requirements remain relevant.

• S0291 PJApps — malware.

  PJApps has the capability to collect and leak the victim's phone number, mobile device unique identifier (IMEI).[Lookout-EnterpriseApps]

  Exact relationship: relationship--789cb76e-27b0-4762-a2f7-3ff32ce0762d
• S0292 AndroRAT — malware.

  AndroRAT collects the device’s location through GPS or through network settings.[forcepoint_bitter]

  Exact relationship: relationship--c6770405-985b-4e24-8b09-01bce16426da
• S0310 ANDROIDOS_ANSERVER.A — malware.

  ANDROIDOS_ANSERVER.A gathers the device IMEI and IMSI.[TrendMicro-Anserver2]

  Exact relationship: relationship--919a13bc-74be-4660-af63-454abee92635
• S0311 YiSpecter — malware.

  YiSpecter has collected compromised device MAC addresses.[paloalto_yispecter_1015]

  Exact relationship: relationship--25de6cf6-38d5-4d1e-b3f1-6956a0ff0ac3
• S0313 RuMMS — malware.

  RuMMS gathers the device phone number and IMEI and transmits them to a command and control server.[FireEye-RuMMS]

  Exact relationship: relationship--3c291ee5-1782-4e5b-8131-5188c7388f45
• S0315 DualToy — malware.

  DualToy collects the connected iOS device’s information including IMEI, IMSI, ICCID, serial number and phone number.[PaloAlto-DualToy]

  Exact relationship: relationship--71490fdb-e271-4a67-b932-5288924b1dae
• S0316 Pegasus for Android — malware.

  Pegasus for Android checks if the device is on Wi-Fi, a cellular network, and is roaming.[Lookout-PegasusAndroid]

  Exact relationship: relationship--db3fc82d-d353-438d-aa5e-9b5e7e60f0ac
• S0318 XLoader for Android — malware.

  XLoader for Android collects the device’s IMSI and ICCID.[TrendMicro-XLoader-FakeSpy]

  Exact relationship: relationship--f7039142-dbdc-4ffc-a54f-136ad57a6ac1
• S0324 SpyDealer — malware.

  SpyDealer harvests the device phone number, IMEI, and IMSI.[PaloAlto-SpyDealer]

  Exact relationship: relationship--f6a451e8-2125-4bbe-be52-e682523cd169
• S0326 RedDrop — malware.

  RedDrop collects and exfiltrates information including IMEI, IMSI, MNC, MCC, nearby Wi-Fi networks, and other device and SIM-related info.[Wandera-RedDrop]

  Exact relationship: relationship--c9b3d86a-9c5e-4fe3-9c1c-dbd0bb89a74b
• S0328 Stealth Mango — malware.

  Stealth Mango collects and uploads information about changes in SIM card or phone numbers on the device.[Lookout-StealthMango]

  Exact relationship: relationship--a7336f2c-8f89-4d54-ac2b-77743afb2943
• S0329 Tangelo — malware.

  Tangelo contains functionality to gather cellular IDs.[Lookout-StealthMango]

  Exact relationship: relationship--433ba5b0-76eb-49e1-a2ed-e54994e94041
• S0403 Riltok — malware.

  Riltok can query the device's IMEI.[Kaspersky Riltok June 2019]

  Exact relationship: relationship--1250f91c-723d-4b4c-afea-b3a71101951f
• S0405 Exodus — malware.

  Exodus One queries the device for its IMEI code and the phone number in order to validate the target of a new infection.[SWB Exodus March 2019]

  Exact relationship: relationship--789dd0f9-527c-49b3-93b7-851ce4961f0f
• S0406 Gustuff — malware.

  Gustuff gathers the device IMEI to send to the command and control server.[Talos Gustuff Apr 2019]

  Exact relationship: relationship--95bf4e8b-f388-48a0-b236-c2077252e71e
• S0407 Monokle — malware.

  Monokle checks if the device is connected via Wi-Fi or mobile data.[Lookout-Monokle]

  Exact relationship: relationship--9373912a-affa-4a3c-ad97-1b8311e228ee
• S0411 Rotexy — malware.

  Rotexy collects the device's IMEI and sends it to the command and control server.[securelist rotexy 2018]

  Exact relationship: relationship--ca4eb452-4a2f-41d7-a015-81f43e96737e
• S0425 Corona Updates — malware.

  Corona Updates can collect device network configuration information, such as Wi-Fi SSID and IMSI.[TrendMicro Coronavirus Updates]

  Exact relationship: relationship--a3a8b2f2-f1aa-49ba-be55-a674f371f209
• S0427 TrickMo — malware.

  TrickMo can collect device network configuration information such as IMSI, IMEI, and Wi-Fi connection state.[SecurityIntelligence TrickMo]

  Exact relationship: relationship--15eccf44-e528-41fb-9cb8-834c8c0ca9d9
• S0432 Bread — malware.

  Bread collects the device’s IMEI, carrier, mobile country code, and mobile network code.[Google Bread]

  Exact relationship: relationship--86e3c37c-1e4a-450c-850b-c80be8156fe3
• S0463 INSOMNIA — malware.

  INSOMNIA can collect the device’s phone number, ICCID, IMEI, and the currently active network interface (Wi-Fi or cellular).[Google Project Zero Insomnia]

  Exact relationship: relationship--61550ef4-41f0-4354-af5c-f47db8aca654
• S0478 EventBot — malware.

  EventBot can gather device network information.[Cybereason EventBot]

  Exact relationship: relationship--529107fd-6420-4573-8dbf-cdcd49c2708c
• S0489 WolfRAT — malware.

  WolfRAT sends the device’s IMEI with each exfiltration request.[Talos-WolfRAT]

  Exact relationship: relationship--20376a7f-897a-4f5d-a87a-93e64200a5a6
• S0490 XLoader for iOS — malware.

  XLoader for iOS can obtain the device’s IMEM, ICCID, and MEID.[TrendMicro-XLoader-FakeSpy]

  Exact relationship: relationship--3f81a680-3151-4608-b83f-550756632013
• S0506 ViperRAT — malware.

  ViperRAT can collect network configuration data from the device, including phone number, SIM operator, and network operator.[Lookout ViperRAT]

  Exact relationship: relationship--b6726136-3c20-4921-a0cb-75a66f59107c
• S0509 FakeSpy — malware.

  FakeSpy can collect device networking information, including phone number, IMEI, and IMSI.[Cybereason FakeSpy]

  Exact relationship: relationship--020a1aaa-a444-4f3c-a08b-f1369be276f2
• S0522 Exobot — malware.

  Exobot can obtain the device’s IMEI, phone number, and IP address.[Threat Fabric Exobot]

  Exact relationship: relationship--c368c932-7d5a-40e3-a18b-f30e82b9e4e6
• S0529 CarbonSteal — malware.

  CarbonSteal has collected device network information, including 16-bit GSM Cell Identity, 16-bit Location Area Code, Mobile Country Code (MCC), and Mobile Network Code (MNC). CarbonSteal has also called `netcfg` to get stats.[Lookout Uyghur Campaign]

  Exact relationship: relationship--8870c211-820a-46a1-96fc-02f4e6eaec03
• S0535 Golden Cup — malware.

  Golden Cup can collect the device’s phone number and IMSI.[Symantec GoldenCup]

  Exact relationship: relationship--5977289e-d38f-4974-912b-2151fc00c850
• S0536 GPlayed — malware.

  GPlayed can collect the device’s IMEI, phone number, and country.[Talos GPlayed]

  Exact relationship: relationship--58c0fe4b-612d-4fc6-973f-16914b0f4b72
• S0540 Asacub — malware.

  Asacub can collect various pieces of device network configuration information, such as mobile network operator.[Securelist Asacub]

  Exact relationship: relationship--759a2e09-32b6-4857-9b6d-adf5dcee142b
• S0545 TERRACOTTA — malware.

  TERRACOTTA has collected the device’s phone number and can check if the active network connection is metered.[WhiteOps TERRACOTTA]

  Exact relationship: relationship--d53a8ff0-7252-477e-8767-fd485dd62e7c
• S0577 FrozenCell — malware.

  FrozenCell has collected phone metadata such as cell location, mobile country code (MCC), and mobile network code (MNC).[Lookout FrozenCell]

  Exact relationship: relationship--5c1e3aa9-160d-49fd-83a2-2ed2f8c5435c
• S1056 TianySpy — malware.

  TianySpy can check to see if Wi-Fi is enabled.[trendmicro_tianyspy_0122]

  Exact relationship: relationship--eee008fa-a46f-4542-93e3-8fe5f949130f
• S1061 AbstractEmu — malware.

  AbstractEmu can collect device IP address and SIM information.[lookout_abstractemu_1021]

  Exact relationship: relationship--1c67b72f-7389-4c21-9347-2b1bba07aaaf
• S1077 Hornbill — malware.

  Hornbill can collect a device's phone number and IMEI, and can check to see if WiFi is enabled.[lookout_hornbill_sunbird_0221]

  Exact relationship: relationship--1329a866-0f6b-4660-b537-a6d208352502
• S1079 BOULDSPY — malware.

  BOULDSPY can collect network information, such as IP address, SIM card information, and Wi-Fi information.[lookout_bouldspy_0423]

  Exact relationship: relationship--56c8af86-2924-46f8-a1d7-8309ee6f0282
• S1082 Sunbird — malware.

  Sunbird can exfiltrate phone number and IMEI.[lookout_hornbill_sunbird_0221]

  Exact relationship: relationship--0c417238-738d-4bda-8359-d37d39414ebe
• S1093 FlyTrap — malware.

  FlyTrap can collect IP address and network configuration information.[Trend Micro FlyTrap]

  Exact relationship: relationship--f8151852-5a56-4c91-a691-1e50387a291d
• S1185 LightSpy — malware.

  LightSpy has collected device information such as IMEI, phone number, MAC address and IP address.[LinkedIn Dmitry LightSpy 2025]

  Exact relationship: relationship--7c67e8eb-4967-4858-8bfe-bb68c3f30cfd
• S1214 Android/SpyAgent — malware.

  Android/SpyAgent has collected device network information, such as the IMEI and the phone number.[McAfee MoqHao 2019]

  Exact relationship: relationship--d8001cd5-3e71-44af-ae85-26f5f56e5cb8
• S1215 Binary Validator — malware.

  Binary Validator has collected the device’s phone number and IMEI.[SecureList OpTriangulation 23Oct2023]

  Exact relationship: relationship--d2304825-cd71-4d74-ab9c-0f4ad510cad3
• S1216 TriangleDB — malware.

  TriangleDB has collected and sent information on the device’s IMEI, MEID, serial number and other device information.[SecureList OpTriangulation 21Jun2023]

  Exact relationship: relationship--ec6ec329-a758-4259-a5f8-789cfef78a53
• S1231 GodFather — malware.

  GodFather has accessed the device’s current cellular network information, including the phone number and the serial number.[MerkleScience_Godfather_April2023]

  Exact relationship: relationship--9f617f18-5b84-4fcd-a7e3-0e0d67a86192
• S1241 RatMilad — malware.

  RatMilad has collected device information such as MAC address, IMEI and phone number.[ZimperiumGupta_RatMilad_Oct2022]

  Exact relationship: relationship--f54196e6-3efd-4562-ae86-37bb79ec49f6
• S9005 DocSwap — malware.

  DocSwap has checked for the `LOCAL_MAC_ADDRESS` and `READ_PRIVILEGED_PHONE_STATE` permissions.[EnkiWhiteHat_KimsukyDOCSWAP_Dec2025]

  Exact relationship: relationship--4a4a6166-57de-43c1-a0af-5416b561a9d8

• M1006 Use Recent OS Version

  Android 10 introduced changes that prevent normal applications from accessing sensitive device identifiers.[TelephonyManager]