AN1785: Analytic 1785
Defender correlates app attempts to enumerate or infer security/management tooling (ManagedConfiguration/MDM presence, VPN/NEFilter config, AV/EDR app presence via LaunchServices or URL-scheme probing, private APIs) with local inventory persistence and egress. Chain: probe (MDM/NE/VPN/AV presence) → burst of LS/canOpenURL/ManagedConfiguration calls → inventory cache write → small POST.
Analyst context for executives and security teams
This analytic describes an iOS behavior pattern where an app appears to check whether security or management tooling is present, persist what it finds locally, and then send a small outbound POST. For leaders, the value is not the individual API call; it is whether the organization can recognize mobile apps that are trying to map the defensive environment before adapting behavior or communicating inventory externally.
Executive priority
Prioritize this as a mobile security and compliance-readiness question: do managed iOS devices provide enough evidence to determine when an app is probing for MDM, VPN, network extension, AV/EDR, or related security controls and then exfiltrating that inventory? Security leaders should ask whether mobile telemetry, app vetting, MDM policy evidence, and incident response procedures can support an investigation of this chain on iOS devices.
Technical view
Validate coverage for the full observed chain on iOS: attempts to infer ManagedConfiguration or MDM presence, VPN or NEFilter configuration, AV/EDR app presence through LaunchServices or URL-scheme probing, possible private API use, local inventory/cache persistence, and a small outbound POST. Because the ATT&CK object provides no official detection logic and no tactics, teams should treat AN1785 as a detection-design prompt rather than a ready-to-run rule.
Likely telemetry
- iOS app behavior telemetry related to ManagedConfiguration or MDM checks
- LaunchServices or canOpenURL-style app and URL-scheme probing evidence where available
- Network Extension, VPN, or NEFilter configuration access indicators where available
- Local app storage or cache write evidence showing inventory persistence
- Outbound mobile network telemetry showing small POST requests after probing activity
Detection direction
- Correlate behavior rather than alerting on a single API family; the supplied chain is probe activity followed by inventory persistence and egress.
- Tune for bursts of security-tool discovery activity followed closely by local writes and outbound POST traffic.
- Reduce false positives by baselining legitimate enterprise, MDM, VPN, and security apps that may query management or network configuration for expected reasons.
- Check for blind spots where iOS privacy controls, limited endpoint visibility, unmanaged devices, or mobile network routing prevent correlation across app behavior, local persistence, and egress.
- Because no relationship context is supplied, do not assume a specific technique, campaign, actor, or malware family from this analytic alone.
Mitigation priorities
- Confirm which iOS devices are managed and whether MDM/mobile security tooling can provide app inventory, network, and policy evidence needed for investigation.
- Restrict or review untrusted apps that request or exercise capabilities associated with URL-scheme probing, configuration discovery, or unusual network egress.
- Use app vetting and mobile policy controls to reduce exposure to apps that enumerate installed security or management tooling without a clear business purpose.
- Ensure incident response playbooks cover mobile evidence collection, including app identity, device management state, local persistence indicators where accessible, and outbound network records.
- Maintain audit evidence showing mobile management posture, approved app controls, and monitoring limitations for iOS environments.
Analyst notes and limits
AN1785 is a mobile ATT&CK detection analytic for iOS, not a technique description. The strongest operational use is to test whether SOC, mobile security, and IR teams can correlate app-level security-tool discovery with persistence of an inventory artifact and outbound egress.
The supplied object has no official detection text, no tactics, and no relationship context. The take is therefore limited to the official description, platform, and external reference. Local telemetry availability on iOS will determine whether this can be detected or investigated in practice.
Analytic 1785
Defender correlates app attempts to enumerate or infer security/management tooling (ManagedConfiguration/MDM presence, VPN/NEFilter config, AV/EDR app presence via LaunchServices or URL-scheme probing, private APIs) with local inventory persistence and egress. Chain: probe (MDM/NE/VPN/AV presence) → burst of LS/canOpenURL/ManagedConfiguration calls → inventory cache write → small POST.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.1 | Current bundle | 7ece3190475b… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
mitre-attack AN1785Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.