Live Active security incident? Get immediate response
MITRE ATT&CK® Technique

T1418: Software Discovery

Adversaries may attempt to get a listing of applications that are installed on a device. Adversaries may use the information from Software Discovery during automated discovery to shape follow-on behaviors, including whether or not to fully infect the target and/or attempts specific actions.

Adversaries may attempt to enumerate applications for a variety of reasons, such as figuring out what security measures are present or to identify the presence of target applications.

MobileT1418TechniqueObject v2.1 Modified
Discuss defensive coverage Back to ATT&CK
Glexia's Take

Analyst context for executives and security teams

Analyst confidence High

Software Discovery on mobile devices is the act of enumerating installed applications on Android or iOS. Its business significance is that app inventory can help malicious software decide what to do next, such as identifying security tools or target apps. For leaders, this is a mobile risk and visibility problem: if the organization cannot tell which apps are installed, which devices are current, and which app-inventory behaviors are observable, it may miss early reconnaissance that shapes later compromise activity.

Executive priority

Prioritize this technique where mobile devices have access to sensitive business data, executive communications, financial applications, regulated workflows, or operational systems. The ATT&CK relationships show this behavior is used by multiple mobile malware families and campaigns, including spyware, banking trojans, and surveillanceware, so it should be considered in mobile security monitoring, incident response readiness, and compliance evidence for managed device governance. Executives should ask whether mobile OS currency, user guidance, and mobile telemetry are sufficient to prove control coverage rather than assuming endpoint controls cover phones and tablets by default.

Technical view

For SOC, detection engineering, and IR teams, validate coverage for Android and iOS application-enumeration behavior. ATT&CK does not provide official detection text for T1418, but it does reference DET0600, Detection of Software Discovery, as a related detection strategy. Teams should confirm whether mobile device management, mobile threat defense, endpoint telemetry, or app vetting processes can expose suspicious requests for installed-app listings, especially when paired with discovery of security applications under sub-technique T1418.001. During investigations, app enumeration should be treated as context for follow-on behavior rather than a standalone proof of compromise.

Likely telemetry

  • Mobile device inventory and installed-application lists from managed Android and iOS devices
  • Mobile security or mobile threat defense alerts related to application enumeration or suspicious app behavior
  • Mobile OS version, patch level, and device management compliance state
  • Application permission, entitlement, and configuration data where available
  • Incident response artifacts from suspect mobile applications, including observed access to app inventory or security-tool discovery behavior

Detection direction

  • Map current mobile telemetry against DET0600 and identify whether app-enumeration events are actually visible for both Android and iOS estates.
  • Tune detections to reduce noise from legitimate management, backup, enterprise app catalog, and security tooling activity that may also inspect installed applications.
  • Give higher investigative weight when software discovery is paired with security software discovery, suspicious permissions, untrusted apps, or other mobile malware behaviors.
  • Validate visibility separately for managed and unmanaged/BYOD devices; unmanaged devices may create a major blind spot.
  • Do not treat lack of alerts as evidence of absence because the ATT&CK object does not provide official detection logic and mobile platforms may limit available telemetry.

Mitigation priorities

  • Maintain recent Android and iOS operating system versions, aligning with ATT&CK mitigation M1006, because newer mobile OS versions may include security architecture improvements and blocks against observed techniques.
  • Provide user guidance, aligning with M1011, on risky mobile application behaviors, untrusted app sources, and configuration choices that affect mobile exposure.
  • Use mobile governance processes to maintain an accurate app inventory and distinguish approved business applications from unexpected or risky software.
  • Include mobile devices in incident response playbooks, evidence collection plans, and compliance reporting rather than limiting scope to traditional endpoints.
  • Review policies for high-risk users and sensitive business workflows where installed-app discovery could help an adversary select banking, messaging, security, or enterprise applications for follow-on actions.
Analyst notes and limits

This object is a mobile ATT&CK technique for Android and iOS with no specified tactic and no official detection text. The relationship set is useful: it includes a detection strategy reference, two mitigations, a security-software discovery sub-technique, two campaigns, and numerous software examples that use the behavior. That breadth supports treating app enumeration as a meaningful mobile reconnaissance signal, but local device ownership models, OS versions, management coverage, and telemetry sources determine practical detectability.

This take is based only on the supplied ATT&CK fields, external references, and relationships. It does not establish current exploitation, attribution, customer exposure, or guaranteed detection coverage. Several related software descriptions are platform-specific and should not be generalized beyond the supplied platform fields. Organizations need local mobile telemetry and policy context to determine risk and coverage.

Official MITRE ATT&CK definition

Software Discovery

Adversaries may attempt to get a listing of applications that are installed on a device. Adversaries may use the information from Software Discovery during automated discovery to shape follow-on behaviors, including whether or not to fully infect the target and/or attempts specific actions.

Adversaries may attempt to enumerate applications for a variety of reasons, such as figuring out what security measures are present or to identify the presence of target applications.

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Related techniques

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

1 rows
Domain ID Name Relationship / procedure
Mobile T1418.001 Security Software Discovery Sub-technique Security Software Discovery subtechnique of this object.
Associated objects

Groups, software, and campaigns

Malware Mobile

S1062: S.O.V.A.

S.O.V.A. is an Android banking trojan that was first identified in August 2021 and has subsequently been found in a variety of applications, including banking, cryptocurrency wallet/exchange, and shopping apps. S.O.V.A., which is Russian for "owl", contains features not commonly found in Android malware, such as session cookie theft.[1][2]

Android
Malware Mobile

S1241: RatMilad

RatMilad is an Android remote access tool (RAT) with spyware functionality that has been used to target enterprise mobile devices in the Middle East since at least 2021. Variants of RatMilad have been disguised as VPN applications and a fake app named NumRent. Upon installation, RatMilad employs multiple Collection techniques to collect sensitive information before uploading the collected data to its command and control (C2) server. [1]

Android
Malware Mobile

S1069: TangleBot

TangleBot is SMS malware that was initially observed in September 2021, primarily targeting mobile users in the United States and Canada. TangleBot has used SMS text message lures about COVID-19 regulations and vaccines to trick mobile users into downloading the malware, similar to FluBot Android malware campaigns.[1]

Android
Malware Mobile

S1225: CherryBlos

CherryBlos is an Android malware that steals credentials and redirects cryptocurrency to adversary-controlled wallets. CherryBlos was labelled Robot 999 in its first appearance in April 2023; since then, various aliases have been used, including GPTalk, Happy Miner, and SynthNet. The threat actors behind CherryBlos uploaded the malware to different Google Play regions, such as Malaysia, Vietnam, Indonesia, Philippines, Uganda, and Mexico.[1]

Android
Malware Mobile

S0509: FakeSpy

FakeSpy is Android spyware that has been operated by the Chinese threat actor behind the Roaming Mantis campaigns.[1]

Android
Malware Mobile

S0427: TrickMo

TrickMo a 2FA bypass mobile banking trojan, most likely being distributed by TrickBot. TrickMo has been primarily targeting users located in Germany.[1]

TrickMo is designed to steal transaction authorization numbers (TANs), which are typically used as one-time passwords.[1]

Android
Relationship explorer

All related ATT&CK context

uses · Campaign C0054: Operation Triangulation Mobile uses · Malware S1062: S.O.V.A. Mobile uses · Malware S1241: RatMilad Mobile subtechnique of · Technique T1418.001: Security Software Discovery Mobile uses · Malware S0505: Desert Scorpion Mobile uses · Malware S1069: TangleBot Mobile uses · Malware S1225: CherryBlos Mobile uses · Malware S0399: Pallas Mobile uses · Malware S0489: WolfRAT Mobile uses · Malware S0509: FakeSpy Mobile uses · Malware S1216: TriangleDB Mobile detects · Detection Strategy DET0600: Detection of Software Discovery Mobile uses · Malware S0529: CarbonSteal Mobile uses · Malware S0403: Riltok Mobile uses · Malware S0427: TrickMo Mobile uses · Malware S0418: ViceLeaker Mobile uses · Malware S0536: GPlayed Mobile uses · Malware S0544: HenBox Mobile uses · Malware S0478: EventBot Mobile uses · Malware S0424: Triada Mobile uses · Malware S1083: Chameleon Mobile uses · Malware S0463: INSOMNIA Mobile uses · Malware S0440: Agent Smith Mobile uses · Malware S1215: Binary Validator Mobile
Mitigations

Mitigation direction

Mitigation Mobile

M1011: User Guidance

Describes any guidance or training given to users to set particular configuration settings or avoid specific potentially risky behaviors.

Mitigation Mobile

M1006: Use Recent OS Version

New mobile operating system versions bring not only patches against discovered vulnerabilities but also often bring security architecture improvements that provide resilience against potential vulnerabilities or weaknesses that have not yet been discovered. They may also bring improvements that block use of observed adversary techniques.

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .

ATT&CK release
19.1
Object version
2.1
Created
Modified
Raw hash
5137627839d76867...
Imported snapshots across ATT&CK releases (1)
Release Bundle imported Object version Modified Status Raw hash
19.1 2.1 Current bundle 5137627839d7…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    NIST Mobile Threat Catalogue APP-12
    Open source URL
  2. [2]
    mitre-attack T1418
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use