DET0704: Detection of Compromise Software Dependencies and Development Tools
MITRE ATT&CK DET0704: Detection of Compromise Software Dependencies and Development Tools Detection Strategy details, with detection guidance, relationships and…
Security context for executives and security teams
DET0704 is a mobile ATT&CK detection strategy focused on spotting compromise of software dependencies and development tools. The business issue is supply-chain trust: mobile apps may inherit risk from third-party code or build components before the final product reaches users. For leaders, this matters because a weakness in dependency governance or build integrity can create downstream exposure that normal endpoint or app monitoring may not see until after release.
Executive priority
Treat this as a software supply-chain and mobile application assurance priority rather than only a SOC alerting problem. Security leaders should ask whether mobile development teams can prove what dependencies and tools were used, whether changes to those components are reviewed, and whether incident responders can trace a suspicious mobile app behavior back to a dependency or build process. This supports resilience, audit evidence, and risk-based prioritization for mobile applications on Android and iOS, as identified through the related ATT&CK technique.
Technical view
The supplied ATT&CK object has no official detection text, platforms, or tactics of its own, but it detects T1474.001, Compromise Software Dependencies and Development Tools, in the mobile domain. SOC, detection engineering, and IR teams should validate visibility across the mobile software delivery lifecycle: dependency inventories, build tool changes, package or library updates, code repository activity, build pipeline logs, application signing records, and release artifacts. Detection should focus on unexpected or unauthorized changes to dependencies, development tools, or delivery mechanisms that could introduce malicious code into Android or iOS applications.
Likely telemetry
- Software bill of materials or dependency inventory records for mobile applications
- Source code repository commit, merge, and review logs
- Build pipeline and continuous integration logs
- Development tool configuration and version change records
- Package manager or dependency update logs
Detection direction
- Confirm whether dependency and build-tool changes are logged with enough detail to support investigation, not just compliance inventory.
- Baseline expected dependency versions, maintainers, build tools, and release artifacts for mobile applications, then review deviations.
- Correlate repository, dependency, build, signing, and release events; isolated logs may miss supply-chain manipulation.
- Tune for legitimate developer activity, routine dependency upgrades, and automated build changes to reduce false positives.
- Use the relationship to T1474.001 as context: the concern is manipulation before receipt by the final consumer, so release provenance and pre-release controls are central.
Mitigation priorities
- Maintain an accurate inventory of mobile application dependencies and development tools.
- Require review and approval for dependency additions, version changes, and build tool modifications.
- Preserve build, signing, and release evidence so IR teams can reconstruct provenance during an investigation.
- Apply security assessment to third-party libraries and build outputs before release.
- Align mobile development, SOC, incident response, and compliance teams on what evidence proves dependency and build integrity.
Additional notes and limits
This take is based on the detection strategy object DET0704 and its relationship to T1474.001. Because the object does not include official detection guidance, the practical direction is inferred conservatively from the related technique description: adversaries may manipulate software dependencies or delivery mechanisms before the final consumer receives the application.
The ATT&CK object provides no official description, no official detection text, no tactics, and no platforms directly on the detection strategy. Android and iOS are included only because the related technique lists them. Local architecture, development workflow, repository tooling, and build pipeline evidence are required to determine actual coverage.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Detection of Compromise Software Dependencies and Development Tools
No official description is available in the imported ATT&CK source object.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.