T1418: Software Discovery
Adversaries may attempt to get a listing of applications that are installed on a device. Adversaries may use the information from Software Discovery during automated discovery to shape follow-on behaviors, including whether or not to fully infect the target and/or attempts specific actions.
Adversaries may attempt to enumerate applications for a variety of reasons, such as figuring out what security measures are present or to identify the presence of target applications.
Security context for executives and security teams
Software Discovery on mobile devices is the act of enumerating installed applications on Android or iOS. Its business significance is that app inventory can help malicious software decide what to do next, such as identifying security tools or target apps. For leaders, this is a mobile risk and visibility problem: if the organization cannot tell which apps are installed, which devices are current, and which app-inventory behaviors are observable, it may miss early reconnaissance that shapes later compromise activity.
Executive priority
Prioritize this technique where mobile devices have access to sensitive business data, executive communications, financial applications, regulated workflows, or operational systems. The ATT&CK relationships show this behavior is used by multiple mobile malware families and campaigns, including spyware, banking trojans, and surveillanceware, so it should be considered in mobile security monitoring, incident response readiness, and compliance evidence for managed device governance. Executives should ask whether mobile OS currency, user guidance, and mobile telemetry are sufficient to prove control coverage rather than assuming endpoint controls cover phones and tablets by default.
Technical view
For SOC, detection engineering, and IR teams, validate coverage for Android and iOS application-enumeration behavior. ATT&CK does not provide official detection text for T1418, but it does reference DET0600, Detection of Software Discovery, as a related detection strategy. Teams should confirm whether mobile device management, mobile threat defense, endpoint telemetry, or app vetting processes can expose suspicious requests for installed-app listings, especially when paired with discovery of security applications under sub-technique T1418.001. During investigations, app enumeration should be treated as context for follow-on behavior rather than a standalone proof of compromise.
Likely telemetry
- Mobile device inventory and installed-application lists from managed Android and iOS devices
- Mobile security or mobile threat defense alerts related to application enumeration or suspicious app behavior
- Mobile OS version, patch level, and device management compliance state
- Application permission, entitlement, and configuration data where available
- Incident response artifacts from suspect mobile applications, including observed access to app inventory or security-tool discovery behavior
Detection direction
- Map current mobile telemetry against DET0600 and identify whether app-enumeration events are actually visible for both Android and iOS estates.
- Tune detections to reduce noise from legitimate management, backup, enterprise app catalog, and security tooling activity that may also inspect installed applications.
- Give higher investigative weight when software discovery is paired with security software discovery, suspicious permissions, untrusted apps, or other mobile malware behaviors.
- Validate visibility separately for managed and unmanaged/BYOD devices; unmanaged devices may create a major blind spot.
- Do not treat lack of alerts as evidence of absence because the ATT&CK object does not provide official detection logic and mobile platforms may limit available telemetry.
Mitigation priorities
- Maintain recent Android and iOS operating system versions, aligning with ATT&CK mitigation M1006, because newer mobile OS versions may include security architecture improvements and blocks against observed techniques.
- Provide user guidance, aligning with M1011, on risky mobile application behaviors, untrusted app sources, and configuration choices that affect mobile exposure.
- Use mobile governance processes to maintain an accurate app inventory and distinguish approved business applications from unexpected or risky software.
- Include mobile devices in incident response playbooks, evidence collection plans, and compliance reporting rather than limiting scope to traditional endpoints.
- Review policies for high-risk users and sensitive business workflows where installed-app discovery could help an adversary select banking, messaging, security, or enterprise applications for follow-on actions.
Additional notes and limits
This object is a mobile ATT&CK technique for Android and iOS with no specified tactic and no official detection text. The relationship set is useful: it includes a detection strategy reference, two mitigations, a security-software discovery sub-technique, two campaigns, and numerous software examples that use the behavior. That breadth supports treating app enumeration as a meaningful mobile reconnaissance signal, but local device ownership models, OS versions, management coverage, and telemetry sources determine practical detectability.
This take is based only on the supplied ATT&CK fields, external references, and relationships. It does not establish current exploitation, attribution, customer exposure, or guaranteed detection coverage. Several related software descriptions are platform-specific and should not be generalized beyond the supplied platform fields. Organizations need local mobile telemetry and policy context to determine risk and coverage.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Software Discovery
Adversaries may attempt to get a listing of applications that are installed on a device. Adversaries may use the information from Software Discovery during automated discovery to shape follow-on behaviors, including whether or not to fully infect the target and/or attempts specific actions.
Adversaries may attempt to enumerate applications for a variety of reasons, such as figuring out what security measures are present or to identify the presence of target applications.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Related techniques
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Mobile | T1418.001 | Security Software DiscoverySub-technique | Security Software Discovery subtechnique of this object. |
Groups, software, and campaigns
S1062: S.O.V.A.
S.O.V.A. is an Android banking trojan that was first identified in August 2021 and has subsequently been found in a variety of applications, including banking, cryptocurrency wallet/exchange, and shopping apps. S.O.V.A., which is Russian for "owl", contains features not commonly found in Android malware, such as session cookie theft.[1][2]
S1241: RatMilad
RatMilad is an Android remote access tool (RAT) with spyware functionality that has been used to target enterprise mobile devices in the Middle East since at least 2021. Variants of RatMilad have been disguised as VPN applications and a fake app named NumRent. Upon installation, RatMilad employs multiple Collection techniques to collect sensitive information before uploading the collected data to its command and control (C2) server. [1]
S0505: Desert Scorpion
Desert Scorpion is surveillanceware that has targeted the Middle East, specifically individuals located in Palestine. Desert Scorpion is suspected to have been operated by the threat actor APT-C-23.[1]
There are multiple close variants of Desert Scorpion, such as VAMP[2], GnatSpy[3], FrozenCell and SpyC23, which add some additional functionality but are not significantly different from the original malware.
S1069: TangleBot
TangleBot is SMS malware that was initially observed in September 2021, primarily targeting mobile users in the United States and Canada. TangleBot has used SMS text message lures about COVID-19 regulations and vaccines to trick mobile users into downloading the malware, similar to FluBot Android malware campaigns.[1]
S1225: CherryBlos
CherryBlos is an Android malware that steals credentials and redirects cryptocurrency to adversary-controlled wallets. CherryBlos was labelled Robot 999 in its first appearance in April 2023; since then, various aliases have been used, including GPTalk, Happy Miner, and SynthNet. The threat actors behind CherryBlos uploaded the malware to different Google Play regions, such as Malaysia, Vietnam, Indonesia, Philippines, Uganda, and Mexico.[1]
S0399: Pallas
Pallas is mobile surveillanceware that was custom-developed by Dark Caracal.[1]
S0489: WolfRAT
S0509: FakeSpy
S1216: TriangleDB
TriangleDB is an Objective-C written implant deployed after Binary Validator and after root privileges are obtained during Operation Triangulation’s infection chain. Upon execution, TriangleDB communicates with the C2 server, relaying information about the victim device.[1]
S0529: CarbonSteal
CarbonSteal is one of a family of four surveillanceware tools that share a common C2 infrastructure. CarbonSteal primarily deals with audio surveillance. [1]
S0403: Riltok
S0427: TrickMo
C0054: Operation Triangulation
Operation Triangulation is a mobile campaign targeting iOS devices.[1] The unidentified actors used zero-click exploits in iMessage attachments to gain Initial Access, then executed exploits and validators, such as Binary Validator before finally executing the TriangleDB implant.
C0033: C0033
C0033 was a PROMETHIUM campaign during which they used StrongPity to target Android users. C0033 was the first publicly documented mobile campaign for PROMETHIUM, who previously used Windows-based techniques.[1]
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 2.1 | Current bundle | 5137627839d7… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]SecureList OpTriangulation 21Jun2023
Kucherin, G., et al. (2023, June 21). Dissecting TriangleDB, a Triangulation spyware implant. Retrieved April 18, 2024.
Open source URL - [2]cleafy_sova_1122
Francesco Lubatti, Federico Valentini. (2022, November 8). SOVA malware is back and is evolving rapidly. Retrieved March 30, 2023.
Open source URL - [3]ZimperiumGupta_RatMilad_Oct2022
Gupta, N. (2022, October 5). We Smell A RatMilad Android Spyware. Retrieved August 27, 2025.
Open source URL - [4]Lookout Desert Scorpion
A. Blaich, M. Flossman. (2018, April 16). Lookout finds new surveillanceware in Google Play with ties to known threat actor targeting the Middle East. Retrieved September 11, 2020.
Open source URL - [5]cloudmark_tanglebot_0921
Felipe Naves, Andrew Conway, W. Stuart Jones, Adam McNeil . (2021, September 23). TangleBot: New Advanced SMS Malware Targets Mobile Users Across U.S. and Canada with COVID-19 Lures. Retrieved February 28, 2023.
Open source URL - [6]TrendMicro_CherryBlos_July2023
Trend Micro Research. (2023, July 28). Related CherryBlos and FakeTrade Android Malware Involved in Scam Campaigns. Retrieved March 28, 2025.
Open source URL - [7]Lookout Dark Caracal Jan 2018
Blaich, A., et al. (2018, January 18). Dark Caracal: Cyber-espionage at a Global Scale. Retrieved April 11, 2018.
Open source URL - [8]Talos-WolfRAT
W. Mercer, P. Rascagneres, V. Ventura. (2020, May 19). The wolf is back... . Retrieved July 20, 2020.
Open source URL - [9]Cybereason FakeSpy
O. Almkias. (2020, July 1). FakeSpy Masquerades as Postal Service Apps Around the World. Retrieved September 15, 2020.
Open source URL - [10]Lookout Uyghur Campaign
A. Kumar, K. Del Rosso, J. Albrecht, C. Hebeisen. (2020, June 1). Mobile APT Surveillance Campaigns Targeting Uyghurs - A collection of long-running Android tooling connected to a Chinese mAPT actor. Retrieved November 10, 2020.
Open source URL - [11]Kaspersky Riltok June 2019
Tatyana Shishkova. (2019, June 25). Riltok mobile Trojan: A banker with global reach. Retrieved August 7, 2019.
Open source URL - [12]SecurityIntelligence TrickMo
P. Asinovsky. (2020, March 24). TrickBot Pushing a 2FA Bypass App to Bank Customers in Germany. Retrieved April 24, 2020.
Open source URL - [13]SecureList - ViceLeaker 2019
GReAT. (2019, June 26). ViceLeaker Operation: mobile espionage targeting Middle East. Retrieved November 21, 2019.
Open source URL - [14]Talos GPlayed
V. Ventura. (2018, October 11). GPlayed Trojan - .Net playing with Google Market . Retrieved November 24, 2020.
Open source URL - [15]Palo Alto HenBox
A. Hinchliffe, M. Harbison, J. Miller-Osborn, et al. (2018, March 13). HenBox: The Chickens Come Home to Roost. Retrieved September 9, 2019.
Open source URL - [16]Cybereason EventBot
D. Frank, L. Rochberger, Y. Rimmer, A. Dahan. (2020, April 30). EventBot: A New Mobile Banking Trojan is Born. Retrieved June 26, 2020.
Open source URL - [17]Google Triada June 2019
Lukasz Siewierski. (2019, June 6). PHA Family Highlights: Triada. Retrieved July 16, 2019.
Open source URL - [18]cyble_chameleon_0423
Cyble Research & Intelligence Labs. (2023, April 13). Banking Trojan targeting mobile users in Australia and Poland. Retrieved August 16, 2023.
Open source URL - [19]Google Project Zero Insomnia
I. Beer. (2019, August 29). Implant Teardown. Retrieved June 2, 2020.
Open source URL - [20]CheckPoint Agent Smith
A. Hazum, F. He, I. Marom, B. Melnykov, A. Polkovnichenko. (2019, July 10). Agent Smith: A New Species of Mobile Malware. Retrieved May 7, 2020.
Open source URL - [21]SecureList OpTriangulation 23Oct2023
Kucherin, G., et al. (2023, October 23). The outstanding stealth of Operation Triangulation. Retrieved April 18, 2024.
Open source URL - [22]Cofense Anubis
M. Feller. (2020, February 5). Infostealer, Keylogger, and Ransomware in One: Anubis Targets More than 250 Android Applications. Retrieved September 25, 2024.
Open source URL - [23]ESET DEFENSOR ID
L. Stefanko. (2020, May 22). Insidious Android malware gives up all malicious features but one to gain stealth. Retrieved June 26, 2020.
Open source URL - [24]welivesec_strongpity
Stefanko, L. (2023, January 10). StrongPity espionage campaign targeting Android users. Retrieved January 31, 2023.
Open source URL - [25]WeLiveSecurity AdDisplayAshas
L. Stefanko. (2019, October 24). Tracking down the developer of Android adware affecting millions of users. Retrieved October 29, 2020.
Open source URL - [26]Zscaler TikTok Spyware
S. Desai. (2020, September 8). TikTok Spyware. Retrieved January 5, 2021.
Open source URL - [27]lookout_hornbill_sunbird_0221
Apurva Kumar, Kristin Del Rosso. (2021, February 10). Novel Confucius APT Android Spyware Linked to India-Pakistan Conflict. Retrieved June 9, 2023.
Open source URL - [28]lookout_abstractemu_1021
P Shunk, K Balaam. (2021, October 28). Rooting Malware Makes a Comeback: Lookout Discovers Global Campaign. Retrieved February 6, 2023.
Open source URL - [29]securelist rotexy 2018
T. Shishkova, L. Pikman. (2018, November 22). The Rotexy mobile Trojan – banker and ransomware. Retrieved September 23, 2019.
Open source URL - [30]ThreatFabric Ginp
ThreatFabric. (2019, November). Ginp - A malware patchwork borrowing from Anubis. Retrieved April 8, 2020.
Open source URL - [31]WhiteOps TERRACOTTA
Satori Threat Intelligence and Research Team. (2020, August). TERRACOTTA Android Malware: A Technical Study. Retrieved December 18, 2020.
Open source URL - [32]Trend Micro Bouncing Golf 2019
E. Xu, G. Guo. (2019, June 28). Mobile Cyberespionage Campaign ‘Bouncing Golf’ Affects Middle East. Retrieved January 27, 2020.
Open source URL - [33]Threat Fabric Cerberus
Threat Fabric. (2019, August). Cerberus - A new banking Trojan from the underworld. Retrieved June 26, 2020.
Open source URL - [34]Android Package Visibility
Google. (n.d.). Package visibility filtering on Android. Retrieved April 11, 2022.
Open source URL - [35]Bitdefender Mandrake
R. Gevers, M. Tivadar, R. Bleotu, A. M. Barbatei, et al.. (2020, May 14). Uprooting Mandrake: The Story of an Advanced Android Spyware Framework That Went Undetected for 4 Years. Retrieved July 15, 2020.
Open source URL - [36]ZimperiumOrtegaPratapagiri_GodFather_Jun2025
Ortega, F. Pratapagiri, V. (2025, June 18). Your Mobile App, Their Playground: The Dark Side of Virtualization. Retrieved July 16, 2025.
Open source URL - [37]MerkleScience_Godfather_April2023
Merkle Science. (2023, April 25). The Godfather Android Malware: Threat under the lens. Retrieved July 16, 2025.
Open source URL - [38]FlexiSpy-Features
FlexiSpy. (n.d.). FlexiSpy Monitoring Features. Retrieved September 4, 2019.
Open source URL - [39]Symantec GoldenCup
R. Iarchy, E. Rynkowski. (2018, July 5). GoldenCup: New Cyber Threat Targeting World Cup Fans. Retrieved October 29, 2020.
Open source URL - [40]lookout_bouldspy_0423
Kyle Schmittle, Alemdar Islamoglu, Paul Shunk, Justin Albrecht. (2023, April 27). Lookout Discovers Android Spyware Tied to Iranian Police Targeting Minorities: BouldSpy. Retrieved July 21, 2023.
Open source URL - [41]paloalto_yispecter_1015
Claud Xiao. (2015, October 4). YiSpecter: First iOS Malware That Attacks Non-jailbroken Apple iOS Devices by Abusing Private APIs. Retrieved March 3, 2023.
Open source URL - [42]ThreatFabric_Crocodilus_March2025
ThreatFabric. (2025, March 28). Exposing Crocodilus: New Device Takeover Malware Targeting Android Devices. Retrieved November 24, 2025.
Open source URL - [43]S2W_DocSwap_Mar2025
Kim, H., S2W TALON. (2025, March 13). Detailed Analysis of DocSwap Malware Disguised as Security Document Viewer. Retrieved January 12, 2026.
Open source URL - [44]MelikovBlackBerry LightSpy 2024
Melikov, D. (2024, April 11). LightSpy Returns: Renewed Espionage Campaign Targets Southern Asia, Possibly India. Retrieved January 14, 2025.
Open source URL - [45]Threatfabric LightSpy 2023
ThreatFabric. (2023, October 2). LightSpy mAPT Mobile Payment System Attack. Retrieved January 17, 2025.
Open source URL - [46]Threatfabric LightSpy 2024
ThreatFabric. (2024, October 29). LightSpy: Implant for iOS. Retrieved January 30, 2025.
Open source URL - [47]LinkedIn Dmitry LightSpy 2025
Dmitry Bestuzhev. (2025, April 7). The Coordinated Kill Switch: LightSpy's iOS Destructive Plugin Architecture Manages Device Disablement. Retrieved April 14, 2025.
Open source URL - [48]Sophos Red Alert 2.0
J. Chandraiah. (2018, July 23). Red Alert 2.0: Android Trojan targets security-seekers. Retrieved December 14, 2020.
Open source URL - [49]Lookout-StealthMango
Lookout. (n.d.). Stealth Mango & Tangelo. Retrieved September 27, 2018.
Open source URL - [50]ESET_VajraSpy_Feb2024
Stefanko, L. (2024, February 1). VajraSpy: A Patchwork of espionage apps. Retrieved October 27, 2025.
Open source URL - [51]K7Dhanalakshmi_VajraSpy_April2022
Dhanalakshmi. (2022, April 19). VajraSpy – An Android RAT. Retrieved November 5, 2025.
Open source URL - [52]Lookout-PegasusAndroid
Mike Murray. (2017, April 3). Pegasus for Android: the other side of the story emerges. Retrieved April 16, 2017.
Open source URL - [53]Lookout-Monokle
Bauer A., Kumar A., Hebeisen C., et al. (2019, July). Monokle: The Mobile Surveillance Tooling of the Special Technology Center. Retrieved September 4, 2019.
Open source URL - [54]SWB Exodus March 2019
Security Without Borders. (2019, March 29). Exodus: New Android Spyware Made in Italy. Retrieved November 17, 2024.
Open source URL - [55]NIST Mobile Threat CatalogueAPP-12Open source URL
- [56]NIST Mobile Threat CatalogueAPP-12Open source URL
- [57]mitre-attackT1418Open source URL
- [58]mitre-attackT1418Open source URL
- [59]SecureList OpTriangulation 21Jun2023
Kucherin, G., et al. (2023, June 21). Dissecting TriangleDB, a Triangulation spyware implant. Retrieved April 18, 2024.
Open source URL - [60]lookout_hornbill_sunbird_0221
Apurva Kumar, Kristin Del Rosso. (2021, February 10). Novel Confucius APT Android Spyware Linked to India-Pakistan Conflict. Retrieved June 9, 2023.
Open source URL - [61]Lookout Uyghur Campaign
A. Kumar, K. Del Rosso, J. Albrecht, C. Hebeisen. (2020, June 1). Mobile APT Surveillance Campaigns Targeting Uyghurs - A collection of long-running Android tooling connected to a Chinese mAPT actor. Retrieved November 10, 2020.
Open source URL - [62]Lookout Uyghur Campaign
A. Kumar, K. Del Rosso, J. Albrecht, C. Hebeisen. (2020, June 1). Mobile APT Surveillance Campaigns Targeting Uyghurs - A collection of long-running Android tooling connected to a Chinese mAPT actor. Retrieved November 10, 2020.
Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.