ATT&CK Mobile T1418 Software Discovery Guide

Before a mobile banking trojan draws an overlay or a spyware implant decides whether to stay, it usually asks one question: which apps are on this phone? MITRE ATT&CK for Mobile T1418 Software Discovery covers adversaries listing installed applications to shape follow-on behaviour, including whether to fully infect the device, and its sub-technique T1418.001 Security Software Discovery covers looking specifically for security products. ATT&CK lists it for Android and iOS under Discovery (TA0032), with one of the longest procedure lists in the Mobile matrix. This guide covers how the platforms limit app enumeration, how to spot over-broad enumeration in app vetting and telemetry, and what to do with the signal. It is for mobile security engineers, app vetting teams and threat analysts. The Enterprise equivalent is T1518 Software Discovery.

Key takeaways

Discovery decides the attack. ATT&CK examples such as Anubis, Riltok and S.O.V.A. compare the installed app list with a target list of banking or crypto apps before acting.
Android 11 filters the package list. Apps targeting Android 11 or later see a filtered list unless they declare <queries> or the QUERY_ALL_PACKAGES permission, which Google Play subjects to approval.
iOS limits app enumeration. ATT&CK states that App Store apps cannot list installed applications; canOpenURL only answers for URL schemes declared in LSApplicationQueriesSchemes, capped at 50 entries for apps linked on iOS 15 or later.
Security software is a target. Under T1418.001, Gustuff checks for antivirus apps from a list and Exobot can close a running antivirus app.
Enumeration is a vetting signal. A flashlight or game app that declares QUERY_ALL_PACKAGES, or probes dozens of URL schemes, deserves a closer look.

How app enumeration works and where the platforms limit it

Aspect	Android	iOS and iPadOS
Typical API (ATT&CK analytic)	`PackageManager.getInstalledPackages()` or `getInstalledApplications()`; `getPackageInfo()` for specific packages	`UIApplication.canOpenURL()` probing URL schemes
Platform limit	Package visibility filtering for apps targeting Android 11 (API 30) or later; some packages are visible automatically	Undeclared schemes always return false; 50-entry cap from iOS 15
Broad access route	`QUERY_ALL_PACKAGES`, subject to Google Play approval; Google Play treats the installed app list as personal and sensitive user data	ATT&CK notes iOS 12 removed a private API that non-App Store apps had used to list installed apps
Exposure outside the store	Sideloaded apps are not reviewed against Play policy	Enterprise-signed or otherwise non-App Store apps are the ATT&CK concern (M1011)
Privileged route	Triada modified `com.android.systemui` to gain `GET_REAL_TASKS` for foreground app information	Operation Triangulation (C0054) and TriangleDB obtained installed app lists after exploitation

ATT&CK's mitigations are M1006 Use Recent OS Version (Android 11 package visibility, iOS 12 API removal) and M1011 User Guidance (do not install iOS apps from unofficial sources).

Real cases from ATT&CK procedure examples

Banking trojans: Anubis, Riltok, S.O.V.A., Cerberus, Ginp, EventBot, TrickMo and GodFather list installed apps, several comparing them against a target list; CherryBlos looked specifically for cryptocurrency wallet apps.
Spyware: Pegasus for Android, Monokle, Exodus, FlexiSpy, LightSpy, Hornbill (searching for apps such as WhatsApp) and BOULDSPY collect app lists.
iOS campaigns: during Operation Triangulation, the actors obtained a list of installed applications, and INSOMNIA could list installed non-Apple applications.
Group campaigns: in C0033, PROMETHIUM (G0056) used StrongPity to obtain the installed app list.
Security software discovery (T1418.001): Gustuff checks for antivirus software from a predefined list, BRATA searches for installed security apps, and Exobot can detect and close a running antivirus app.

For the families involved, see the Android Banking Trojans Guide and the Commercial Spyware Guide.

T1418.001 Security Software Discovery

When malware finds a mobile threat defence (MTD) agent, an MDM agent or an antivirus app, ATT&CK says it may change course: hold back, avoid full infection or try to disable the product. The iOS analytic in ATT&CK looks for canOpenURL() calls against schemes of MDM or security tools by apps not on an approved list; the Android analytic looks for getPackageInfo() calls naming security tool packages. Two defensive consequences follow:

Absence of alerts is not absence of malware. A device carrying security tooling may see quieter behaviour, so pair on-device signals with network and server-side detection.
Agent health is a control. Alert when an MTD or MDM agent stops reporting, is disabled or loses permissions, as that can follow discovery.

Prevention and hardening

Restrict app sources. On managed Android devices block unknown sources; on supervised iOS devices use the "Allow app installation from a website" and alternative marketplace restrictions where applicable, and keep "Install apps" governed by MDM.
Set an OS floor. Require Android 11 or later so package visibility filtering applies to apps that target it, and a current iOS release.
Vet for over-broad enumeration. In static review flag QUERY_ALL_PACKAGES, wide <queries> declarations and long LSApplicationQueriesSchemes lists, and ask what the business need is.
Check your own apps. Declare only the packages and schemes you need; broad visibility in your app is privacy-sensitive data under Google Play policy.
Protect the security agents. Use device owner or supervised mode so users and apps cannot remove MDM or MTD agents, and alert on agent loss.

Detection and measurement

Data source (ATT&CK detection strategy)	Android	iOS
App vetting and dynamic analysis	Calls to `getInstalledPackages()` or `getInstalledApplications()` by apps not on an enumeration allow-list	`canOpenURL()` called many times, or with schemes not declared in `LSApplicationQueriesSchemes`, in a short window
Management state	Managed package inventory and metadata via Android Enterprise or EMM	`InstalledApplicationList` and `ManagedApplicationList` via Apple MDM
Network	Android Enterprise network logging or VPN flow data showing an upload soon after first launch	Network Extension, per-app VPN or gateway flows

Discovery usually happens immediately after installation and is followed by exfiltration of the list, so a new app making an early upload to an unfamiliar domain is worth correlating with its permission set. Measures:

Percentage of approved third-party apps reviewed for QUERY_ALL_PACKAGES or broad scheme lists.
Number of managed devices allowing unknown sources (target zero).
Percentage of devices at Android 11 or later.
MTD and MDM agent health: devices with an agent silent for more than 24 hours.
Time from MTD detection of an enumerating app to its removal.

Common failure patterns

Treating discovery as harmless. App lists drive targeting; a trojan that finds your banking app is one step from an overlay.
Approving apps on store presence alone. Play review applies to QUERY_ALL_PACKAGES but not to sideloaded or third-party store apps.
No alert on agent loss. Security software discovery followed by agent removal is quiet unless you watch agent health.
Over-broad visibility in your own apps. Copy-pasted <queries> blocks and scheme lists widen privacy exposure and invite store rejection.

Framework mapping

Framework	Reference	How it applies
MITRE ATT&CK for Mobile	T1418, T1418.001; TA0032; M1006, M1011	Technique, tactic and listed mitigations
NIST SP 800-53 Rev 5	AC-19; CM-11 User-installed Software; CM-8 System Component Inventory; SI-4	Govern app installs, keep inventory, monitor
NIST CSF 2.0	ID.AM-02; DE.CM-09	Software inventory; monitoring of endpoints
OWASP MASVS	MASVS-PRIVACY	Data minimisation in your own apps, including app visibility

Practitioner checklist

Block unknown sources and unofficial app distribution on managed devices.
Require Android 11 or later and a current iOS release.
Flag QUERY_ALL_PACKAGES and long URL scheme lists during app vetting.
Limit <queries> and LSApplicationQueriesSchemes in your own apps to what is needed.
Run MDM and MTD agents in modes users cannot remove, and alert on silence.
Correlate new-app installs with early outbound connections.

Mobile T1418 Software Discovery: Detecting App Enumeration on Android and iOS