Software Discovery: Security Software Discovery

Adversaries may attempt to get a listing of security applications and configurations that are installed on a device. This may include things such as mobile security products. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not to fully infect the target and/or attempt specific actions.

ID: T1418.001
Sub-technique of:  T1418
Tactic Type: Post-Adversary Device Access
Tactic: Discovery
Platforms: Android, iOS
MTC ID: APP-12
Version: 1.1
Created: 31 March 2022
Last Modified: 20 March 2023

Procedure Examples

ID Name Description
S1094 BRATA

BRATA can search for specifically installed security applications.[1]

S0522 Exobot

Exobot can obtain a list of installed applications and can detect if an antivirus application is running, and close it if it is.[2]

S0406 Gustuff

Gustuff checks for antivirus software contained in a predefined list.[3]

Mitigations

ID Mitigation Description
M1006 Use Recent OS Version

Android 11 introduced privacy enhancements to package visibility, filtering results that are returned from the package manager. iOS 12 removed the private API that could previously be used to list installed applications on non-app store applications.[4]

M1011 User Guidance

iOS users should be instructed to not download applications from unofficial sources, as applications distributed via the Apple App Store cannot list installed applications on a device.

Detection

ID Data Source Data Component Detects
DS0041 Application Vetting API Calls

Application vetting services could look for the Android permission android.permission.QUERY_ALL_PACKAGES, and apply extra scrutiny to applications that request it. On iOS, application vetting services could look for usage of the private API LSApplicationWorkspace and apply extra scrutiny to applications that employ it.

References