Application Discovery

Adversaries may seek to identify all applications installed on the device. One use case for doing so is to identify the presence of endpoint security applications that may increase the adversary's risk of detection. Another use case is to identify the presence of applications that the adversary may wish to target.

On Android, applications can use methods in the PackageManager class [1] to enumerate other apps installed on device, or an entity with shell access can use the pm command line tool.

On iOS, apps can use private API calls to obtain a list of other apps installed on the device. [2] However, use of private API calls will likely prevent the application from being distributed through Apple's App Store.

ID: T1418
Sub-techniques:  No sub-techniques
Tactic Type: Post-Adversary Device Access
Tactics: Defense Evasion, Discovery
Platforms: Android, iOS
Version: 1.0
Created: 25 October 2017
Last Modified: 17 October 2018

Procedure Examples

Name Description
Agent Smith

Agent Smith obtains the device’s application list.[18]

Anubis

Anubis can collect a list of installed applications to compare to a list of targeted applications.[15]

Cerberus

Cerberus can obtain a list of installed applications.[22]

DEFENSOR ID

DEFENSOR ID can retrieve a list of installed applications.[21]

EventBot

EventBot can collect a list of installed applications.[20]

Exodus

Exodus Two can obtain a list of installed applications.[9]

FlexiSpy

FlexiSpy can retrieve a list of installed applications.[3]

Ginp

Ginp can obtain a list of installed applications.[16]

GolfSpy

GolfSpy can obtain a list of installed applications.[14]

Gustuff

Gustuff checks for antivirus software contained in a predefined list.[10]

INSOMNIA

INSOMNIA can obtain a list of installed non-Apple applications.[19]

Monokle

Monokle can list applications installed on the device.[11]

Pallas

Pallas retrieves a list of all applications installed on the device.[6]

Pegasus for Android

Pegasus for Android accesses the list of installed applications.[4]

Riltok

Riltok can retrieve a list of installed applications. Installed application names are then checked against an adversary-defined list of targeted applications.[8]

Rotexy

Rotexy retrieves a list of installed applications and sends it to the command and control server.[12]

Stealth Mango

Stealth Mango uploads information about installed packages.[5]

Triada

Triada is able to modify code within the com.android.systemui application to gain access to GET_REAL_TASKS permissions. This permission enables access to information about applications currently on the foreground and other recently used apps.[7]

TrickMo

TrickMo can collect a list of installed applications.[17]

ViceLeaker

ViceLeaker can obtain a list of installed applications.[13]

Mitigations

Mitigation Description
Application Vetting

Application vetting techniques could search for use of the Android PackageManager class to enumerate other apps, and such applications could have extra scrutiny applied to them. However, this technique may not be practical if many apps invoke these methods as part of their legitimate behavior. On iOS, application vetting techniques could similarly search for use of the private API call necessary to obtain a list of apps installed on the device. Additionally, on iOS, use of the private API call is likely to result in the app not being accepted into Apple's App Store.

References