Gold Open Source
ExplorePackagesVulnerabilitiesCWEsMCP ServersScan
Login
Gold Open Source

The authoritative source for production-ready open-source components. Every package, container image, AI model, and MCP server undergoes rigorous verification for security, malware, and license compliance.

Explore Gold

  • Explore Everything
  • Packages
  • Gold Certified Packages
  • Container Images
  • AI Models
  • MCP Servers
  • Agent Skills
  • Chip Manufacturers

Security Data & Tools

  • Scan Your Dependencies
  • Trending Threats
  • Threat RSS Feeds
  • CVE Database
  • Actively Exploited (KEV)
  • SGZ Zero-Days
  • CWE Index
  • MITRE ATT&CK
  • Malicious Packages
  • Security Glossary
  • Supply-Chain Report
  • Developers (API & Badge)
  • Chrome Extension
  • Credits & Data Sources

Products

  • The Platform
  • ESSCM
  • Portal
  • TPRM
  • OSM
  • Cowork
  • Code / Runner
  • Guard

Use Cases

  • Know Your Software
  • Auto-Fix Vulnerabilities
  • Asset Discovery
  • AI Governance
  • MCP Server Security
  • Supply Chain Compliance
  • Zero-Day Discovery
  • All Use Cases

Company

  • About
  • Pricing
  • Blog
  • Documentation
  • Safeguard Academy
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 Gold Open Source. All rights reserved.

Built with care bySafeguard
Home/ATT&CK/T1418
MITRE ATT&CK Technique

T1418: Software Discovery

ShareXLinkedInRedditHN

Adversaries may attempt to get a listing of applications that are installed on a device. Adversaries may use the information from [Software Discovery](https://attack.mitre.org/techniques/T1418) during automated discovery to shape follow-on behaviors, including whether or not to fully infect the target and/or attempts specific actions. Adversaries may attempt to enumerate applications for a variety of reasons, such as figuring out what security measures are present or to identify the presence of target applications.

Tactics
Discovery
Platforms
Android, iOS

▪Sub-techniques (1)

T1418.001Security Software Discovery

▪Mitigations (2)

M1011User Guidance

Describes any guidance or training given to users to set particular configuration settings or avoid specific potentially risky behaviors.

M1006Use Recent OS Version

New mobile operating system versions bring not only patches against discovered vulnerabilities but also often bring security architecture improvements that provide resilience against potential vulnerabilities or weaknesses that have not yet been discovered. They may also bring improvements that block use of observed adversary techniques.

▪Software using this technique (50)

S0311YiSpectermalwareS0316Pegasus for AndroidmalwareS0328Stealth MangomalwareS0399PallasmalwareS0403RiltokmalwareS0405ExodusmalwareS0407MonoklemalwareS0408FlexiSpytoolS0411RotexymalwareS0418ViceLeakermalwareS0421GolfSpymalwareS0422AnubismalwareS0423GinpmalwareS0424TriadamalwareS0427TrickMomalwareS0440Agent SmithmalwareS0463INSOMNIAmalwareS0478EventBotmalwareS0479DEFENSOR IDmalwareS0480CerberusmalwareS0485MandrakemalwareS0489WolfRATmalwareS0505Desert ScorpionmalwareS0509FakeSpymalwareS0525Android/AdDisplay.AshasmalwareS0529CarbonStealmalwareS0535Golden CupmalwareS0536GPlayedmalwareS0539Red Alert 2.0malwareS0544HenBoxmalwareS0545TERRACOTTAmalwareS0550DoubleAgentmalwareS0551GoldenEaglemalwareS0558Tiktok PromalwareS1061AbstractEmumalwareS1062S.O.V.A.malwareS1069TangleBotmalwareS1077HornbillmalwareS1079BOULDSPYmalwareS1082SunbirdmalwareS1083ChameleonmalwareS1185LightSpymalwareS1215Binary ValidatormalwareS1216TriangleDBmalwareS1225CherryBlosmalwareS1231GodFathermalwareS1241RatMiladmalwareS9004CrocodilusmalwareS9005DocSwapmalwareS9006VajraSpymalware

▪Reference

T1418on MITRE ATT&CK

MITRE ATT&CK® is a registered trademark of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.