aol.pm

File and Directory Discovery

Technique · ATTACK:mobile:T1420

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:mobile:T1420",
  "title": "File and Directory Discovery",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1420",
  "snapshot": "mobile-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--cf28ca46-1fd3-46b4-b1f6-ec0b72361848",
  "external_id": "T1420",
  "domain": "mobile",
  "created": "2017-10-25T14:48:21.965Z",
  "modified": "2026-05-12T15:12:00.717Z",
  "version": "1.2",
  "aliases": [

  ],
  "tactics": [
    "discovery"
  ],
  "source_references": [
    {
      "source_name": "NIST Mobile Threat Catalogue",
      "url": "https://pages.nist.gov/mobile-threat-catalogue/stack-threats/STA-41.html",
      "external_id": "STA-41"
    }
  ]
}

Explicit source assertions (22)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:mobile:S0551 → uses → ATTACK:mobile:T1420

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--03038590-e0c3-4751-b6fb-8a9ffff27e1b

Lookout Uyghur Campaign

ATTACK:mobile:S0505 → uses → ATTACK:mobile:T1420

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2c9ad579-0c29-4f2a-80f3-242dc6b0bafd

Lookout Desert Scorpion

ATTACK:mobile:C0033 → uses → ATTACK:mobile:T1420

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3020bb16-fb1f-46f9-9e1c-3b3317af6b96

welivesec_strongpity

ATTACK:mobile:S9005 → uses → ATTACK:mobile:T1420

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--329b14a1-df5f-4112-b062-175ef9447728

EnkiWhiteHat_KimsukyDOCSWAP_Dec2025 · S2W_DocSwap_Mar2025

ATTACK:mobile:G0112 → uses → ATTACK:mobile:T1420

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--383e5b12-061e-45c6-911b-b37187dd9254

BlackBerry Bahamut

ATTACK:mobile:S0549 → uses → ATTACK:mobile:T1420

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4586277d-bebd-4717-87c6-a31a9be741ed

Lookout Uyghur Campaign

ATTACK:mobile:S1225 → uses → ATTACK:mobile:T1420

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--64a55364-3ad1-40e8-92a2-58a7a71a18c9

TrendMicro_CherryBlos_July2023

ATTACK:mobile:C0054 → uses → ATTACK:mobile:T1420

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--686a6bc8-d660-40ad-97bc-9c900195cd5b

SecureList OpTriangulation 21Jun2023

ATTACK:mobile:M1006 → mitigates → ATTACK:mobile:T1420

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7260c8fe-6b3b-48a2-889f-f329fb5b4ef0

ATTACK:mobile:S1095 → uses → ATTACK:mobile:T1420

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--792ae0c6-8b0c-4adf-9c7f-83ebee84bb57

welivesecurity_ahrat_0523

ATTACK:mobile:S9030 → uses → ATTACK:mobile:T1420

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8186d2f5-5040-4ba4-b144-7fea7b3e9a55

Check Point Wirte NOV 2024

ATTACK:mobile:S1077 → uses → ATTACK:mobile:T1420

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--867b4929-20f2-47cd-9ab3-43a5a6ea98b5

lookout_hornbill_sunbird_0221

ATTACK:mobile:S1216 → uses → ATTACK:mobile:T1420

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8b3756f1-327a-4625-bde0-26b216ecb07a

SecureList OpTriangulation 21Jun2023

ATTACK:mobile:S9006 → uses → ATTACK:mobile:T1420

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8e9cacb4-f265-4a4e-9f80-853c7cfa791f

ESET_VajraSpy_Feb2024

ATTACK:mobile:C0016 → uses → ATTACK:mobile:T1420

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--96ec33c8-78b6-421f-bab3-bd9d0564db31

Cylance Dust Storm

ATTACK:mobile:S0535 → uses → ATTACK:mobile:T1420

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a285f343-09c3-49af-9c18-1dccf89e9009

Symantec GoldenCup

ATTACK:mobile:S0577 → uses → ATTACK:mobile:T1420

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a9e97a14-ea3c-47b1-a865-0a1edea9c81c

Lookout FrozenCell

ATTACK:mobile:S0558 → uses → ATTACK:mobile:T1420

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b05668b9-aa06-4191-a4fa-f7e5a7804694

Zscaler TikTok Spyware

ATTACK:mobile:S0529 → uses → ATTACK:mobile:T1420

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ba8735ad-b9c6-4b35-9fac-d4747ab0b2ae

Lookout Uyghur Campaign

ATTACK:mobile:S1092 → uses → ATTACK:mobile:T1420

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--be8d0cd6-be77-456e-bcfb-6325cb8ba137

Bleeipng Computer Escobar

ATTACK:mobile:S0550 → uses → ATTACK:mobile:T1420

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d70aaf50-29b7-4687-98ea-ffaa3fa858c0

Lookout Uyghur Campaign

ATTACK:mobile:S1241 → uses → ATTACK:mobile:T1420

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fc3c2496-aef9-4924-82e7-716d5149db01

ZimperiumGupta_RatMilad_Oct2022

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.