Skip to content

System Network Connections Discovery

Technique · ATTACK:mobile:T1421

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:mobile:T1421",
  "title": "System Network Connections Discovery",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1421",
  "snapshot": "mobile-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--dd818ea5-adf5-41c7-93b5-f3b839a219fb",
  "external_id": "T1421",
  "domain": "mobile",
  "created": "2017-10-25T14:48:33.574Z",
  "modified": "2025-10-24T17:49:29.321Z",
  "version": "2.1",
  "aliases": [

  ],
  "tactics": [
    "discovery"
  ],
  "source_references": [

  ]
}

Explicit source assertions (10)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:mobile:C0033 → uses → ATTACK:mobile:T1421

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0891421a-8476-4d37-b274-645b90f139c7

trendmicro_strongpity

ATTACK:mobile:S0407 → uses → ATTACK:mobile:T1421

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--25cdb4f2-5b38-411c-bfb6-eca7ea4d4527

Lookout-Monokle

ATTACK:mobile:S0408 → uses → ATTACK:mobile:T1421

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4449ac76-8329-4483-b152-99b990006cbc

FlexiSpy-Features

ATTACK:mobile:S0289 → uses → ATTACK:mobile:T1421

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--450a1b75-efa5-4d7a-bcd5-d3e63723b408

Lookout-Pegasus

ATTACK:mobile:S0399 → uses → ATTACK:mobile:T1421

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5a036fb8-9f72-4383-91c5-0f47b33b2c9d

Lookout Dark Caracal Jan 2018

ATTACK:mobile:S1185 → uses → ATTACK:mobile:T1421

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a111958f-bb98-48c1-ad44-bf55fad232e9

FirshSecureList LightSpy 2020 · MelikovBlackBerry LightSpy 2024 · Shoshin_Kaspersky LightSpy 2020 · Threatfabric LightSpy 2023 · Threatfabric LightSpy 2024

ATTACK:mobile:S9040 → uses → ATTACK:mobile:T1421

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c5186dde-b30d-4471-a90e-9c834e35c40d

CERTPL_NGate_Nov2025

ATTACK:mobile:S0509 → uses → ATTACK:mobile:T1421

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c9c22e0d-c427-42ef-ae76-beb8ae9f6bf2

Cybereason FakeSpy

ATTACK:mobile:S0405 → uses → ATTACK:mobile:T1421

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cf4243f5-562a-457f-bb15-d45a2047f7ca

SWB Exodus March 2019

ATTACK:mobile:S0506 → uses → ATTACK:mobile:T1421

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d358ac0b-4c67-44e3-939b-24cd36d3c3fb

Lookout ViperRAT

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.