Skip to content

System Network Configuration Discovery

Technique · ATTACK:mobile:T1422

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:mobile:T1422",
  "title": "System Network Configuration Discovery",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1422",
  "snapshot": "mobile-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--d4536441-1bcc-49fa-80ae-a596ed3f7ffd",
  "external_id": "T1422",
  "domain": "mobile",
  "created": "2017-10-25T14:48:32.740Z",
  "modified": "2026-05-12T15:12:00.717Z",
  "version": "2.4",
  "aliases": [

  ],
  "tactics": [
    "discovery"
  ],
  "source_references": [
    {
      "source_name": "NetworkInterface",
      "url": "https://developer.android.com/reference/java/net/NetworkInterface.html"
    },
    {
      "source_name": "TelephonyManager",
      "url": "https://developer.android.com/reference/android/telephony/TelephonyManager.html"
    }
  ]
}

Explicit source assertions (51)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:mobile:S0509 → uses → ATTACK:mobile:T1422

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--020a1aaa-a444-4f3c-a08b-f1369be276f2

Cybereason FakeSpy

ATTACK:mobile:S1082 → uses → ATTACK:mobile:T1422

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0c417238-738d-4bda-8359-d37d39414ebe

lookout_hornbill_sunbird_0221

ATTACK:mobile:S0403 → uses → ATTACK:mobile:T1422

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1250f91c-723d-4b4c-afea-b3a71101951f

Kaspersky Riltok June 2019

ATTACK:mobile:S1077 → uses → ATTACK:mobile:T1422

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1329a866-0f6b-4660-b537-a6d208352502

lookout_hornbill_sunbird_0221

ATTACK:mobile:S0427 → uses → ATTACK:mobile:T1422

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--15eccf44-e528-41fb-9cb8-834c8c0ca9d9

SecurityIntelligence TrickMo

ATTACK:mobile:S1061 → uses → ATTACK:mobile:T1422

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1c67b72f-7389-4c21-9347-2b1bba07aaaf

lookout_abstractemu_1021

ATTACK:mobile:S0489 → uses → ATTACK:mobile:T1422

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--20376a7f-897a-4f5d-a87a-93e64200a5a6

ATTACK:mobile:S0311 → uses → ATTACK:mobile:T1422

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--25de6cf6-38d5-4d1e-b3f1-6956a0ff0ac3

paloalto_yispecter_1015

ATTACK:mobile:G1028 → uses → ATTACK:mobile:T1422

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2ca6ff09-827d-4e2e-a60d-daa30f113b57

checkpoint_hamas_android_malware

ATTACK:mobile:S0313 → uses → ATTACK:mobile:T1422

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3c291ee5-1782-4e5b-8131-5188c7388f45

ATTACK:mobile:S0490 → uses → ATTACK:mobile:T1422

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3f81a680-3151-4608-b83f-550756632013

TrendMicro-XLoader-FakeSpy

ATTACK:mobile:S0329 → uses → ATTACK:mobile:T1422

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--433ba5b0-76eb-49e1-a2ed-e54994e94041

Lookout-StealthMango

ATTACK:mobile:S9005 → uses → ATTACK:mobile:T1422

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4a4a6166-57de-43c1-a0af-5416b561a9d8

EnkiWhiteHat_KimsukyDOCSWAP_Dec2025

ATTACK:mobile:S0478 → uses → ATTACK:mobile:T1422

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--529107fd-6420-4573-8dbf-cdcd49c2708c

Cybereason EventBot

ATTACK:mobile:C0054 → uses → ATTACK:mobile:T1422

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--54da16fe-c3af-4283-8e73-434beca633d4

SecureList OpTriangulation 21Jun2023

ATTACK:mobile:M1006 → mitigates → ATTACK:mobile:T1422

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--554ec347-c8b2-43da-876b-36608dcc543d

TelephonyManager

ATTACK:mobile:S1079 → uses → ATTACK:mobile:T1422

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--56c8af86-2924-46f8-a1d7-8309ee6f0282

lookout_bouldspy_0423

ATTACK:mobile:S0536 → uses → ATTACK:mobile:T1422

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--58c0fe4b-612d-4fc6-973f-16914b0f4b72

ATTACK:mobile:S0535 → uses → ATTACK:mobile:T1422

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5977289e-d38f-4974-912b-2151fc00c850

Symantec GoldenCup

ATTACK:mobile:S0577 → uses → ATTACK:mobile:T1422

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5c1e3aa9-160d-49fd-83a2-2ed2f8c5435c

Lookout FrozenCell

ATTACK:mobile:S0463 → uses → ATTACK:mobile:T1422

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--61550ef4-41f0-4354-af5c-f47db8aca654

Google Project Zero Insomnia

ATTACK:mobile:S0315 → uses → ATTACK:mobile:T1422

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--71490fdb-e271-4a67-b932-5288924b1dae

PaloAlto-DualToy

ATTACK:mobile:S0540 → uses → ATTACK:mobile:T1422

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--759a2e09-32b6-4857-9b6d-adf5dcee142b

Securelist Asacub

ATTACK:mobile:S0291 → uses → ATTACK:mobile:T1422

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--789cb76e-27b0-4762-a2f7-3ff32ce0762d

Lookout-EnterpriseApps

ATTACK:mobile:S0405 → uses → ATTACK:mobile:T1422

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--789dd0f9-527c-49b3-93b7-851ce4961f0f

SWB Exodus March 2019

ATTACK:mobile:S1185 → uses → ATTACK:mobile:T1422

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7c67e8eb-4967-4858-8bfe-bb68c3f30cfd

LinkedIn Dmitry LightSpy 2025

ATTACK:mobile:T1422.002 → subtechnique-of → ATTACK:mobile:T1422

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8578441b-00d2-4416-a011-380647e6ccdd

ATTACK:mobile:S0432 → uses → ATTACK:mobile:T1422

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--86e3c37c-1e4a-450c-850b-c80be8156fe3

ATTACK:mobile:S0529 → uses → ATTACK:mobile:T1422

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8870c211-820a-46a1-96fc-02f4e6eaec03

Lookout Uyghur Campaign

ATTACK:mobile:S0310 → uses → ATTACK:mobile:T1422

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--919a13bc-74be-4660-af63-454abee92635

TrendMicro-Anserver2

ATTACK:mobile:S0407 → uses → ATTACK:mobile:T1422

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9373912a-affa-4a3c-ad97-1b8311e228ee

Lookout-Monokle

ATTACK:mobile:S0406 → uses → ATTACK:mobile:T1422

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--95bf4e8b-f388-48a0-b236-c2077252e71e

Talos Gustuff Apr 2019

ATTACK:mobile:S1231 → uses → ATTACK:mobile:T1422

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9f617f18-5b84-4fcd-a7e3-0e0d67a86192

MerkleScience_Godfather_April2023

ATTACK:mobile:S0425 → uses → ATTACK:mobile:T1422

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a3a8b2f2-f1aa-49ba-be55-a674f371f209

TrendMicro Coronavirus Updates

ATTACK:mobile:S0328 → uses → ATTACK:mobile:T1422

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a7336f2c-8f89-4d54-ac2b-77743afb2943

Lookout-StealthMango

ATTACK:mobile:T1422.001 → subtechnique-of → ATTACK:mobile:T1422

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--aeb2d1a0-2180-4032-a395-7573dbd392f4

ATTACK:mobile:S0506 → uses → ATTACK:mobile:T1422

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b6726136-3c20-4921-a0cb-75a66f59107c

Lookout ViperRAT

ATTACK:mobile:S0522 → uses → ATTACK:mobile:T1422

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c368c932-7d5a-40e3-a18b-f30e82b9e4e6

Threat Fabric Exobot

ATTACK:mobile:S0292 → uses → ATTACK:mobile:T1422

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c6770405-985b-4e24-8b09-01bce16426da

forcepoint_bitter

ATTACK:mobile:S0326 → uses → ATTACK:mobile:T1422

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c9b3d86a-9c5e-4fe3-9c1c-dbd0bb89a74b

Wandera-RedDrop

ATTACK:mobile:S0411 → uses → ATTACK:mobile:T1422

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ca4eb452-4a2f-41d7-a015-81f43e96737e

securelist rotexy 2018

ATTACK:mobile:S1215 → uses → ATTACK:mobile:T1422

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d2304825-cd71-4d74-ab9c-0f4ad510cad3

SecureList OpTriangulation 23Oct2023

ATTACK:mobile:S0545 → uses → ATTACK:mobile:T1422

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d53a8ff0-7252-477e-8767-fd485dd62e7c

WhiteOps TERRACOTTA

ATTACK:mobile:S1214 → uses → ATTACK:mobile:T1422

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d8001cd5-3e71-44af-ae85-26f5f56e5cb8

McAfee MoqHao 2019

ATTACK:mobile:S0316 → uses → ATTACK:mobile:T1422

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--db3fc82d-d353-438d-aa5e-9b5e7e60f0ac

Lookout-PegasusAndroid

ATTACK:mobile:S1216 → uses → ATTACK:mobile:T1422

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ec6ec329-a758-4259-a5f8-789cfef78a53

SecureList OpTriangulation 21Jun2023

ATTACK:mobile:S1056 → uses → ATTACK:mobile:T1422

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--eee008fa-a46f-4542-93e3-8fe5f949130f

trendmicro_tianyspy_0122

ATTACK:mobile:S1241 → uses → ATTACK:mobile:T1422

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f54196e6-3efd-4562-ae86-37bb79ec49f6

ZimperiumGupta_RatMilad_Oct2022

ATTACK:mobile:S0324 → uses → ATTACK:mobile:T1422

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f6a451e8-2125-4bbe-be52-e682523cd169

PaloAlto-SpyDealer

ATTACK:mobile:S0318 → uses → ATTACK:mobile:T1422

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f7039142-dbdc-4ffc-a54f-136ad57a6ac1

TrendMicro-XLoader-FakeSpy

ATTACK:mobile:S1093 → uses → ATTACK:mobile:T1422

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f8151852-5a56-4c91-a691-1e50387a291d

Trend Micro FlyTrap

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.