Threadlinqs IntelligenceStart free

ATT&CK techniqueDiscovery (Mobile)

T1418 Software Discovery

Discovery (Mobile)Mobile

As of 2026-10-05, T1418 (Software Discovery) appears in 34 tracked threats, first reported 2026-02-16 and most recently 2026-09-27, with linked actors including NSO Group, Cyber Av3ngers; it most often appears alongside T1660 (Phishing).

Tracked threats
343 critical, 28 high, 2 medium
First seen
2026-02-16
Last seen
2026-09-27
Threat actors
2In the threats using it
Detection rules
30Blue tier and above

Data as of:

Activity timeline

T1418 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 10 reports, and 34 of the 34 threats were reported in the twelve months to 2026-09.

How adversaries use it

T1418 Software Discovery is catalogued by MITRE ATT&CK under the Discovery (Mobile) tactic in the Mobile matrix. Threadlinqs maps 34 of 2623 tracked threats (1.3%) to it; by severity that is 3 critical, 28 high, 2 medium.

Threats that use T1418 most often also use T1660 Phishing (29 threats), T1513 Screen Capture (23 threats), T1646 Exfiltration Over C2 Channel (21 threats), T1426 System Information Discovery (19 threats), T1437 Application Layer Protocol (19 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.

2 tracked threat actors appear in the threats that use T1418; the most frequent are NSO Group (2), Cyber Av3ngers (1).

Mitigations

MITRE ATT&CK lists 2 mitigations for T1418.

Threat actors using it

Tracked threats

The 30 most recent of 34 tracked threats that use T1418.

Detection coverage

Threadlinqs maintains 30 detection rules mapped to T1418 (SPL 8, KQL 11, Sigma 11). Rule content is available to Blue tier accounts and above; this page shows counts only.

30 detection rules (SPL/KQL/Sigma) · Blue and above. Compare plans

Sub-techniques

  • T1418.001 Security Software Discovery — 2 tracked threats