DET0600 Detection of Software Discovery

Item	Value
ID	DET0600
Version	1.0
Created	21 October 2025
Last Modified	21 October 2025

Technique Detected: T1418 (Software Discovery)

Analytics

Android

AN1646

Application vetting services could look for the Android permission android.permission.QUERY_ALL_PACKAGES, and apply extra scrutiny to applications that request it. On iOS, application vetting services could look for usage of the private API LSApplicationWorkspace and apply extra scrutiny to applications that employ it.

Log Sources

Data Component	Name	Channel
API Calls (DC0112)	Application Vetting	None

Mutable Elements

Field	Description

iOS

AN1647

Application vetting services could look for the Android permission android.permission.QUERY_ALL_PACKAGES, and apply extra scrutiny to applications that request it. On iOS, application vetting services could look for usage of the private API LSApplicationWorkspace and apply extra scrutiny to applications that employ it.

Log Sources

Data Component	Name	Channel
API Calls (DC0112)	Application Vetting	None

Mutable Elements

Field	Description