System Network Connections Discovery

Senses

Sense 1

Adversaries may attempt to get a listing of network connections to or from the compromised device they are currently accessing or from remote systems by querying for information over the network. This is typically accomplished by utilizing device APIs to collect information about nearby networks, such as Wi Fi, Bluetooth, and cellular tower connections. On Android, this can be done by querying the respective APIs: for information about the current Wi Fi connection, as well as nearby Wi Fi networks. Querying the API requires the application to hold the permission. for information about Bluetooth devices, which also requires the application to hold several permissions granted by the user at runtime. For Android versions prior to Q, applications can use the method. For Q and later, applications can use the method. Both methods require the application hold the permission.

Adversaries may attempt to get a listing of network connections to or from the compromised device they are currently accessing or from remote systems by querying for information over the network.

This is typically accomplished by utilizing device APIs to collect information about nearby networks, such as Wi-Fi, Bluetooth, and cellular tower connections. On Android, this can be done by querying the respective APIs:

WifiInfo for information about the current Wi-Fi connection, as well as nearby Wi-Fi networks. Querying the WiFiInfo API requires the application to hold the ACCESS_FINE_LOCATION permission.
BluetoothAdapter for information about Bluetooth devices, which also requires the application to hold several permissions granted by the user at runtime.
For Android versions prior to Q, applications can use the TelephonyManager.getNeighboringCellInfo() method. For Q and later, applications can use the TelephonyManager.getAllCellInfo() method. Both methods require the application hold the ACCESS_FINE_LOCATION permission.

MITRE ATT&CK (Mobile, CTI STIX Data)

Bibliography

MITRE ATT&CK (Mobile, CTI STIX Data)
Accessed Jan 06, 2026Quoted
MITRE ATT&CK CTI (STIX bundle)
https://raw.githubusercontent.com/mitre-attack/attack-stix-data/master/mobile-attack/mobile-attack.json
See repository LICENSE.txt for ATT&CK terms: non-exclusive royalty-free license; reproduce MITRE copyright + license in copies. Verify requirements before publishing quoted text.
Source: MITRE ATT&CK (attack-stix-data).