IMSI vs IMEI: How Attackers Harvest Your Phone's Identifiers and How to Detect, Harden, and Defend Against Cellular Tracking

Your phone broadcasts two identifiers that most users — and frankly, most security teams — never think about: the IMSI (International Mobile Subscriber Identity) and the IMEI (International Mobile Equipment Identity). A recent explainer from BleepingComputer has put renewed attention on a problem that red teams and nation-state operators have exploited for decades: these identifiers are the foundation of cellular surveillance, and the defensive controls most organizations have in place barely acknowledge they exist.

Here's why this matters right now. IMSI catchers (Stingrays, dirt boxes, rogue base stations — pick your preferred term) remain commercially available, deployable from a backpack or vehicle, and are in active use by law enforcement, intelligence services, and criminal groups alike. The 5G transition was supposed to fix IMSI exposure with encrypted subscriber identifiers (SUCI), but implementation gaps, forced downgrades to 4G/LTE, and legacy SS7 interconnect mean the identifier leakage problem is alive and well in 2026. Meanwhile, mobile networks sit outside the telemetry perimeter of nearly every SOC I've assessed — no EDR coverage, no network monitoring, no detection content at all.

This post breaks down what IMSI and IMEI actually are, how attackers and adversaries obtain them, and — most importantly — what defenders can realistically do to detect, harden, and reduce exposure for high-risk users and fleets.

Technical Analysis

IMSI vs IMEI: The Distinction That Matters

IMSI is a subscriber identifier. It's a 15-digit value burned into the SIM/eSIM that identifies the account to the mobile network: Mobile Country Code (MCC) + Mobile Network Code (MNC) + subscriber ID. Every time a device attaches to a network — during paging, handover, or initial registration — the IMSI (or its derivatives) is involved in the signaling exchange. Whoever holds your IMSI can correlate your identity to your location through the network, or through a rogue base station, directly.

IMEI is a device identifier. It identifies the hardware — the handset itself — independent of what SIM is inserted. Networks use it for device blacklisting (stolen phone blocking via the Equipment Identity Register), and it's typically transmitted to the network on request. Swapping SIMs changes your IMSI but not your IMEI, which is precisely why adversaries tracking a person rather than an account care about it.

The operational consequence: rotating SIMs (and thus IMSIs) blunts subscriber-level tracking, but if the IMEI stays constant, a persistent adversary can re-correlate the 'new' identity to the same physical device. Conversely, the guidance in the source reporting about rotating IMSIs is valid against IMSI-based tracking chains but incomplete against IMEI-aware adversaries. Defenders advising executives, journalists, or other high-risk users need to understand both halves of this.

How Attackers Obtain These Identifiers

1. IMSI catchers / rogue base stations. A fake cell tower broadcasting stronger signal than legitimate towers forces nearby phones to attach. On 2G, the IMSI is requested in cleartext — this is the classic attack. On 4G/5G, attackers use downgrade attacks (jamming higher bands or exploiting bidding-down in the attach procedure) to force the device into a mode where identifier exposure occurs. This requires no network access, no malware, and no user interaction — just RF proximity.

2. SS7 and Diameter signaling abuse. The global SS7 interconnect (and its 4G successor, Diameter) allows carriers to query each other for subscriber location and identity. Threat actors with access to a cooperative or compromised carrier — or who lease access through gray-market signaling providers — can resolve an IMSI from a phone number and track location remotely, with no physical proximity required. This is a nation-state and commercial-surveillance TTP that remains unmitigated at the protocol level in most of the world.

3. Malware and OS-level access. On a compromised Android device, apps with READ_PHONE_STATE or privileged access can read the IMEI directly (Android restricted IMEI access for third-party apps starting with Android 10, but privileged malware and pre-installed carrier/OEM components can still reach it). Forensic toolkits and stalkerware routinely harvest both identifiers.

4. Passive RF collection. Wi-Fi and cellular probing, combined with leaked carrier databases and breach dumps mapping phone numbers to IMSIs, lets adversaries build correlation databases without touching the target device at all.

Exploitation Status

This is not a theoretical or newly disclosed vulnerability — there is no CVE here, and no patch is coming, because this is architectural exposure inherent to cellular protocols. IMSI catchers are confirmed in active use globally by state and non-state actors. SS7-based location tracking has been documented in real espionage campaigns and remains exploitable in 2026 because SS7 interconnect cannot be retired without breaking global roaming. The 5G SUCI mechanism (which encrypts the subscriber identifier with the home network's public key) materially reduces over-the-air IMSI exposure — but only when devices stay on 5G standalone and networks enforce it, neither of which is reliably true today.

Why Your SOC Sees Nothing

Cellular attach events, paging, and base-station negotiation happen entirely in the baseband — below the OS, below EDR, below every agent you've deployed. Your endpoint stack is blind to an IMSI catcher by design. Detection therefore has to happen at different layers: RF monitoring, MDM/UEM telemetry (SIM and device changes), and behavioral analytics on the assets and accounts an adversary would target after obtaining identifiers.

Detection & Response

Because the identifier harvest itself is invisible to endpoint tooling, practical detection content focuses on the observable downstream and adjacent behaviors: SIM/eSIM changes on managed devices, unauthorized access to modem/baseband interfaces from the host OS, and processes interacting with cellular hardware. The following content is designed to be genuinely useful rather than noisy — deploy it against high-risk user populations first (executives, legal, journalists, traveling staff) before broad rollout.

Sigma Rules

The following rules target host-side interaction with cellular modems — a technique used by stalkerware, forensic extraction tools, and some malware to read IMEI/IMSI via AT commands or Mobile Broadband Interface Model (MBIM) interfaces on Windows.

---
title: AT Command Interaction With Cellular Modem via Serial or COM Port
id: 3f8a2c71-9b4d-4e12-a765-2c1d4e5f6a7b
status: experimental
description: Detects processes opening serial/COM ports and issuing AT commands commonly used to query IMEI (AT+CGSN), IMSI (AT+CIMI), or SIM identity (AT+CCID) from an attached cellular modem. Associated with forensic extraction tools and stalkerware.
references:
  - https://www.bleepingcomputer.com/news/security/imsi-vs-imei-what-your-phone-broadcasts-and-who-can-read-it/
  - https://attack.mitre.org/techniques/T1420/
author: Security Arsenal
date: 2026/06/15
tags:
  - attack.collection
  - attack.t1005
logsource:
  category: process_creation
  product: windows
detection:
  selection_cmd:
    CommandLine|contains:
      - 'AT+CGSN'
      - 'AT+CIMI'
      - 'AT+CCID'
      - 'AT+CSQ'
      - 'AT+CREG'
  selection_port:
    CommandLine|contains:
      - 'COM'
      - '\\.\'
  condition: selection_cmd or (selection_port and 1 of selection_cmd)
falsepositives:
  - Legitimate field engineering and modem diagnostics by telecom staff
  - IoT/telemetry applications managing cellular gateways
level: high
---
title: Suspect Process Querying Mobile Broadband or SIM Information
id: 8d2e4b19-7c5f-4a31-b982-6e3d5f7a8b9c
status: experimental
description: Detects non-standard processes using PowerShell or WMI to enumerate mobile broadband interfaces, SIM info, or device identifiers - behavior consistent with reconnaissance of cellular-attached systems.
references:
  - https://attack.mitre.org/techniques/T1082/
author: Security Arsenal
date: 2026/06/15
tags:
  - attack.discovery
  - attack.t1082
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wmic.exe'
  selection_cmd:
    CommandLine|contains:
      - 'Win32_POTSModem'
      - 'MSFT_NetAdapter'
      - 'Get-NetAdapter'
      - 'Cellular'
      - 'MBIM'
      - 'IMEI'
      - 'IMSI'
  condition: all of selection_*
falsepositives:
  - MDM/UEM inventory agents collecting hardware identifiers
  - IT asset inventory scripts
level: medium
---
title: Execution of Known Mobile Forensic or SIM Tooling Binaries
id: 5c7f3d28-1a9e-4b64-c873-9f2e6a8b0c1d
status: experimental
description: Detects execution of binaries associated with SIM reading, phone forensic extraction, or IMSI/IMEI harvesting tooling on endpoints.
references:
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/06/15
tags:
  - attack.execution
  - attack.collection
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\simreader.exe'
      - '\simedit.exe'
      - '\pySIM-prog.exe'
      - '\simtrace2.exe'
  selection_cli:
    CommandLine|contains:
      - '--read-iccid'
      - '--read-imsi'
      - 'simtrace'
  condition: 1 of selection_*
falsepositives:
  - Telecom lab environments and eSIM provisioning testing
level: high

KQL — Microsoft Sentinel / Defender

This query hunts across Defender process telemetry for the modem/SIM reconnaissance behaviors above, and separately pulls SIM or device-identifier change signals if you ingest Intune/MDM data into Sentinel. Deploy the first as an analytics rule scoped to high-risk device groups; run the second as a scheduled hunt if you ingest MDM inventory.

// Hunt 1: Processes interacting with cellular modem or querying SIM/device identifiers
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where ProcessCommandLine has_any (
    "AT+CGSN", "AT+CIMI", "AT+CCID",   // IMEI / IMSI / ICCID AT commands
    "Win32_POTSModem", "MBIM", "Get-NetAdapter")
   or ProcessCommandLine has_all ("Cellular", "IMEI")
   or ProcessCommandLine has_all ("Cellular", "IMSI")
| project TimeGenerated, DeviceName, AccountName, FileName,
          ProcessCommandLine, InitiatingProcessFileName, SHA256
| order by TimeGenerated desc
;

// Hunt 2: SIM changes on managed devices (requires Intune/MDM inventory ingestion)
// Detect IMSI/ICCID rotation events - legitimate for travel eSIMs, suspicious when
// clustered, unexpected, or on devices belonging to tracked-person risk groups.
DeviceInfo
| where TimeGenerated > ago(30d)
| join kind=inner (
    DeviceProcessEvents
    | where TimeGenerated > ago(30d)
    | where ProcessCommandLine has_any ("esim", "lpa", "iccid")
  ) on DeviceId
| summarize SimRelatedEvents = count(),
            Commands = make_set(ProcessCommandLine, 20)
  by DeviceName, bin(TimeGenerated, 1d)
| where SimRelatedEvents > 5
| order by SimRelatedEvents desc

Velociraptor VQL

For DFIR triage of a device suspected to have been subject to stalkerware or forensic extraction targeting cellular identifiers, this artifact enumerates processes with modem-related command lines and lists serial/COM device handles via process inspection.

-- Hunt for processes querying cellular modem identifiers or SIM data
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(AT\+(CGSN|CIMI|CCID|CREG)|IMEI|IMSI|ICCID|MBIM|POTSModem|simtrace|esim)'
   OR Exe =~ '(?i)(simreader|simedit|simtrace|forensic)'
ORDER BY CreateTime DESC

-- Enumerate installed mobile broadband adapters and modems for forensic scoping
SELECT Name, DeviceID, Description, Manufacturer, Status
FROM wmi(query='SELECT Name, DeviceID, Description, Manufacturer, Status FROM Win32_POTSModem',
         namespace='ROOT/CIMV2')

Remediation / Verification Script

There is no patch for protocol-level identifier exposure, so this script focuses on what you can control from the endpoint: auditing cellular interfaces on managed Windows laptops, confirming MDM enrollment state for SIM-change telemetry, and disabling unused mobile broadband adapters to shrink the attack surface on devices that shouldn't have cellular at all.

#Requires -RunAsAdministrator
# Security Arsenal - Cellular Attack Surface Audit & Hardening
# Run on managed endpoints; logs results for SIEM ingestion

$LogPath = "$env:ProgramData\SecurityArsenal\cellular-audit-$(Get-Date -Format 'yyyyMMdd-HHmm').log"
New-Item -ItemType Directory -Path (Split-Path $LogPath) -Force | Out-Null

function Write-Audit($msg) {
    $line = "$(Get-Date -Format o) $msg"
    Add-Content -Path $LogPath -Value $line
    Write-Output $line
}

# 1. Enumerate cellular / mobile broadband adapters
Write-Audit '=== Cellular adapter inventory ==='
$cellAdapters = Get-NetAdapter | Where-Object {
    $_.InterfaceDescription -match '(?i)(mobile broadband|wwan|cellular|lte|5g|qualcomm.*mbim|fibocom|quectel|sierra)'
}
if ($cellAdapters) {
    $cellAdapters | ForEach-Object {
        Write-Audit ("FOUND: {0} | {1} | Status={2}" -f $_.Name, $_.InterfaceDescription, $_.Status)
    }
} else {
    Write-Audit 'No cellular adapters detected.'
}

# 2. Disable cellular adapters on devices policy-flagged as non-cellular
#    Set $DisableCellular = $true only for device groups where WWAN is unauthorized
$DisableCellular = $false
if ($DisableCellular -and $cellAdapters) {
    foreach ($a in $cellAdapters) {
        Write-Audit ("DISABLING: {0}" -f $a.Name)
        Disable-NetAdapter -Name $a.Name -Confirm:$false
    }
}

# 3. Enumerate modems registered with the OS
Write-Audit '=== Registered modems (Win32_POTSModem) ==='
Get-CimInstance -ClassName Win32_POTSModem -ErrorAction SilentlyContinue | ForEach-Object {
    Write-Audit ("MODEM: {0} | AttachedTo={1} | Status={2}" -f $_.Description, $_.AttachedTo, $_.Status)
}

# 4. Audit serial/COM ports for unexpected modem exposure
Write-Audit '=== Serial port inventory ==='
Get-CimInstance -ClassName Win32_SerialPort -ErrorAction SilentlyContinue | ForEach-Object {
    Write-Audit ("COM: {0} | {1}" -f $_.DeviceID, $_.Description)
}

# 5. Verify MDM enrollment (required for SIM-change telemetry)
Write-Audit '=== MDM enrollment state ==='
$enrollment = Get-CimInstance -Namespace 'Root\CIMV2\mdm\dmmap' -ClassName MDM_Enrollment -ErrorAction SilentlyContinue
if ($enrollment) {
    Write-Audit 'Device is MDM-enrolled - SIM/ICCID inventory telemetry available.'
} else {
    Write-Audit 'WARNING: Device not MDM-enrolled. No SIM-change visibility. Enroll before issuing to high-risk users.'
}

# 6. Check for suspicious recent installs of modem/SIM tooling
Write-Audit '=== Recent suspect process check (last 24h event scan) ==='
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=(Get-Date).AddDays(-1)} -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match '(?i)(AT\+CGSN|AT\+CIMI|simtrace|simreader)' } |
    ForEach-Object { Write-Audit ("ALERT-CANDIDATE: {0}" -f $_.Message.Substring(0, [Math]::Min(300, $_.Message.Length))) }

Write-Audit '=== Audit complete ==='

Remediation

Since this is architectural exposure rather than a patchable CVE, remediation is layered risk reduction:

For individuals and high-risk users (executives, journalists, legal, HR during disputes):

1. Prefer 5G standalone where available. 5G SA uses SUCI, which encrypts the subscriber identifier over the air. Non-standalone (NSA) 5G still anchors on 4G LTE control plane and inherits its exposure. Verify with your carrier whether your plan and device actually use SA.
2. Use eSIMs with rotation for travel. Rotating IMSIs blunts subscriber-level tracking chains, as the source reporting notes — but understand the IMEI caveat: a persistent adversary correlating on device identity defeats SIM rotation alone. For genuinely high-threat users, device rotation matters too.
3. Disable 2G where the OS allows it. Android 12+ exposes a toggle to disable 2G (Settings > SIMs > Allow 2G: off), which kills the cleartext-IMSI catcher path. iOS does not expose this control; Lockdown Mode reduces but does not eliminate cellular exposure.
4. Treat unexpected signal degradation as a signal. Repeated drops to 2G/3G, loss of encryption indicators, or sudden network re-registrations in a fixed location are consistent with downgrade attacks. High-risk users should log and report these.
5. Minimize phone-number exposure. SS7 tracking chains start from the phone number. Use secondary numbers, VoIP identities, or platform-specific contact handles for public-facing roles.

For organizations:

1. Deploy RF monitoring at sensitive sites. IMSI catcher detection requires RF-layer tooling — spectrum analysis or dedicated rogue base-station detection (e.g., cellular intrusion detection at facilities). This is the only control that directly observes the attack.
2. Get cellular devices under MDM/UEM. You cannot detect SIM swaps, ICCID changes, or unexpected eSIM provisioning on devices you don't manage. Enroll everything with a corporate number, and alert on identifier changes outside travel windows.
3. Shrink the endpoint attack surface. Laptops with WWAN modules that don't need cellular should have the adapter disabled or the module omitted at procurement. Run the audit script above against your fleet.
4. Protect the downstream target. Assume identifier-based location tracking of key personnel is achievable by a motivated adversary. That means physical security awareness, travel OPSEC policies, and — critically — hardening the accounts that a phone number anchors (carrier account takeover, SIM-swap fraud) with carrier-level port/SIM-swap locks and non-SMS MFA everywhere.
5. Update your threat model documentation. If your risk register doesn't include cellular-layer tracking for at-risk roles, it's incomplete. Add it, assign an owner, and test it during your next purple team engagement.

What you cannot fix: SS7 interconnect exposure and IMEI persistence are carrier- and protocol-level problems. No endpoint control mitigates them. Honest risk communication to leadership — that some exposure is structural and must be managed behaviorally — is itself a deliverable.

Related Resources

Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub