Detection of File Deletion

Technique Detected:  File Deletion | T1630.002

ID: DET0638
Domains: Mobile
Analytics: AN1712
Version: 1.0
Created: 21 October 2025
Last Modified: 21 October 2025

Analytics

AN1712

Mobile security products can detect which applications can request device administrator permissions. Application vetting services could be extra scrutinous of applications that request device administrator permissions.
The user can view applications with administrator access through the device settings, and may also notice if user data is inexplicably missing.

Log Sources
Data Component Name Channel
Permissions Requests (DC0114) Application Vetting None
System Settings (DC0118) User Interface None