Adversaries may delete, alter, or hide generated artifacts on a device, including files, jailbreak status, or the malicious application itself. These actions may interfere with event collection, reporting, or other notifications used to detect intrusion activity. This may compromise the integrity of mobile security solutions by causing notable events or information to go unreported.
| ID | Name | Description |
|---|---|---|
| S1083 | Chameleon |
Chameleon has removed artifacts of its presence and has the ability to uninstall itself.[1] |
| S1231 | GodFather |
GodFather has requested for the |
| C0054 | Operation Triangulation |
During Operation Triangulation, the threat actors deleted the initial exploitation message and exploit attachment.[3] |
| ID | Mitigation | Description |
|---|---|---|
| M1002 | Attestation |
Attestation can detect unauthorized modifications to devices. Mobile security software can then use this information and take appropriate mitigation action. |
| M1001 | Security Updates |
Security updates typically provide patches for vulnerabilities that could be abused by malicious applications. |
| M1011 | User Guidance |
Inform users that device rooting or granting unnecessary access to the accessibility service presents security risks that could be taken advantage of without their knowledge. |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0651 | Detection of Indicator Removal on Host | AN1733 |
Mobile security products can detect which applications can request device administrator permissions. Application vetting services could look for use of APIs that could indicate the application is trying to hide activity. |
| AN1734 |
Mobile security products can detect which applications can request device administrator permissions. Application vetting services could look for use of APIs that could indicate the application is trying to hide activity. |