| ID | Name |
|---|---|
| T1630.001 | Uninstall Malicious Application |
| T1630.002 | File Deletion |
| T1630.003 | Disguise Root/Jailbreak Indicators |
An adversary could use knowledge of the techniques used by security software to evade detection.[1][2] For example, some mobile security products perform compromised device detection by searching for particular artifacts such as an installed "su" binary, but that check could be evaded by naming the binary something else. Similarly, polymorphic code techniques could be used to evade signature-based detection.[3]
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.
| ID | Data Source | Data Component | Detects |
|---|---|---|---|
| DS0013 | Sensor Health | Host Status |
Mobile security products can use attestation to detect compromised devices. |