Indicator Removal on Host: Disguise Root/Jailbreak Indicators

ID Name
T1630.001 Uninstall Malicious Application
T1630.002 File Deletion
T1630.003 Disguise Root/Jailbreak Indicators

An adversary could use knowledge of the techniques used by security software to evade detection.[1][2] For example, some mobile security products perform compromised device detection by searching for particular artifacts such as an installed "su" binary, but that check could be evaded by naming the binary something else. Similarly, polymorphic code techniques could be used to evade signature-based detection.[3]

ID: T1630.003
Sub-technique of:  T1630
Tactic Type: Post-Adversary Device Access
Tactic: Defense Evasion
Platforms: Android, iOS
Version: 1.0
Created: 08 April 2022
Last Modified: 11 April 2022


This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.


Mobile security products can use attestation to detect compromised devices.