MITRE ATT&CKmitigation

M1010 Deploy Compromised Device Detection Method

Published 2017-10-25 Modified 2025-04-25 Official page ↗
Domain
mobile
Version
1.0
Created
2017-10-25

Description

A variety of methods exist that can be used to enable enterprises to identify compromised (e.g. rooted/jailbroken) devices, whether using security mechanisms built directly into the device, third-party mobile security applications, enterprise mobility management (EMM)/mobile device management (MDM) capabilities, or other methods. Some methods may be trivial to evade while others may be more sophisticated.

Related

Mitigates · MITRE ATT&CK (9)

  • T1628.002 User Evasion sub-technique
  • T1629 Impair Defenses technique
  • T1629.003 Disable or Modify Tools sub-technique
  • T1634 Credentials from Password Store technique
  • T1634.001 Keychain sub-technique
  • T1623 Command and Scripting Interpreter technique
  • T1623.001 Unix Shell sub-technique
  • T1617 Hooking technique
  • T1404 Exploitation for Privilege Escalation technique