MITRE ATT&CKtechnique

T1629 Impair Defenses

Published 2022-04-01 Modified 2025-10-24 Official page ↗
Domain
mobile
Tactics
Defense Evasion
Platforms
Android
Version
1.1
Created
2022-04-01

Description

Adversaries may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms. This not only involves impairing preventative defenses, such as anti-virus, but also detection capabilities that defenders can use to audit activity and identify malicious behavior. This may span both native defenses as well as supplemental capabilities installed by users or mobile endpoint administrators.

Related

Tactic · MITRE ATT&CK (1)

  • TA0030 Defense Evasion tactic

Referenced by MITRE ATT&CK · mitigates (5)

  • M1001 Security Updates mitigation
  • M1011 User Guidance mitigation
  • M1004 System Partition Integrity mitigation
  • M1010 Deploy Compromised Device Detection Method mitigation
  • M1012 Enterprise Policy mitigation

Referenced by MITRE ATT&CK · subtechnique of (3)

  • T1629.001 Prevent Application Removal sub-technique
  • T1629.002 Device Lockout sub-technique
  • T1629.003 Disable or Modify Tools sub-technique

Referenced by MITRE ATT&CK · uses (2)

  • S1231 GodFather software (malware)
  • S1225 CherryBlos software (malware)

References