MITRE ATT&CKsub-technique

T1629.003 Disable or Modify Tools

Published 2022-04-01 Modified 2025-10-24 Official page ↗
Domain
mobile
Tactics
Defense Evasion
Platforms
Android
Version
1.1
Created
2022-04-01

Description

Adversaries may disable security tools to avoid potential detection of their tools and activities. This can take the form of disabling security software, modifying SELinux configuration, or other methods to interfere with security tools scanning or reporting information. This is typically done by abusing device administrator permissions or using system exploits to gain root access to the device to modify protected system files.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1629 Impair Defenses technique

Tactic · MITRE ATT&CK (1)

  • TA0030 Defense Evasion tactic

Referenced by MITRE ATT&CK · mitigates (4)

  • M1001 Security Updates mitigation
  • M1011 User Guidance mitigation
  • M1004 System Partition Integrity mitigation
  • M1010 Deploy Compromised Device Detection Method mitigation

Referenced by MITRE ATT&CK · uses (13)

  • S1214 Android/SpyAgent software (malware)
  • C0033 C0033 campaign
  • S1195 SpyC23 software (malware)
  • S1094 BRATA software (malware)
  • S1083 Chameleon software (malware)
  • S1067 FluBot software (malware)
  • S1061 AbstractEmu software (malware)
  • S1054 Drinik software (malware)
  • S0494 Zen software (malware)
  • S0485 Mandrake software (malware)
  • S0480 Cerberus software (malware)
  • S0422 Anubis software (malware)
  • S0420 Dvmap software (malware)