MITRE ATT&CKtechnique

T1630 Indicator Removal on Host

Published 2022-03-30 Modified 2025-10-24 Official page ↗
Domain
mobile
Tactics
Defense Evasion
Platforms
iOS, Android
Version
1.1
Created
2022-03-30

Description

Adversaries may delete, alter, or hide generated artifacts on a device, including files, jailbreak status, or the malicious application itself. These actions may interfere with event collection, reporting, or other notifications used to detect intrusion activity. This may compromise the integrity of mobile security solutions by causing notable events or information to go unreported.

Related

Tactic · MITRE ATT&CK (1)

  • TA0030 Defense Evasion tactic

Referenced by MITRE ATT&CK · mitigates (3)

  • M1001 Security Updates mitigation
  • M1002 Attestation mitigation
  • M1011 User Guidance mitigation

Referenced by MITRE ATT&CK · subtechnique of (3)

  • T1630.003 Disguise Root/Jailbreak Indicators sub-technique
  • T1630.001 Uninstall Malicious Application sub-technique
  • T1630.002 File Deletion sub-technique

Referenced by MITRE ATT&CK · uses (3)

  • S1231 GodFather software (malware)
  • C0054 Operation Triangulation campaign
  • S1083 Chameleon software (malware)

References