MITRE ATT&CKsub-technique

T1630.002 File Deletion

Published 2022-03-30 Modified 2026-05-12 Official page ↗
Domain
mobile
Tactics
Defense Evasion
Platforms
Android
Version
1.1
Created
2022-03-30

Description

Adversaries may wipe a device or delete individual files in order to manipulate external outcomes or hide activity. An application must have administrator access to fully wipe the device, while individual files may not require special permissions to delete depending on their storage location. Stored data could include a variety of file formats, such as Office files, databases, stored emails, and custom file formats. The impact file deletion will have depends on the type of data as well as the goals and objectives of the adversary, but can include deleting update files to evade detection or deleting attacker-specified files for impact.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1630 Indicator Removal on Host technique

Tactic · MITRE ATT&CK (1)

  • TA0030 Defense Evasion tactic

Referenced by MITRE ATT&CK · mitigates (1)

  • M1011 User Guidance mitigation

Referenced by MITRE ATT&CK · uses (20)

  • S9005 DocSwap software (malware)
  • C0054 Operation Triangulation campaign
  • S1215 Binary Validator software (malware)
  • S1216 TriangleDB software (malware)
  • S1080 Fakecalls software (malware)
  • S1077 Hornbill software (malware)
  • S0558 Tiktok Pro software (malware)
  • S0549 SilkBean software (malware)
  • S0550 DoubleAgent software (malware)
  • S0536 GPlayed software (malware)
  • S0529 CarbonSteal software (malware)
  • S0505 Desert Scorpion software (malware)
  • S0489 WolfRAT software (malware)
  • S0485 Mandrake software (malware)
  • S0440 Agent Smith software (malware)
  • S0421 GolfSpy software (malware)
  • S0418 ViceLeaker software (malware)
  • S0407 Monokle software (malware)
  • S0408 FlexiSpy software (tool)
  • S0399 Pallas software (malware)

References