Adversaries may disable security tools to avoid potential detection of their tools and activities. This can take the form of disabling security software, modifying SELinux configuration, or other methods to interfere with security tools scanning or reporting information. This is typically done by abusing device administrator permissions or using system exploits to gain root access to the device to modify protected system files.
Ensure that Android devices being used include and enable the Verified Boot capability, which cryptographically ensures the integrity of the system partition.
M1010Deploy Compromised Device Detection MethodA variety of methods exist that can be used to enable enterprises to identify compromised (e.g. rooted/jailbroken) devices, whether using security mechanisms built directly into the device, third-party mobile security applications, enterprise mobility management (EMM)/mobile device management (MDM) capabilities, or other methods. Some methods may be trivial to evade while others may be more sophisticated.
M1011User GuidanceDescribes any guidance or training given to users to set particular configuration settings or avoid specific potentially risky behaviors.
M1001Security UpdatesInstall security updates in response to discovered vulnerabilities. Purchase devices with a vendor and/or mobile carrier commitment to provide security updates in a prompt manner for a set period of time. Decommission devices that will no longer receive security updates. Limit or block access to enterprise resources from devices that have not installed recent security updates. On Android devices, access can be controlled based on each device's security patch level. On iOS devices, access can be controlled based on the iOS version.
MITRE ATT&CK® is a registered trademark of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.