Skip to content

M1010 Deploy Compromised Device Detection Method

A variety of methods exist that can be used to enable enterprises to identify compromised (e.g. rooted/jailbroken) devices, whether using security mechanisms built directly into the device, third-party mobile security applications, enterprise mobility management (EMM)/mobile device management (MDM) capabilities, or other methods. Some methods may be trivial to evade while others may be more sophisticated.

Item Value
ID M1010
Version 1.0
Created 25 October 2017
Last Modified 17 October 2018
Navigation Layer View In ATT&CK® Navigator

Techniques Addressed by Mitigation

Domain ID Name Use
mobile T1605 Command-Line Interface Mobile security products can often detect jailbroken or rooted devices.
mobile T1446 Device Lockout -
mobile T1617 Hooking Mobile security products can often detect rooted devices.
mobile T1579 Keychain Mobile security products can potentially detect jailbroken devices and take responsive action.
mobile T1618 User Evasion Mobile security products that are part of the Samsung Knox for Mobile Threat Defense program could examine running applications while the device is idle, potentially detecting malicious applications that are running primarily when the device is not being used.
Back to top