M1010 Deploy Compromised Device Detection Method

A variety of methods exist that can be used to enable enterprises to identify compromised (e.g. rooted/jailbroken) devices, whether using security mechanisms built directly into the device, third-party mobile security applications, enterprise mobility management (EMM)/mobile device management (MDM) capabilities, or other methods. Some methods may be trivial to evade while others may be more sophisticated.

Item	Value
ID	M1010
Version	1.0
Created	25 October 2017
Last Modified	17 October 2018
Navigation Layer	View In ATT&CK® Navigator

Techniques Addressed by Mitigation

Domain	ID	Name	Use
mobile	T1623	Command and Scripting Interpreter	Mobile security products can typically detect jailbroken or rooted devices.
mobile	T1623.001	Unix Shell	Mobile security products can typically detect jailbroken or rooted devices.
mobile	T1634	Credentials from Password Store	Mobile security products can take appropriate action when jailbroken devices are detected, potentially limiting the adversary’s access to password stores.
mobile	T1634.001	Keychain	Mobile security products can take appropriate action when jailbroken devices are detected, potentially limiting the adversary’s access to password stores.
mobile	T1404	Exploitation for Privilege Escalation	Mobile security products can potentially detect jailbroken or rooted devices.
mobile	T1628	Hide Artifacts	-
mobile	T1628.002	User Evasion	Mobile security products that are part of the Samsung Knox for Mobile Threat Defense program could examine running applications while the device is idle, potentially detecting malicious applications that are running primarily when the device is not being used.
mobile	T1617	Hooking	Mobile security products can often detect rooted devices.
mobile	T1629	Impair Defenses	Mobile security software can typically detect if a device has been rooted or jailbroken and can inform the user, who can then take appropriate action.
mobile	T1629.003	Disable or Modify Tools	Mobile security software can typically detect if a device has been rooted or jailbroken and can inform the user, who can then take appropriate action.