Skip to content

T1408 Disguise Root/Jailbreak Indicators

An adversary could use knowledge of the techniques used by security software to evade detection12. For example, some mobile security products perform compromised device detection by searching for particular artifacts such as an installed “su” binary, but that check could be evaded by naming the binary something else. Similarly, polymorphic code techniques could be used to evade signature-based detection3.

Item Value
ID T1408
Tactics TA0030
Platforms Android, iOS
Version 1.1
Created 25 October 2017
Last Modified 03 February 2019


ID Mitigation Description
M1001 Security Updates -


Back to top