Skip to content

T1630.003 Disguise Root/Jailbreak Indicators

An adversary could use knowledge of the techniques used by security software to evade detection.13 For example, some mobile security products perform compromised device detection by searching for particular artifacts such as an installed “su” binary, but that check could be evaded by naming the binary something else. Similarly, polymorphic code techniques could be used to evade signature-based detection.2

Item Value
ID T1630.003
Sub-techniques T1630.001, T1630.002, T1630.003
Tactics TA0030
Platforms Android, iOS
Version 1.1
Created 08 April 2022
Last Modified 20 March 2023


ID Data Source Data Component
DS0013 Sensor Health Host Status