Boot or Logon Initialization Scripts
Technique · ATTACK:mobile:T1398
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:mobile:T1398",
"title": "Boot or Logon Initialization Scripts",
"type": "Technique",
"source_url": "https://attack.mitre.org/techniques/T1398",
"snapshot": "mobile-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--46d818a5-67fa-4585-a7fc-ecf15376c8d5",
"external_id": "T1398",
"domain": "mobile",
"created": "2017-10-25T14:48:31.294Z",
"modified": "2025-10-24T17:48:43.758Z",
"version": "2.1",
"aliases": [
],
"tactics": [
"persistence"
],
"source_references": [
{
"source_name": "Android-VerifiedBoot",
"url": "https://source.android.com/security/verifiedboot/"
},
{
"source_name": "NIST Mobile Threat Catalogue",
"url": "https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-26.html",
"external_id": "APP-26"
},
{
"source_name": "NIST Mobile Threat Catalogue",
"url": "https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-27.html",
"external_id": "APP-27"
}
]
}Explicit source assertions (8)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:mobile:S0285 → uses → ATTACK:mobile:T1398
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--373f33be-9b40-44f5-bfd3-db2a9f5fa72c
HackerNews-OldBootATTACK:mobile:M1001 → mitigates → ATTACK:mobile:T1398
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3c0b0763-78d2-4d6e-8e57-b4f27af7e414
ATTACK:mobile:S1095 → uses → ATTACK:mobile:T1398
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--51bd38a1-465b-49c0-9218-5984f391a51c
welivesecurity_ahrat_0523ATTACK:mobile:M1004 → mitigates → ATTACK:mobile:T1398
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--82f12052-783e-40e4-8079-d9c030c310fd
ATTACK:mobile:M1002 → mitigates → ATTACK:mobile:T1398
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--92879f0e-d1db-4407-9cc6-c1dbcc47caea
ATTACK:mobile:M1003 → mitigates → ATTACK:mobile:T1398
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ce6c7f21-91a5-4d63-bd03-a6b57e025afe
ATTACK:mobile:S1079 → uses → ATTACK:mobile:T1398
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f259b5a8-bf2f-48c9-ae1b-b20d53daf665
lookout_bouldspy_0423ATTACK:mobile:S1185 → uses → ATTACK:mobile:T1398
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fed0de7b-509f-445d-90b9-4b507214298b
Threatfabric LightSpy 2024