aol.pm

Device Administrator Permissions

Subtechnique · ATTACK:mobile:T1626.001

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:mobile:T1626.001",
  "title": "Device Administrator Permissions",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1626/001",
  "snapshot": "mobile-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--9c049d7b-c92a-4733-9381-27e2bd2ccadc",
  "external_id": "T1626.001",
  "domain": "mobile",
  "created": "2022-04-01T15:59:05.830Z",
  "modified": "2026-05-12T15:12:00.706Z",
  "version": "1.1",
  "aliases": [

  ],
  "tactics": [
    "privilege-escalation"
  ],
  "source_references": [
    {
      "source_name": "NIST Mobile Threat Catalogue",
      "url": "https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-22.html",
      "external_id": "APP-22"
    }
  ]
}

Explicit source assertions (12)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:mobile:M1006 → mitigates → ATTACK:mobile:T1626.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--289f5e23-088a-4840-a2a6-bab30da2a64b

GoogleIO2016

ATTACK:mobile:S1082 → uses → ATTACK:mobile:T1626.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3c90dc4c-8156-49ae-8144-76526268a6c1

lookout_hornbill_sunbird_0221

ATTACK:mobile:S0539 → uses → ATTACK:mobile:T1626.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--56551987-326a-46ad-a34a-59bb7ab793a9

Sophos Red Alert 2.0

ATTACK:mobile:S0536 → uses → ATTACK:mobile:T1626.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--794c3cb4-1a1f-4d7e-969f-c97dfcd006c7

Talos GPlayed

ATTACK:mobile:T1626.001 → subtechnique-of → ATTACK:mobile:T1626

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--aa40d01f-0741-4bf2-bacd-75e1f3a77af0

ATTACK:mobile:M1011 → mitigates → ATTACK:mobile:T1626.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b98fa6ef-a5f2-4867-8108-8daf8534cc3c

ATTACK:mobile:S9004 → uses → ATTACK:mobile:T1626.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d1a78380-2464-4906-8709-237ff3306225

ThreatFabric_Crocodilus_March2025

ATTACK:mobile:S1061 → uses → ATTACK:mobile:T1626.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d64c4924-76f0-4b2e-858d-b0df733334d0

lookout_abstractemu_1021

ATTACK:mobile:S0522 → uses → ATTACK:mobile:T1626.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d9aab2e1-31e0-45b2-a40b-0cbe60677b4b

Threat Fabric Exobot

ATTACK:mobile:S0318 → uses → ATTACK:mobile:T1626.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--eb27258f-6bb9-49b5-928e-b66f37f8f16e

TrendMicro-XLoader

ATTACK:mobile:S1077 → uses → ATTACK:mobile:T1626.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f6417788-0c6e-4172-9010-f20870ec2278

lookout_hornbill_sunbird_0221

ATTACK:mobile:S0540 → uses → ATTACK:mobile:T1626.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f92fe9dd-7296-42f6-904e-e245c438376e

Securelist Asacub

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.