File Deletion
Subtechnique · ATTACK:mobile:T1630.002
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:mobile:T1630.002",
"title": "File Deletion",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1630/002",
"snapshot": "mobile-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--ab7400b7-3476-4776-9545-ef3fa373de63",
"external_id": "T1630.002",
"domain": "mobile",
"created": "2022-03-30T19:36:09.691Z",
"modified": "2026-05-12T15:12:00.707Z",
"version": "1.1",
"aliases": [
],
"tactics": [
"defense-evasion"
],
"source_references": [
{
"source_name": "Android DevicePolicyManager 2019",
"url": "https://developer.android.com/reference/android/app/admin/DevicePolicyManager.html"
}
]
}Explicit source assertions (22)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:mobile:M1011 → mitigates → ATTACK:mobile:T1630.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--079911c5-0db9-4eb2-ab85-6ed6e118fbbc
ATTACK:mobile:C0054 → uses → ATTACK:mobile:T1630.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1508c120-06fa-4da2-8fcd-7fdc133228fa
SecureList OpTriangulation 21Jun2023ATTACK:mobile:S1077 → uses → ATTACK:mobile:T1630.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--198b99e6-3954-4c93-90bc-4227b45270a4
lookout_hornbill_sunbird_0221ATTACK:mobile:S1216 → uses → ATTACK:mobile:T1630.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--26c2626b-92a0-4798-b9f3-00abf12a817b
SecureList OpTriangulation 21Jun2023ATTACK:mobile:S0489 → uses → ATTACK:mobile:T1630.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2c5b36b4-5381-4d9e-9ce5-cd7cd19041b1
Talos-WolfRATATTACK:mobile:S0407 → uses → ATTACK:mobile:T1630.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3f2daf2e-c28c-46cd-bf91-ae35e873f365
Lookout-MonokleATTACK:mobile:S0550 → uses → ATTACK:mobile:T1630.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--57a069a0-399f-43ab-9efc-50432a41b26b
Lookout Uyghur CampaignATTACK:mobile:T1630.002 → subtechnique-of → ATTACK:mobile:T1630
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5b235ed4-548d-49f2-ae01-1874666e6747
ATTACK:mobile:S0399 → uses → ATTACK:mobile:T1630.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--60ecd154-e907-419a-b41d-1a9a1f59e7c3
Lookout Dark Caracal Jan 2018ATTACK:mobile:S0549 → uses → ATTACK:mobile:T1630.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--80778a1e-715d-477b-87fa-e92181b31659
Lookout Uyghur CampaignATTACK:mobile:S0440 → uses → ATTACK:mobile:T1630.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8634a732-1c5e-4931-a24f-cdcc2f81c788
CheckPoint Agent SmithATTACK:mobile:S0505 → uses → ATTACK:mobile:T1630.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8c9dbc53-27d2-420c-b698-98c23a7ead2b
Lookout Desert ScorpionATTACK:mobile:S0536 → uses → ATTACK:mobile:T1630.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8f52e1ab-284e-4d0c-bae1-3a8544a22f57
Talos GPlayedATTACK:mobile:S1080 → uses → ATTACK:mobile:T1630.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b81f9698-b9d1-4a6a-b836-f7e29232693a
kaspersky_fakecalls_0422ATTACK:mobile:S0418 → uses → ATTACK:mobile:T1630.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bc79d59b-1828-4133-9f8f-df8cad9543a8
SecureList - ViceLeaker 2019ATTACK:mobile:S9005 → uses → ATTACK:mobile:T1630.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c4d4bb09-4732-40fb-82f5-7e38390abebe
EnkiWhiteHat_KimsukyDOCSWAP_Dec2025 · S2W_DocSwap_Mar2025ATTACK:mobile:S0408 → uses → ATTACK:mobile:T1630.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d7d78682-c9ad-4880-ae6e-3fc79f3737f1
CyberMerchants-FlexiSpyATTACK:mobile:S0558 → uses → ATTACK:mobile:T1630.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--de4ecfa3-fa91-4377-810c-5c567de9688b
Zscaler TikTok SpywareATTACK:mobile:S1215 → uses → ATTACK:mobile:T1630.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e3beb58a-2603-451e-a907-1a3823a90197
SecureList OpTriangulation 23Oct2023ATTACK:mobile:S0485 → uses → ATTACK:mobile:T1630.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ece70dca-803c-4209-8792-7e56e9901288
Bitdefender MandrakeATTACK:mobile:S0421 → uses → ATTACK:mobile:T1630.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f4aeacef-035c-4308-9e85-997703e27809
Trend Micro Bouncing Golf 2019ATTACK:mobile:S0529 → uses → ATTACK:mobile:T1630.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f6f21954-c592-40d8-b7a0-75f332c42eaa
Lookout Uyghur Campaign