Disguise Root/Jailbreak Indicators

{
  "id": "ATTACK:mobile:T1630.003",
  "title": "Disguise Root/Jailbreak Indicators",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1630/003",
  "snapshot": "mobile-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--a91262d5-b9ff-463f-b8d2-12e4ea1eb3c9",
  "external_id": "T1630.003",
  "domain": "mobile",
  "created": "2022-04-08T16:29:30.087Z",
  "modified": "2025-10-24T17:49:12.130Z",
  "version": "1.1",
  "aliases": [

  ],
  "tactics": [
    "defense-evasion"
  ],
  "source_references": [
    {
      "source_name": "Brodie",
      "url": "https://media.blackhat.com/eu-13/briefings/Brodie/bh-eu-13-lacoon-attacks-mdm-brodie-wp.pdf"
    },
    {
      "source_name": "Rastogi",
      "url": "http://pages.cs.wisc.edu/~vrastogi/static/papers/rcj13b.pdf"
    },
    {
      "source_name": "Tan",
      "url": "http://www.blackhat.com/us-16/briefings.html#bad-for-enterprise-attacking-byod-enterprise-mobile-security-solutions"
    },
    {
      "source_name": "NIST Mobile Threat Catalogue",
      "url": "https://pages.nist.gov/mobile-threat-catalogue/emm-threats/EMM-5.html",
      "external_id": "EMM-5"
    }
  ]
}