Skip to content

Prevent Application Removal

Subtechnique · ATTACK:mobile:T1629.001

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:mobile:T1629.001",
  "title": "Prevent Application Removal",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1629/001",
  "snapshot": "mobile-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--dc01774a-d1c1-45fb-b506-0a5d1d6593d9",
  "external_id": "T1629.001",
  "domain": "mobile",
  "created": "2022-04-01T18:44:32.808Z",
  "modified": "2026-05-12T15:12:00.721Z",
  "version": "1.2",
  "aliases": [

  ],
  "tactics": [
    "defense-evasion"
  ],
  "source_references": [
    {
      "source_name": "NIST Mobile Threat Catalogue",
      "url": "https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-22.html",
      "external_id": "APP-22"
    }
  ]
}

Explicit source assertions (13)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:mobile:M1006 → mitigates → ATTACK:mobile:T1629.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--26b1025b-5c08-4b6e-8c50-7d2baf29e7b7

ATTACK:mobile:S0286 → uses → ATTACK:mobile:T1629.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--51757971-17ac-40c3-bae7-78365579db49

TrendMicro-Obad

ATTACK:mobile:S1231 → uses → ATTACK:mobile:T1629.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6f96e9f0-1054-40f5-a8f9-3f926624752d

MerkleScience_Godfather_April2023

ATTACK:mobile:S1083 → uses → ATTACK:mobile:T1629.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--81722aad-f503-4a74-91d5-1843adf8a995

cyble_chameleon_0423 · ThreatFabric_Chameleon_Dec2023

ATTACK:mobile:S0485 → uses → ATTACK:mobile:T1629.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9fa03a70-ad00-4148-ae5e-8315f3e618d2

Bitdefender Mandrake

ATTACK:mobile:S0406 → uses → ATTACK:mobile:T1629.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b6feb018-65e3-46ff-b872-e4385b6f3b34

ATTACK:mobile:M1011 → mitigates → ATTACK:mobile:T1629.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bba8b056-acbe-4fed-b890-965a446d7a3c

ATTACK:mobile:S0422 → uses → ATTACK:mobile:T1629.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cb5465c0-a577-45b1-becf-305e0bd47497

ATTACK:mobile:T1629.001 → subtechnique-of → ATTACK:mobile:T1629

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cb80178a-5f9c-41bd-95a2-a7c5fe23c12c

ATTACK:mobile:S1062 → uses → ATTACK:mobile:T1629.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d3e52467-d090-4ebd-b9b1-3022cc6d5df0

threatfabric_sova_0921

ATTACK:mobile:S9004 → uses → ATTACK:mobile:T1629.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ebebb43d-aeec-4436-9d6f-c11fc8de82f3

ThreatFabric_Crocodilus_March2025

ATTACK:mobile:S1067 → uses → ATTACK:mobile:T1629.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ee095f20-eef5-4dcc-a537-70b387592c2c

bitdefender_flubot_0524

ATTACK:mobile:M1012 → mitigates → ATTACK:mobile:T1629.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fb62afa9-d593-44f8-840d-bd5c595a1228

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.