aol.pm

File Deletion

Subtechnique · ATTACK:mobile:T1630.002

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:mobile:T1630.002",
  "title": "File Deletion",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1630/002",
  "snapshot": "mobile-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--ab7400b7-3476-4776-9545-ef3fa373de63",
  "external_id": "T1630.002",
  "domain": "mobile",
  "created": "2022-03-30T19:36:09.691Z",
  "modified": "2026-05-12T15:12:00.707Z",
  "version": "1.1",
  "aliases": [

  ],
  "tactics": [
    "defense-evasion"
  ],
  "source_references": [
    {
      "source_name": "Android DevicePolicyManager 2019",
      "url": "https://developer.android.com/reference/android/app/admin/DevicePolicyManager.html"
    }
  ]
}

Explicit source assertions (22)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:mobile:M1011 → mitigates → ATTACK:mobile:T1630.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--079911c5-0db9-4eb2-ab85-6ed6e118fbbc

ATTACK:mobile:C0054 → uses → ATTACK:mobile:T1630.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1508c120-06fa-4da2-8fcd-7fdc133228fa

SecureList OpTriangulation 21Jun2023

ATTACK:mobile:S1077 → uses → ATTACK:mobile:T1630.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--198b99e6-3954-4c93-90bc-4227b45270a4

lookout_hornbill_sunbird_0221

ATTACK:mobile:S1216 → uses → ATTACK:mobile:T1630.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--26c2626b-92a0-4798-b9f3-00abf12a817b

SecureList OpTriangulation 21Jun2023

ATTACK:mobile:S0489 → uses → ATTACK:mobile:T1630.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2c5b36b4-5381-4d9e-9ce5-cd7cd19041b1

Talos-WolfRAT

ATTACK:mobile:S0407 → uses → ATTACK:mobile:T1630.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3f2daf2e-c28c-46cd-bf91-ae35e873f365

Lookout-Monokle

ATTACK:mobile:S0550 → uses → ATTACK:mobile:T1630.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--57a069a0-399f-43ab-9efc-50432a41b26b

Lookout Uyghur Campaign

ATTACK:mobile:T1630.002 → subtechnique-of → ATTACK:mobile:T1630

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5b235ed4-548d-49f2-ae01-1874666e6747

ATTACK:mobile:S0399 → uses → ATTACK:mobile:T1630.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--60ecd154-e907-419a-b41d-1a9a1f59e7c3

Lookout Dark Caracal Jan 2018

ATTACK:mobile:S0549 → uses → ATTACK:mobile:T1630.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--80778a1e-715d-477b-87fa-e92181b31659

Lookout Uyghur Campaign

ATTACK:mobile:S0440 → uses → ATTACK:mobile:T1630.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8634a732-1c5e-4931-a24f-cdcc2f81c788

CheckPoint Agent Smith

ATTACK:mobile:S0505 → uses → ATTACK:mobile:T1630.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8c9dbc53-27d2-420c-b698-98c23a7ead2b

Lookout Desert Scorpion

ATTACK:mobile:S0536 → uses → ATTACK:mobile:T1630.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8f52e1ab-284e-4d0c-bae1-3a8544a22f57

Talos GPlayed

ATTACK:mobile:S1080 → uses → ATTACK:mobile:T1630.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b81f9698-b9d1-4a6a-b836-f7e29232693a

kaspersky_fakecalls_0422

ATTACK:mobile:S0418 → uses → ATTACK:mobile:T1630.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bc79d59b-1828-4133-9f8f-df8cad9543a8

SecureList - ViceLeaker 2019

ATTACK:mobile:S9005 → uses → ATTACK:mobile:T1630.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c4d4bb09-4732-40fb-82f5-7e38390abebe

EnkiWhiteHat_KimsukyDOCSWAP_Dec2025 · S2W_DocSwap_Mar2025

ATTACK:mobile:S0408 → uses → ATTACK:mobile:T1630.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d7d78682-c9ad-4880-ae6e-3fc79f3737f1

CyberMerchants-FlexiSpy

ATTACK:mobile:S0558 → uses → ATTACK:mobile:T1630.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--de4ecfa3-fa91-4377-810c-5c567de9688b

Zscaler TikTok Spyware

ATTACK:mobile:S1215 → uses → ATTACK:mobile:T1630.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e3beb58a-2603-451e-a907-1a3823a90197

SecureList OpTriangulation 23Oct2023

ATTACK:mobile:S0485 → uses → ATTACK:mobile:T1630.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ece70dca-803c-4209-8792-7e56e9901288

Bitdefender Mandrake

ATTACK:mobile:S0421 → uses → ATTACK:mobile:T1630.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f4aeacef-035c-4308-9e85-997703e27809

Trend Micro Bouncing Golf 2019

ATTACK:mobile:S0529 → uses → ATTACK:mobile:T1630.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f6f21954-c592-40d8-b7a0-75f332c42eaa

Lookout Uyghur Campaign

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.