System Checks
Subtechnique · ATTACK:mobile:T1633.001
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:mobile:T1633.001",
"title": "System Checks",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1633/001",
"snapshot": "mobile-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--6ffad4be-bfe0-424f-abde-4d9a84a800ad",
"external_id": "T1633.001",
"domain": "mobile",
"created": "2022-03-30T17:53:35.582Z",
"modified": "2025-10-24T17:48:56.336Z",
"version": "1.1",
"aliases": [
],
"tactics": [
"defense-evasion"
],
"source_references": [
]
}Explicit source assertions (17)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:mobile:S1061 → uses → ATTACK:mobile:T1633.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--021ca5c4-7e8a-439b-8c2e-38f817db63e3
lookout_abstractemu_1021ATTACK:mobile:T1633.001 → subtechnique-of → ATTACK:mobile:T1633
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0d305e1e-df8f-4028-bf6f-1d7fed9e6184
ATTACK:mobile:S0525 → uses → ATTACK:mobile:T1633.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--10560632-6449-4579-90eb-20fc46dcca08
WeLiveSecurity AdDisplayAshasATTACK:mobile:S0301 → uses → ATTACK:mobile:T1633.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--15065492-1aef-4cf8-af3c-cc763eee5daf
Lookout-DendroidATTACK:mobile:S0485 → uses → ATTACK:mobile:T1633.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1a2f6cdc-7c52-4f6e-9182-bc5b16a638dd
Bitdefender MandrakeATTACK:mobile:S0423 → uses → ATTACK:mobile:T1633.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1cc71849-142f-4097-9546-7946b0b546a6
ThreatFabric GinpATTACK:mobile:S0544 → uses → ATTACK:mobile:T1633.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2115228b-c61a-4ebb-829a-df7355635fbf
Palo Alto HenBoxATTACK:mobile:S1083 → uses → ATTACK:mobile:T1633.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2ce1e63a-2e9b-4cac-9469-3fb78bf4640f
cyble_chameleon_0423ATTACK:mobile:S0545 → uses → ATTACK:mobile:T1633.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2e6d507e-afbb-4fa5-b459-2b060ab52db3
WhiteOps TERRACOTTAATTACK:mobile:G0112 → uses → ATTACK:mobile:T1633.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2e7f8995-93ae-41bb-9baf-53178341d93e
BlackBerry BahamutATTACK:mobile:S0480 → uses → ATTACK:mobile:T1633.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--42624ee9-1bf5-46aa-87d0-9fda0de9a06e
Threat Fabric CerberusATTACK:mobile:S0411 → uses → ATTACK:mobile:T1633.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4fc165fd-185e-4c70-b423-c242cf715510
securelist rotexy 2018ATTACK:mobile:S0509 → uses → ATTACK:mobile:T1633.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--66132260-65d1-4bf5-8200-abdb2014be6f
Cybereason FakeSpyATTACK:mobile:S0422 → uses → ATTACK:mobile:T1633.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--67db22d4-6f89-40c6-b31b-737c1e3dec3f
Trend Micro AnubisATTACK:mobile:S1094 → uses → ATTACK:mobile:T1633.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7f3f4abd-f097-4ab5-b9ae-7ffc1a2e015e
mcafee_brata_0421ATTACK:mobile:S0489 → uses → ATTACK:mobile:T1633.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8ff45341-60d6-40d3-bb38-566814a466f9
Talos-WolfRATATTACK:mobile:S0427 → uses → ATTACK:mobile:T1633.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ed3293cf-de4f-4a73-98af-24325e8187c9
SecurityIntelligence TrickMo