Adversaries may include functionality in malware that uninstalls the malicious application from the device. This can be achieved by:
| ID | Name | Description |
|---|---|---|
| S0480 | Cerberus | |
| S0427 | TrickMo |
TrickMo can uninstall itself from a device on command by abusing the accessibility service.[2] |
| ID | Mitigation | Description |
|---|---|---|
| M1005 | Application Vetting |
Application vetting services could look for use of the accessibility service or features that typically require root access. |
| M1002 | Attestation |
Attestation can detect rooted devices. |
| M1001 | Security Updates |
Security updates typically provide patches for vulnerabilities that enable device rooting. |
| M1011 | User Guidance |
Inform users that device rooting or granting unnecessary access to the accessibility service presents security risks that could be taken advantage of without their knowledge. |