{"source_checked_on":"2026-10-19","schema_version":1,"key":"mobile/T1640","id":"T1640","name":"Account Access Removal","domain":"mobile","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1640","source_file":{"file":"mobile.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/mobile-attack/mobile-attack-20.0.json","sha256":"824f7d8a37e7893b29e4c6ca6d87b5fbbf3b228ec6384f1a69ee20d523ff59e5","bytes":6095145},"source_object_sha256":"8709a25ad9c746dd533697506c1727df6fdd9c17c8eb8d68c88e3f8a48e9ecce","description":"Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: credentials changed) to remove access to accounts. ","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1640","external_id":"T1640"}],"platforms":["Android"],"environments":["mobile"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0112","name":"API Calls","page":"telemetry/DC0112/","kind":"attack_component","category":"Mobile lab instrumentation","description":"Instrumented mobile API calls and results relevant to an application behavior.","collection_focus":"Instrument selected APIs in the owned test app or approved research build; log caller, API, sanitized argument class and return status.","providers":[{"name":"Android logcat","scope":"Permitted logs from a consented test device/emulator; output depends on build, permissions and instrumentation.","source_id":"android_logs"},{"name":"Android dumpsys","scope":"Point-in-time service/package state on an authorized development device.","source_id":"android_state"},{"name":"Instrumented test application","scope":"Own-app permission, API and state callbacks; not universal visibility into other apps.","source_id":"android_permissions"}],"configuration":["Use a disposable emulator or owned development device with approved debugging. Record OS/API level, app version and instrumentation privileges.","Collect only relevant logcat buffers/tags and service snapshots; add explicit own-app instrumentation for events absent from OS logs.","Forward sanitized logs and compare before/after state. Remove test data and revoke debugging access after the lab session."],"configuration_example":null,"required_fields":["package","api","result","thread"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0112","collector":"illustrative-lab-collector","observation":{"package":"test.example.lab","api":"android.hardware.camera2.CameraManager.openCamera","result":"permission_denied","thread":"main"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Android tooling does not imply iOS coverage. Standard mobile apps cannot observe all other apps or protected OS internals; MDM status is not full API, filesystem or content telemetry.","sources":[{"id":"android_logs","title":"Android logcat and access limits","url":"https://developer.android.com/tools/logcat"},{"id":"android_state","title":"Android dumpsys","url":"https://developer.android.com/tools/dumpsys"},{"id":"android_permissions","title":"Android runtime permission requests","url":"https://developer.android.com/training/permissions/requesting"}],"association":"attack_component","anomaly_design":"Per owned device, app version and permission state: unexpected API/permission changes, background activity and network destinations. OS privacy restrictions and emulator differences limit observability."},{"id":"DC0114","name":"Application Permission","page":"telemetry/DC0114/","kind":"attack_component","category":"Mobile lab instrumentation","description":"Declared or granted permissions of a mobile application.","collection_focus":"Compare manifest declarations with runtime granted state using authorized package inspection and own-app permission checks.","providers":[{"name":"Android logcat","scope":"Permitted logs from a consented test device/emulator; output depends on build, permissions and instrumentation.","source_id":"android_logs"},{"name":"Android dumpsys","scope":"Point-in-time service/package state on an authorized development device.","source_id":"android_state"},{"name":"Instrumented test application","scope":"Own-app permission, API and state callbacks; not universal visibility into other apps.","source_id":"android_permissions"}],"configuration":["Use a disposable emulator or owned development device with approved debugging. Record OS/API level, app version and instrumentation privileges.","Collect only relevant logcat buffers/tags and service snapshots; add explicit own-app instrumentation for events absent from OS logs.","Forward sanitized logs and compare before/after state. Remove test data and revoke debugging access after the lab session."],"configuration_example":{"label":"Inspect the owned Android lab application","language":"shell","source_id":"android_state","content":"adb shell dumpsys package test.example.lab","note":"Read-only snapshot on a consented debug device. Replace the example package with your owned test app. Output and access vary by Android build; this is not a permission-request event stream."},"required_fields":["package","permission","declared","granted"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0114","collector":"illustrative-lab-collector","observation":{"package":"test.example.lab","permission":"android.permission.CAMERA","declared":true,"granted":false}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Android tooling does not imply iOS coverage. Standard mobile apps cannot observe all other apps or protected OS internals; MDM status is not full API, filesystem or content telemetry.","sources":[{"id":"android_logs","title":"Android logcat and access limits","url":"https://developer.android.com/tools/logcat"},{"id":"android_state","title":"Android dumpsys","url":"https://developer.android.com/tools/dumpsys"},{"id":"android_permissions","title":"Android runtime permission requests","url":"https://developer.android.com/training/permissions/requesting"}],"association":"attack_component","anomaly_design":"Per owned device, app version and permission state: unexpected API/permission changes, background activity and network destinations. OS privacy restrictions and emulator differences limit observability."},{"id":"DC0018","name":"Host Status","page":"telemetry/DC0018/","kind":"attack_component","category":"Host state and inventory","description":"Host health and availability observations such as heartbeat, shutdown or degraded state.","collection_focus":"Collect agent heartbeat and OS health independently; record missed polls, last-seen time and monitor health.","providers":[{"name":"osquery","scope":"Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.","source_id":"osquery"},{"name":"Linux Audit plus inventory snapshots","scope":"Events explain changes; snapshots describe state at collection time.","source_id":"linux"}],"configuration":["Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.","Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.","Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset."],"configuration_example":null,"required_fields":["asset_id","status","heartbeat_age_seconds","collector_healthy"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0018","collector":"illustrative-lab-collector","observation":{"asset_id":"lab-host-1","status":"degraded","heartbeat_age_seconds":90,"collector_healthy":true}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.","sources":[{"id":"osquery","title":"osquery scheduled configuration","url":"https://github.com/osquery/osquery/blob/master/docs/wiki/deployment/configuration.md"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Compare authorized state snapshots: first-seen drivers/services/modules, unexpected configuration drift and integrity changes. Record collection cadence; absence in a sample is not evidence of deletion."}],"detection":{"key":"mobile/T1640","id":"T1640","name":"Account Access Removal","domain":"mobile","platforms":["Android"],"environments":["mobile"],"source_url":"https://attack.mitre.org/techniques/T1640","technique_page":"techniques/mobile/T1640/","page":"detections/mobile/T1640/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0605","name":"Detection of Account Access Removal","url":"https://attack.mitre.org/detectionstrategies/DET0605","stix_id":"x-mitre-detection-strategy--78eb87ae-c606-41cc-b133-b02eb35fb54d","relationship_id":"relationship--f62351c6-0dff-45b1-a711-1b40b96639a2","description":"","analytics":[{"id":"AN1655","name":"Analytic 1655","guidance":"For Android, detect Account Access Removal by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: DevicePolicyManager.resetPassword() or lockNow() or wipeData() called by caller NOT IN $MDMAgentPackageList$]; Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; Host Status via Android Enterprise DPC [DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.","url":"https://attack.mitre.org/detectionstrategies/DET0605#AN1655","platforms":["Android"],"tuning":[{"field":"MDMAgentPackageList","description":"MDM agent and approved Device Admin packages. Derive from MDM platform."},{"field":"LockoutWindow","description":"Default 300s between Device Admin API call and device check-in failure."}],"log_sources":[{"component_id":"DC0112","component":"API Calls","name":"mobile:DynamicAnalysis","channel":"Dynamic API/runtime trace: DevicePolicyManager.resetPassword() or lockNow() or wipeData() called by caller NOT IN $MDMAgentPackageList$","platforms":["Android"],"analytic_id":"AN1655","source_url":"https://attack.mitre.org/detectionstrategies/DET0605#AN1655","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0112/"},{"component_id":"DC0114","component":"Application Permission","name":"android:DevicePolicyManager","channel":"DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review","platforms":["Android"],"analytic_id":"AN1655","source_url":"https://attack.mitre.org/detectionstrategies/DET0605#AN1655","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0114/"},{"component_id":"DC0018","component":"Host Status","name":"android:DevicePolicyManager","channel":"DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported","platforms":["Android"],"analytic_id":"AN1655","source_url":"https://attack.mitre.org/detectionstrategies/DET0605#AN1655","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0018/"}]}]}],"telemetry_references":[{"id":"DC0112","name":"API Calls","tag":"API Calls","page":"telemetry/DC0112/","kind":"attack_component"},{"id":"DC0114","name":"Application Permission","tag":"Application Permission","page":"telemetry/DC0114/","kind":"attack_component"},{"id":"DC0018","name":"Host Status","tag":"Host Status","page":"telemetry/DC0018/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S0407","name":"Monokle","url":"https://attack.mitre.org/software/S0407","kind":"malware","description":"[Monokle](https://attack.mitre.org/software/S0407) can reset the user's password/PIN.(Citation: Lookout-Monokle)","relationship_id":"relationship--545d9313-3fcc-4d4a-b9d2-7555430df8f2","references":[{"source_name":"Lookout-Monokle","description":"Bauer A., Kumar A., Hebeisen C., et al. (2019, July). Monokle: The Mobile Surveillance Tooling of the Special Technology Center. Retrieved September 4, 2019.","url":"https://www.lookout.com/documents/threat-reports/lookout-discovers-monokle-threat-report.pdf"}]}],"actors":[],"mitigations":[{"id":"M1011","name":"User Guidance","url":"https://attack.mitre.org/mitigations/M1011","kind":"course-of-action","description":"Users should be taught that Device Administrator permissions are very dangerous, and very few applications need it.","relationship_id":"relationship--7657a4d4-1ba3-4b66-83f7-6db5eab14847","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use owned test devices or emulators, disposable app accounts and test data. Verify platform/version instrumentation; desktop test procedures do not establish mobile coverage.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1640":"/ttp-simulation/techniques/mobile/T1640/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"mobile/T1640","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0112","collector":"illustrative-lab-collector","observation":{"package":"test.example.lab","api":"android.hardware.camera2.CameraManager.openCamera","result":"permission_denied","thread":"main"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0114","collector":"illustrative-lab-collector","observation":{"package":"test.example.lab","permission":"android.permission.CAMERA","declared":true,"granted":false}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0018","collector":"illustrative-lab-collector","observation":{"asset_id":"lab-host-1","status":"degraded","heartbeat_age_seconds":90,"collector_healthy":true}}]}}