# T1629.003 Disable or Modify Tools

> As of 2026-11-04, T1629.003 (Disable or Modify Tools) appears in 10 tracked threats, first reported 2026-07-11 and most recently 2026-11-02; it most often appears alongside T1418 (Software Discovery).

- **Tracked threats:** 10 (10 high)
- **First seen:** 2026-07-11
- **Last seen:** 2026-11-02
- **Detection rules:** 26 (counts only; unlock with TL Creds)

## Key facts

- **ID:** T1629.003
- **Framework:** MITRE ATT&CK
- **Tactics:** Defense Evasion (Mobile)
- **Matrix:** Mobile
- **Parent:** T1629
- **Data as of:** 2026-11-04
- **MITRE:** https://attack.mitre.org/techniques/T1629/003/

## Activity timeline

T1629.003 first appeared in tracked threats on 2026-07-11 and was most recently reported on 2026-11-02. The busiest month was 2026-10 with 5 reports, and 10 of the 10 threats were reported in the twelve months to 2026-11.

## How adversaries use it

T1629.003 Disable or Modify Tools is catalogued by MITRE ATT&CK under the Defense Evasion (Mobile) tactic in the Mobile matrix, as a sub-technique of [T1629 Impair Defenses](https://intel.threadlinqs.com/technique/T1629). Threadlinqs maps 10 of 3581 tracked threats (0.3%) to it; by severity that is 10 high.

Threats that use T1629.003 most often also use [T1418 Software Discovery](https://intel.threadlinqs.com/technique/T1418) (9 threats), [T1655.001 Match Legitimate Name or Location](https://intel.threadlinqs.com/technique/T1655.001) (8 threats), [T1513 Screen Capture](https://intel.threadlinqs.com/technique/T1513) (7 threats), [T1646 Exfiltration Over C2 Channel](https://intel.threadlinqs.com/technique/T1646) (7 threats), [T1660 Phishing](https://intel.threadlinqs.com/technique/T1660) (7 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.

## Tracked threats

10 tracked threats use T1629.003.

- [XCPE Android Set-Top Box Botnet: Videostrong Technology Firmware Supply-Chain Backdoor Disrupted by Google](https://intel.threadlinqs.com/threat/TL-2026-5057) — high — 2026-11-02
- [Hirudo Android Banking RAT Replaces Legitimate Banking Apps With Patched Copies to Bypass Security Checks](https://intel.threadlinqs.com/threat/TL-2026-4140) — high — 2026-10-22
- [Hirudo Android Banking RAT Replaces Legitimate Banking Apps via Fake In-App Updates](https://intel.threadlinqs.com/threat/TL-2026-4134) — high — 2026-10-22
- [Manic: Android Malware Blending Banking Trojan and Spyware Capabilities (Ukraine-focused)](https://intel.threadlinqs.com/threat/TL-2026-3594) — high — 2026-10-15
- [Hirudo Android Banking Trojan Replaces Indonesian Banking Apps with Patched Copies and Relays Play Integrity…](https://intel.threadlinqs.com/threat/TL-2026-3499) — high — 2026-10-14
- [Midnight Mimosa: Low-cost MediaTek Android phones ship with firmware-level ad-fraud and residential proxy…](https://intel.threadlinqs.com/threat/TL-2026-3066) — high — 2026-10-09
- [Zero-Permission Android Apps Can Chain AtlasService and olc2 to Gain Root on OnePlus/OPPO Devices via…](https://intel.threadlinqs.com/threat/TL-2026-2683) — high — 2026-09-27
- [RemControl Android Banking Trojan Targets Italy and France via Fake TVTap IPTV App](https://intel.threadlinqs.com/threat/TL-2026-2625) — high — 2026-09-23
- [Chinese-Speaking Threat Actors Deploy PanDa Android RAT Against Mexican Banking Users via Meta Ads…](https://intel.threadlinqs.com/threat/TL-2026-2279) — high — 2026-09-01
- [Rokarolla Android Banking Trojan Intercepts SMS OTPs and Enables Full Device Takeover Across 217+ Banking…](https://intel.threadlinqs.com/threat/TL-2026-1225) — high — 2026-07-11

## Detection coverage

Threadlinqs maintains 26 detection rules mapped to T1629.003 (SPL 10, KQL 10, Sigma 6). Rule content unlocks with TL Creds on a free account; this page shows counts only.

26 detection rules (SPL/KQL/Sigma), unlock with TL Creds: https://threadlinqs.com/tl-creds

## Parent technique

[T1629 Impair Defenses](https://intel.threadlinqs.com/technique/T1629) — 16 tracked threats at the technique level.

## Links

- Canonical page: https://intel.threadlinqs.com/technique/T1629.003
- All techniques: https://intel.threadlinqs.com/techniques
- Full detection coverage and IOCs unlock per threat with TL Creds (https://threadlinqs.com/tl-creds); MCP for AI agents (Purple): https://intel.threadlinqs.com/mcp