T1430.001: Remote Device Management Services
An adversary may use access to cloud services (e.g. Google's Android Device Manager or Apple iCloud's Find my iPhone) or to an enterprise mobility management (EMM)/mobile device management (MDM) server console to track the location of mobile devices managed by the service.[1]
Security context for executives and security teams
Remote Device Management Services covers misuse of cloud device-location services or EMM/MDM consoles to track Android or iOS devices. The business issue is not just mobile privacy: if these services are weakly governed, an account or console access problem can become real-time visibility into employee or executive movement, field operations, or sensitive site visits.
Executive priority
Leaders should treat this as an identity, mobile governance, and privacy/compliance control question. Key decisions are whether access to device-location capabilities is explicitly approved, logged, periodically reviewed, and limited to legitimate operational needs. For organizations with mobile workforces, executives, regulated data, or physical safety concerns, this behavior can affect incident response decisions, audit evidence, and cyber-physical risk management.
Technical view
For SOC, IR, IAM, and mobile security teams, validate how Android, iOS, cloud location services, and EMM/MDM consoles expose location-tracking actions. ATT&CK provides no official detection text for this sub-technique, but the related DET0702 detection strategy indicates that detection should focus on Remote Device Management Services activity. Teams should confirm whether administrative console actions, cloud account activity, device-location requests, and EMM/MDM policy or audit logs are retained and attributable to a user, device, and time.
Likely telemetry
- EMM/MDM administrator audit logs
- Cloud account authentication and session logs for device-location services
- Location request or device tracking events where available
- Mobile device enrollment and management status records
- Administrative role assignment and policy change logs
Detection direction
- Validate that location-tracking actions in EMM/MDM or cloud services generate auditable events with actor, target device, timestamp, and source context.
- Tune review logic around unusual or unauthorized use of location features, especially by accounts or roles that do not normally perform mobile administration.
- Correlate location-service use with authentication events and recent administrative role changes to distinguish legitimate support activity from suspicious access.
- Expect blind spots where consumer cloud services or mobile ecosystem services are outside enterprise logging, or where MDM audit retention is limited.
- Account for false positives from approved support, lost-device recovery, or enterprise policy workflows by requiring documented business justification and change/request context.
Mitigation priorities
- Use enterprise policy to define who may access device-location functions, under what conditions, and with what approval or documentation.
- Use EMM/MDM controls to provision and enforce mobile device behavior where supported by the managed platform.
- Provide user guidance on risky behaviors and configuration choices related to mobile device management and cloud location services.
- Review administrative access to EMM/MDM and cloud device-management consoles regularly, with emphasis on least privilege and accountability.
- Ensure incident response playbooks include steps to preserve mobile management and cloud account logs when unauthorized tracking is suspected.
Additional notes and limits
This sub-technique is a mobile ATT&CK behavior for Android and iOS and is a sub-technique of Location Tracking. It is also the replacement target for the revoked T1468 Remotely Track Device Without Authorization. The supplied relationships identify User Guidance and Enterprise Policy as mitigations and DET0702 as a related detection strategy, but no official ATT&CK detection narrative is provided.
The supplied ATT&CK object does not specify tactics and does not provide official detection details. This take therefore avoids claiming specific detection coverage, exploitation, attribution, or impact. Local architecture, EMM/MDM product logging, cloud account configuration, and mobile enrollment scope are required to assess actual exposure and coverage.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Remote Device Management Services
An adversary may use access to cloud services (e.g. Google's Android Device Manager or Apple iCloud's Find my iPhone) or to an enterprise mobility management (EMM)/mobile device management (MDM) server console to track the location of mobile devices managed by the service.[1]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Related techniques
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Mobile | T1430 | Location Tracking | This object subtechnique of Location Tracking. |
| Mobile | T1468 | Remotely Track Device Without Authorization | Remotely Track Device Without Authorization revoked by this object. |
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.1 | Current bundle | b2ac7c5aacb8… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]Krebs-Location
Brian Krebs. (2018, May 17). Tracking Firm LocationSmart Leaked Location Data for Customers of All Major U.S. Mobile Carriers Without Consent in Real Time Via Its Web Site. Retrieved November 8, 2018.
Open source URL - [2]Krebs-Location
Brian Krebs. (2018, May 17). Tracking Firm LocationSmart Leaked Location Data for Customers of All Major U.S. Mobile Carriers Without Consent in Real Time Via Its Web Site. Retrieved November 8, 2018.
Open source URL - [3]NIST Mobile Threat CatalogueECO-5Open source URL
- [4]NIST Mobile Threat CatalogueECO-5Open source URL
- [5]NIST Mobile Threat CatalogueEMM-7Open source URL
- [6]NIST Mobile Threat CatalogueEMM-7Open source URL
- [7]mitre-attackT1430.001Open source URL
- [8]mitre-attackT1430.001Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.