CyberStack

MITRE ATT&CK / Techniques / T1070.008

Indicator Removal: Clear Mailbox Data

ID
T1070.008
Tactics
TA0005 Stealth
Sub-technique of
T1070 Indicator Removal
Platforms
Linux, macOS, Office Suite, Windows
Data sources
Command Execution, File Deletion, File Modification, Application Log Content, Process Creation
Source
attack.mitre.org
MITRE last modified
12 May 2026

Adversaries may modify mail and mail application data to remove evidence of their activity. Email applications allow users and other programs to export and delete mailbox data via command line tools or use of APIs. Mail application data can be emails, email metadata, or logs generated by the application or operating system, such as export requests.

Adversaries may manipulate emails and mailbox data to remove logs, artifacts, and metadata, such as evidence of Phishing/Internal Spearphishing, Email Collection, Mail Protocols for command and control, or email-based exfiltration such as Exfiltration Over Alternative Protocol. For example, to remove evidence on Exchange servers adversaries have used the ExchangePowerShell PowerShell module, including Remove-MailboxExportRequest to remove evidence of mailbox exports.[2][3] On Linux and macOS, adversaries may also delete emails through a command line utility called mail or use AppleScript to interact with APIs on macOS.[4][5]

Adversaries may also remove emails and metadata/headers indicative of spam or suspicious activity (for example, through the use of organization-wide transport rules) to reduce the likelihood of malicious emails being detected by security products.[6]

Detection

Mitigations (3)

M1022 Restrict File and Directory Permissions

Protect generated event files that are stored locally with proper permissions and authentication and limit opportunities for adversaries to increase privileges by preventing Privilege Escalation opportunities.

M1029 Remote Data Storage

Automatically forward mail data and events to a log server or data repository to prevent conditions in which the adversary can locate and manipulate data on the local system. When possible, minimize time delay on event reporting to avoid prolonged storage on the local system.

M1047 Audit

In an Exchange environment, Administrators can use Get-TransportRule / Remove-TransportRule to discover and remove potentially malicious transport rules.[1]

Groups (2)

Software (2)

References

  1. Microsoft Manage Mail Flow Rules 2023
  2. Volexity SolarWinds
  3. ExchangePowerShell Module
  4. Cybereason Cobalt Kitty 2017
  5. mailx man page
  6. Microsoft OAuth Spam 2022