tfMITRE ATT&CK sub-technique

Clear Mailbox Data T1070.008

sub-technique of T1070 Indicator Removal

Tactic: Stealth
Platforms: Linux, macOS, Office Suite, Windows
Version: 2.0
Created: 08 July 2022
Last modified: 12 May 2026
Contributor: Liran Ravich, CardinalOps

Adversaries may modify mail and mail application data to remove evidence of their activity. Email applications allow users and other programs to export and delete mailbox data via command line tools or use of APIs. Mail application data can be emails, email metadata, or logs generated by the application or operating system, such as export requests.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups56th pct

Threat groups56th percentile · 56% of ATT&CK techniques have this many threat groups attributed or fewer.

Campaigns72nd pct

Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malware51st pct

Tools & malware51st percentile · 51% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules73rd pct

Detection rules73rd percentile · 73% of ATT&CK techniques have this many detection rules written or fewer.

Clear Mailbox Data MITRE reference T1070.008

56th pctamong all ATT&CK techniques for number of groups

2 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

APT42G1044 ↗

Has deleted login notification emails and has cleared the Sent folder to cover their tracks.1

created 2025-01-081 reference

Scattered SpiderG1015 ↗

Has manually deleted emails notifying users of suspicious account activity. 1

created 2023-07-051 referenceaka Roasted 0ktapus

All 2 groups for this technique

1 campaign has been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.

SolarWinds CompromiseC0024 ↗

During the SolarWinds Compromise, APT29 removed evidence of email export requests using Remove-MailboxExportRequest.1

2019–2021

All 1 campaigns for this technique

2 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

LunarMailS1142 ↗

Can set the PR_DELETE_AFTER_SUBMIT flag to delete messages sent for data exfiltration.1

created 2024-06-26MALWAREcarried by 1 group

GoopyS0477 ↗

Has the ability to delete emails used for C2 once the content has been copied.1

created 2020-06-19MALWAREcarried by 1 group

All 2 software entries for this technique

Offense vs defense T1070.008

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 1Sigma rules (cumulative) · 2Splunk ESCU (cumulative) · 7

first rule: 2023 Q3 · 1 of 1 campaigns plotted

Clear Mailbox Data detection strategy DET0266

MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Behavioral Detection of Mailbox Data and Log Deletion for Anti-Forensics

Enterprise

4 platforms

AN0737 · Windows

Detects mailbox manipulation or deletion via PowerShell (e.g., Remove-MailboxExportRequest), file deletion from Outlook data stores (Unistore.db), or tampering with quarantined mail logs.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Application Log ContentDC0038	m365:exchange	Transport Rule Modification
File DeletionDC0040	WinEventLog:Sysmon	EventCode=23
File ModificationDC0061	WinEventLog:Security	EventCode=4663, 4670, 4656
Command ExecutionDC0064	WinEventLog:PowerShell	EventCode=4103, 4104, 4105, 4106

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
MailstorePath	Outlook files in AppData\Local\Comms\Unistore\data
TransportRuleNames	Target suspicious rule changes (e.g., header removal)
PowerShellCommandMatch	Regex match on `Remove-MailboxExportRequest` and similar Exchange cmdlets

AN0738 · Linux

Detects the use of mail utilities like mail or mailx to delete mailbox content, or file-level deletion of inbox files from /var/spool/mail/ or /var/mail/ following suspicious sessions.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve
File DeletionDC0040	auditd:SYSCALL	unlink/unlinkat

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
MailFolderPath	Common inbox file locations like /var/spool/mail/, /var/mail/
CommandPattern	Usage of mailx or echo piped to mail followed by deletion

AN0739 · macOS

Detects removal of Apple Mail artifacts via AppleScript or direct deletion of mailbox content in ~/Library/Mail/, especially when preceded by Remote Login or C2-related API access.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File DeletionDC0040	macos:osquery	file_events
Command ExecutionDC0064	macos:unifiedlog	log stream

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ScriptCommandMatch	AppleScript references to Mail.app and delete commands
LibraryPathMatch	Files within ~/Library/Mail/V*/ folders

AN0740 · Office Suite

Detects Exchange Online or on-prem transport rule changes (e.g., header stripping) and mailbox export cleanup via Remove-MailboxExportRequest, as well as admin actions via Exchange PowerShell sessions.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Application Log ContentDC0038	m365:exchange	Admin Audit Logs, Transport Rules
Command ExecutionDC0064	WinEventLog:PowerShell	Exchange Cmdlets

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
CmdletFilter	Include `New-TransportRule`, `Set-TransportRule`, `Remove-*` actions
UserRoleScope	Track role assignments for admins performing deletions

AuditM1047

In an Exchange environment, Administrators can use Get-TransportRule / Remove-TransportRule to discover and remove potentially malicious transport rules.

Remote Data StorageM1029

Automatically forward mail data and events to a log server or data repository to prevent conditions in which the adversary can locate and manipulate data on the local system. When possible, minimize time delay on event reporting to avoid prolonged storage on the local system.

Restrict File and Directory PermissionsM1022

Protect generated event files that are stored locally with proper permissions and authentication and limit opportunities for adversaries to increase privileges by preventing Privilege Escalation opportunities.

Tests6Executorsbash 4 · PowerShell 2Need elevation6 of 6Have prerequisites2Have cleanup6Platformswindows, linux, macos

#	Test	Platform	Executor	Elevation	Prereqs	Cleanup
01	Copy and Delete Mailbox Data on Windows	windows	PowerShell	Required	—	Yes
Copies and deletes mail data on Windows Attack command New-Item -Path "C:\Users\$env:USERNAME\AppData\Local\Comms\Unistore\data\copy" -ItemType Directory -ErrorAction Ignore Get-ChildItem -Path "C:\Users\$env:USERNAME\AppData\Local\Comms\Unistore\data" -Exclude copy \| ForEach-Object { Copy-Item -Path $_.FullName -Destination "C:\Users\$env:USERNAME\AppData\Local\Comms\Unistore\data\copy" -Recurse -Force -ErrorAction Ignore } Remove-Item -Path "C:\Users\$env:USERNAME\AppData\Local\Comms\Unistore\data\copy" -Recurse -Force -ErrorAction Ignore Cleanup command Remove-Item -Path "C:\Users\$env:USERNAME\AppData\Local\Comms\Unistore\data\copy" -Recurse -Force -ErrorAction Ignore GUIDf66437a0-39ae-41bd-814c-9ca0464d1f7f
02	Copy and Delete Mailbox Data on Linux	linux	bash	Required	1	Yes
Copies and deletes mail data on Linux Attack command mkdir -p /var/spool/mail/copy && for file in /var/spool/mail/; do if [ "$(basename "$file")" != "copy" ]; then cp -R "$file" /var/spool/mail/copy/; fi; done && rm -rf /var/spool/mail/copy/ Cleanup command rm -rf /var/spool/mail/copy if [ -f "$(ls -A /var/spool/mail/temp)" ]; then rm /var/spool/mail/temp; fi Prerequisite Create dummy file in /var/spool/mail/ if no files exist Check if [ -z "$(ls -A /var/spool/mail/)" ]; then exit 1; else exit 0; fi Satisfy if [ -z "$(ls -A /var/spool/mail/)" ]; then touch /var/spool/mail/temp; fi GUIDfc079540-38f0-459e-b892-276552f77daa
03	Copy and Delete Mailbox Data on macOS	macos	bash	Required	—	Yes
Copies and deletes mail data on macOS Attack command mkdir ~/Library/Mail/copy cp -R ~/Library/Mail/* ~/Library/Mail/copy rm -rf ~/Library/Mail/copy/* Cleanup command rm -rf ~/Library/Mail/copy GUIDca344824-58af-4e19-baca-508443465ed4
04	Copy and Modify Mailbox Data on Windows	windows	PowerShell	Required	—	Yes
Copies and modifies mail data on Windows Attack command New-Item -Path "C:\Users\$env:USERNAME\AppData\Local\Comms\Unistore\data\copy" -ItemType Directory -ErrorAction Ignore Get-ChildItem -Path "C:\Users\$env:USERNAME\AppData\Local\Comms\Unistore\data" -Exclude copy \| ForEach-Object { Copy-Item -Path $_.FullName -Destination "C:\Users\$env:USERNAME\AppData\Local\Comms\Unistore\data\copy" -Recurse -Force -ErrorAction Ignore } Get-ChildItem -Path "C:\Users\$env:USERNAME\AppData\Local\Comms\Unistore\data\copy" -File \| ForEach-Object { Add-Content -Path $_.FullName -Value "Modification for Atomic Red Test" -ErrorAction Ignore } Cleanup command Remove-Item -Path "C:\Users\$env:USERNAME\AppData\Local\Comms\Unistore\data\copy" -Recurse -Force -ErrorAction Ignore GUIDad9f8c3f-e6b6-4090-84f9-db65c785f036
05	Copy and Modify Mailbox Data on Linux	linux	bash	Required	1	Yes
Copies and modifies mail data on Linux Attack command mkdir -p /var/spool/mail/copy; for file in /var/spool/mail/*; do if [ "$(basename "$file")" != "copy" ]; then cp -R "$file" /var/spool/mail/copy/; if [ -f "/var/spool/mail/copy/$(basename "$file")" ]; then echo "Modification for Atomic Red Test" >> "/var/spool/mail/copy/$(basename "$file")"; fi; fi; done Cleanup command rm -rf /var/spool/mail/copy if [ -f "$(ls -A /var/spool/mail/temp)" ]; then rm /var/spool/mail/temp; fi Prerequisite Create dummy file in /var/spool/mail/ if no files exist Check if [ -z "$(ls -A /var/spool/mail/)" ]; then exit 1; else exit 0; fi Satisfy if [ -z "$(ls -A /var/spool/mail/)" ]; then touch /var/spool/mail/temp; fi GUID65043630-62e8-4649-a8ae-b8af955b4bf6
06	Copy and Modify Mailbox Data on macOS	macos	bash	Required	—	Yes
Copies and modifies mail data on macOS Attack command mkdir ~/Library/Mail/copy cp -R ~/Library/Mail/* ~/Library/Mail/copy echo "Manipulated data" > ~/Library/Mail/copy/manipulated.txt Cleanup command rm -rf ~/Library/Mail/copy GUIDcf9aef8e-dd40-4cc6-9659-8a4c27dc6c49

Tests from Atomic Red Team (MIT licence) · technique definition

Clear Mailbox Data detections T1070.008

9 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

73rd pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs