t1070-008-clear-mailbox-data

name	T1070.008_clear-mailbox-data
description	Adversaries may modify mail and mail application data to remove evidence of their activity.
category	configuration
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1070.008","defense-evasion","linux","macos","office-suite","windows","sub-technique"]
technique_id	T1070.008
tactic	defense-evasion
all_tactics	["defense-evasion"]
platforms	["Linux","macOS","Office Suite","Windows"]
mitre_url	https://attack.mitre.org/techniques/T1070/008
tech_stack	["linux","macos","office","windows"]
cwe_ids	["CWE-693"]
chains_with	["T1070","T1070.001","T1070.002","T1070.003","T1070.004","T1070.005","T1070.006","T1070.007","T1070.009","T1070.010"]
prerequisites	["T1070"]
severity_boost	{"T1070":"Chain with T1070 for deeper attack path","T1070.001":"Chain with T1070.001 for deeper attack path","T1070.002":"Chain with T1070.002 for deeper attack path"}

T1070.008 Clear Mailbox Data

Sub-technique of: T1070

High-Level Description

Adversaries may modify mail and mail application data to remove evidence of their activity. Email applications allow users and other programs to export and delete mailbox data via command line tools or use of APIs. Mail application data can be emails, email metadata, or logs generated by the application or operating system, such as export requests.

Adversaries may manipulate emails and mailbox data to remove logs, artifacts, and metadata, such as evidence of Phishing/Internal Spearphishing, Email Collection, Mail Protocols for command and control, or email-based exfiltration such as Exfiltration Over Alternative Protocol. For example, to remove evidence on Exchange servers adversaries have used the ExchangePowerShell PowerShell module, including Remove-MailboxExportRequest to remove evidence of mailbox exports. On Linux and macOS, adversaries may also delete emails through a command line utility called mail or use AppleScript to interact with APIs on macOS.

Adversaries may also remove emails and metadata/headers indicative of spam or suspicious activity (for example, through the use of organization-wide transport rules) to reduce the likelihood of malicious emails being detected by security products.

Kill Chain Phase

• Defense Evasion (TA0005)

Platforms: Linux, macOS, Office Suite, Windows

What to Check

• Identify if Clear Mailbox Data technique is applicable to target environment
• Check Linux systems for indicators of Clear Mailbox Data
• Check macOS systems for indicators of Clear Mailbox Data
• Check Office Suite systems for indicators of Clear Mailbox Data
• Verify mitigations are bypassed or absent (3 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Copy and Delete Mailbox Data on Windows

Copies and deletes mail data on Windows

Supported Platforms: windows Yes