Cross-source coverage

T1070.008 / ATT&CK

Indicator Removal: Clear Mailbox Data

13 rules across 4 sources.

From MITRE ATT&CK 19.2

Adversaries may modify mail and mail application data to remove evidence of their activity. Email applications allow users and other programs to export and delete mailbox data via command line tools or use of APIs. Mail application data can be emails, email metadata, or logs generated by the application or operating system, such as export requests.

Adversaries may manipulate emails and mailbox data to remove logs, artifacts, and metadata, such as evidence of Phishing/Internal Spearphishing, Email Collection, Mail Protocols for command and control, or email-based exfiltration such as Exfiltration Over Alternative Protocol. For example, to remove evidence on Exchange servers adversaries have used the ExchangePowerShell PowerShell module, including Remove-MailboxExportRequest to remove evidence of mailbox exports. On Linux and macOS, adversaries may also delete emails through a command line utility called mail or use AppleScript to interact with APIs on macOS.

Adversaries may also remove emails and metadata/headers indicative of spam or suspicious activity (for example, through the use of organization-wide transport rules) to reduce the likelihood of malicious emails being detected by security products.

Tactics
Stealth
Platforms
Linux · macOS · Office Suite · Windows
Telemetry
WinEventLog:PowerShellWinEventLog:SysmonWinEventLog:Securitym365:exchangeauditd:SYSCALLmacos:unifiedlogmacos:osquery

How MITRE says to detect it DET0266

Behavioral Detection of Mailbox Data and Log Deletion for Anti-Forensics

Windows Analytic 0737

Detects mailbox manipulation or deletion via PowerShell (e.g., Remove-MailboxExportRequest), file deletion from Outlook data stores (Unistore.db), or tampering with quarantined mail logs.

  • WinEventLog:PowerShell EventCode=4103, 4104, 4105, 4106
  • WinEventLog:Sysmon EventCode=23
  • WinEventLog:Security EventCode=4663, 4670, 4656
  • m365:exchange Transport Rule Modification

Linux Analytic 0738

Detects the use of mail utilities like `mail` or `mailx` to delete mailbox content, or file-level deletion of inbox files from `/var/spool/mail/` or `/var/mail/` following suspicious sessions.

  • auditd:SYSCALL execve
  • auditd:SYSCALL unlink/unlinkat

macOS Analytic 0739

Detects removal of Apple Mail artifacts via AppleScript or direct deletion of mailbox content in ~/Library/Mail/, especially when preceded by Remote Login or C2-related API access.

  • macos:unifiedlog log stream
  • macos:osquery file_events

Office Suite Analytic 0740

Detects Exchange Online or on-prem transport rule changes (e.g., header stripping) and mailbox export cleanup via `Remove-MailboxExportRequest`, as well as admin actions via Exchange PowerShell sessions.

  • m365:exchange Admin Audit Logs, Transport Rules
  • WinEventLog:PowerShell Exchange Cmdlets

View on attack.mitre.org ↗

splunk/security_content

7 rules
Detection Severity Format
Cisco ASA - User Account Deleted From Local Database Undefined SPL
O365 Email Hard Delete Excessive Volume Undefined SPL
O365 Email Password and Payroll Compromise Behavior Undefined SPL
O365 Email Receive and Hard Delete Takeover Behavior Undefined SPL
O365 Email Send and Hard Delete Exfiltration Behavior Undefined SPL
O365 Email Send and Hard Delete Suspicious Behavior Undefined SPL
O365 Email Send Attachments Excessive Volume Undefined SPL

socfortress/Wazuh-Rules

3 rules
Detection Severity Format
Direct mailbox access or tampering attempt (T1070.008) command= sudo cp /var/spool/mail/testuser /var/spool/mail/mail/testuser.bak High Wazuh XML
Possible mailbox data manipulation detected (T1070.008 - Email Collection: Mailbox Manipulation) High Wazuh XML
Sysmon - Event 1: Process creation · PowerShell Mailbox Copy (T1070.008) Medium Wazuh XML

SigmaHQ/sigma

2 rules
Detection Severity Format
Windows Mail App Mailbox Access Via PowerShell Script Medium Sigma
Access To Windows Outlook Mail Files By Uncommon Applications Low Sigma

elastic/detection-rules

1 rule
Detection Severity Format
M365 Exchange MFA Notification Email Deleted or Moved Low Elastic TOML

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.