T1070.008: Clear Mailbox Data
Adversaries may modify mail and mail application data to remove evidence of their activity. Email applications allow users and other programs to export and delete mailbox data via command line tools or use of APIs. Mail application data can be emails, email metadata, or logs generated by the application or operating system, such as export requests.
Adversaries may manipulate emails and mailbox data to remove logs, artifacts, and metadata, such as evidence of Phishing/Internal Spearphishing, Email Collection, Mail Protocols for command and control, or email-based exfiltration such as Exfiltration Over Alternative Protocol. For example, to remove evidence on Exchange servers adversaries have used the ExchangePowerShell PowerShell module, including Remove-MailboxExportRequest to remove evidence of mailbox exports.[1][2] On Linux and macOS, adversaries may also delete emails through a command line utility called mail or use AppleScript to interact with APIs on macOS.[3][4]
Adversaries may also remove emails and metadata/headers indicative of spam or suspicious activity (for example, through the use of organization-wide transport rules) to reduce the likelihood of malicious emails being detected by security products.[5]
Analyst context for executives and security teams
Clear Mailbox Data matters because email often contains the evidence needed to understand phishing, mailbox collection, command-and-control over mail protocols, or email-based exfiltration. If an adversary can delete or alter mailbox items, metadata, export requests, headers, or mail application logs, leaders may lose the evidence needed for incident scope, legal review, audit response, and user notification decisions.
Executive priority
Treat mailbox anti-forensics as both an identity/cloud and incident-response readiness issue. Priority questions are: who can delete mailbox data or export evidence, are mail and administrative audit records retained off-host, and can the SOC reconstruct activity if mailbox artifacts are removed? This technique should influence investment in email audit logging, least-privilege administration, centralized log retention, and evidence-preservation procedures.
Technical view
ATT&CK maps this sub-technique to stealth across Linux, macOS, Office Suite, and Windows. Validate monitoring around mailbox exports and deletions, ExchangePowerShell activity such as Remove-MailboxExportRequest, mail client or command-line mailbox manipulation, AppleScript interaction with mail APIs on macOS, API-based mailbox changes, and organization-wide transport rule changes that could remove suspicious messages or headers. Because no official ATT&CK detection text is provided, use the related DET0266 strategy as direction for behavioral detection of mailbox data and log deletion, and tune it against legitimate administrative cleanup, retention workflows, and user-initiated mailbox maintenance.
Likely telemetry
- Mailbox audit logs for message deletion, export, and metadata/header changes
- Email platform administrative audit logs, including transport rule creation or modification
- ExchangePowerShell command history and administrative action logs
- Operating system process and command-line telemetry for mail utilities on Linux/macOS and PowerShell on Windows
- API and OAuth application activity against cloud email services
Detection direction
- Confirm whether mailbox deletion, export request removal, and administrative mail rule changes generate searchable audit events.
- Correlate mailbox data deletion with recent phishing, internal spearphishing, email collection, mail-protocol activity, or suspected email-based exfiltration.
- Look for deletion or cleanup activity by privileged users, service principals, OAuth applications, scripts, or command-line tools outside expected change windows.
- Tune out known retention policies, legal hold workflows, helpdesk mailbox cleanup, and approved export removal processes to reduce false positives.
- Test whether evidence remains available if mailbox items or local mail logs are deleted, especially through centralized logging or remote storage.
Mitigation priorities
- Enforce least privilege over mailbox administration, file and directory permissions, and mail application data access, consistent with M1022.
- Forward important email, administrative, endpoint, and operating system logs to centralized or remote storage so local or mailbox-level tampering does not erase evidence, consistent with M1029.
- Regularly audit mailbox permissions, export activity, transport rules, API/OAuth access, and logging configuration, consistent with M1047.
- Document incident-response procedures for preserving mailbox evidence before routine cleanup or administrative changes remove investigative context.
Analyst notes and limits
The relationship set shows this behavior as a sub-technique of Indicator Removal and associates it with a detection strategy plus mitigations for permissions, remote data storage, and auditing. It is also referenced in campaign, group, and software relationships, including SolarWinds Compromise, Scattered Spider, APT42, Goopy, and LunarMail; these relationships should be used for context, not as evidence of current activity in any specific environment.
The official ATT&CK object does not provide a detection section. This take therefore stays at the level of validation direction and telemetry classes supported by the description, references, and relationships. Actual coverage depends on the organization’s email platform, audit licensing/configuration, retention policy, endpoint visibility, and whether logs are protected from mailbox or host-level deletion.
Clear Mailbox Data
Adversaries may modify mail and mail application data to remove evidence of their activity. Email applications allow users and other programs to export and delete mailbox data via command line tools or use of APIs. Mail application data can be emails, email metadata, or logs generated by the application or operating system, such as export requests.
Adversaries may manipulate emails and mailbox data to remove logs, artifacts, and metadata, such as evidence of Phishing/Internal Spearphishing, Email Collection, Mail Protocols for command and control, or email-based exfiltration such as Exfiltration Over Alternative Protocol. For example, to remove evidence on Exchange servers adversaries have used the ExchangePowerShell PowerShell module, including Remove-MailboxExportRequest to remove evidence of mailbox exports.[1][2] On Linux and macOS, adversaries may also delete emails through a command line utility called mail or use AppleScript to interact with APIs on macOS.[3][4]
Adversaries may also remove emails and metadata/headers indicative of spam or suspicious activity (for example, through the use of organization-wide transport rules) to reduce the likelihood of malicious emails being detected by security products.[5]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Related techniques
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1070 | Indicator Removal | This object subtechnique of Indicator Removal. |
Groups, software, and campaigns
G1044: APT42
APT42 is an Iranian-sponsored threat group that conducts cyber espionage and surveillance.[1] The group primarily focuses on targets in the Middle East region, but has targeted a variety of industries and countries since at least 2015.[1] APT42 starts cyber operations through spearphishing emails and/or the PINEFLOWER Android malware, then monitors and collects information from the compromised systems and devices.[1] Finally, APT42 exfiltrates data using native features and open-source tools.[2]
APT42 activities have been linked to Magic Hound by other commercial vendors. While there are behavior and software overlaps between Magic Hound and APT42, they appear to be distinct entities and are tracked as separate entities by their originating vendor.
G1015: Scattered Spider
Scattered Spider is a native English-speaking cybercriminal group active since at least 2022. [1] [2] The group initially targeted customer relationship management (CRM) providers, business process outsourcing (BPO) firms, and telecommunications and technology companies before expanding in 2023 to gaming, hospitality, retail, managed service provider (MSP), manufacturing, and financial sectors. [2] Scattered Spider relies heavily on social engineering, including impersonating IT and help-desk staff, to gain initial access, bypass multi-factor authentication (MFA), and compromise enterprise networks. The group has adapted its tooling to evade endpoint detection and response (EDR) defenses and used ransomware for financial gain. [3] [4] [5] Scattered Spider had expanded into hybrid cloud and identity environments, using help-desk impersonation and MFA bypass to obtain administrator access in Okta, AWS, and Office 365. [6]
S1142: LunarMail
LunarMail is a backdoor that has been used by Turla since at least 2020 including in a compromise of a European ministry of foreign affairs (MFA) in conjunction with LunarLoader and LunarWeb. LunarMail is designed to be deployed on workstations and can use email messages and Steganography in command and control.[1]
S0477: Goopy
C0024: SolarWinds Compromise
The SolarWinds Compromise was a sophisticated supply chain cyber operation conducted by APT29 that was discovered in mid-December 2020. APT29 used customized malware to inject malicious code into the SolarWinds Orion software build process that was later distributed through a normal software update; they also used password spraying, token theft, API abuse, spear phishing, and other supply chain attacks to compromise user accounts and leverage their associated access. Victims of this campaign included government, consulting, technology, telecom, and other organizations in North America, Europe, Asia, and the Middle East. This activity has been labled the StellarParticle campaign in industry reporting.[1] Industry reporting also initially referred to the actors involved in this campaign as UNC2452, NOBELIUM, Dark Halo, and SolarStorm.[2][3][4][5][1][6][7][8]
In April 2021, the US and UK governments attributed the SolarWinds Compromise to Russia's Foreign Intelligence Service (SVR); public statements included citations to APT29, Cozy Bear, and The Dukes.[9][10][11] The US government assessed that of the approximately 18,000 affected public and private sector customers of Solar Winds’ Orion product, a much smaller number were compromised by follow-on APT29 activity on their systems.[12]
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 2.0 | Current bundle | 6e758a084951… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
Volexity SolarWinds
Cash, D. et al. (2020, December 14). Dark Halo Leverages SolarWinds Compromise to Breach Organizations. Retrieved December 29, 2020.
Open source URL -
[2]
ExchangePowerShell Module
Microsoft. (2017, September 25). ExchangePowerShell. Retrieved June 10, 2022.
Open source URL -
[3]
Cybereason Cobalt Kitty 2017
Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.
Open source URL -
[4]
mailx man page
Michael Kerrisk. (2021, August 27). mailx(1p) — Linux manual page. Retrieved June 10, 2022.
Open source URL -
[5]
Microsoft OAuth Spam 2022
Microsoft. (2023, September 22). Malicious OAuth applications abuse cloud email services to spread spam. Retrieved March 13, 2023.
Open source URL -
[6]
mitre-attack T1070.008Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.