1200KM / simulation
T1070.008 Clear Mailbox Data — Attack Simulation
Adversaries may modify mail and mail application data to remove evidence of their activity. Email applications allow users and other programs to export and delete mailbox data via command line tools or use of APIs. Mail application data can be emails, email metadata, or logs generated by the application or operating system, such as export requests. Adversaries may manipulate emails and mailbox data to remove logs, artifacts, and metadata, such…
Technique description
Adversaries may modify mail and mail application data to remove evidence of their activity. Email applications allow users and other programs to export and delete mailbox data via command line tools or use of APIs. Mail application data can be emails, email metadata, or logs generated by the application or operating system, such as export requests. Adversaries may manipulate emails and mailbox data to remove logs, artifacts, and metadata, such…
At least one platform-compatible Atomic procedure is documented. Individual review, lab prerequisites, and validation remain required.
Official ATT&CK definition · Detection rules and anomaly models
Documented simulation candidates
- Copy and Delete Mailbox Data on Linux
Procedure 25e2be0e-96f7-4417-bd16-a4a2500e3802; elevation required; cleanup present, not reviewed. Not executed or individually validated.
- Copy and Delete Mailbox Data on macOS
Procedure 3824130e-a6e4-4528-8091-3a52eeb540f6; elevation required; cleanup present, not reviewed. Not executed or individually validated.
- Copy and Modify Mailbox Data on Linux
Procedure 6d99f93c-da56-49e3-b195-163090ace4f6; elevation required; cleanup present, not reviewed. Not executed or individually validated.
- Copy and Modify Mailbox Data on macOS
Procedure 8a0b1579-5a36-483a-9cde-0236983e1665; elevation required; cleanup present, not reviewed. Not executed or individually validated.
- Copy and Delete Mailbox Data on Windows
Procedure d29f01ea-ac72-4efc-8a15-bea64b77fabf; elevation required; cleanup present, not reviewed. Not executed or individually validated.
- Copy and Modify Mailbox Data on Windows
Procedure edddff85-fee0-499d-9501-7d4d2892e79b; elevation required; cleanup present, not reviewed. Not executed or individually validated.
Connected ecosystem references
Linked tags
Detection and collection
Attack tools
No reviewed association in this snapshot.
Threat actor context
These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.
Existing research
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.