T1070.008 — Clear Mailbox Data

Tactic: Stealth · Platforms: Linux, macOS, Office Suite, Windows

Adversaries may modify mail and mail application data to remove evidence of their activity. Email applications allow users and other programs to export and delete mailbox data via command line tools or use of APIs. Mail application data can be emails, email metadata, or logs generated by the…

Sub-technique of Indicator Removal (T1070).

Sigma detection rules (4)

title: "T1070.008 Indicator Removal: Clear Mailbox Data"
id: c21783a1-9622-40b3-a08e-45ea82de47ed
description: 'Detects PowerShell execution of Exchange/M365 mailbox cmdlets commonly abused to purge mailbox content or export requests as anti-forensic cleanup (e.g. Search-Mailbox -DeleteContent, Remove-MailboxExportRequest). Corrected from a service:security / category:file_change definition on Sysmon EventID 23 — an inconsistent product/category/EventID triad with no mailbox-cmdlet signal. Actual mailbox log/audit deletion is typically performed and logged server-side in Exchange/M365 unified audit logs, not local Windows event logs; this rule implements the closest defensible host-based proxy — the PowerShell command line invoking the destructive cmdlet. Data Component: Process Creation (Command-Line). Tune using: MailstorePath, TransportRuleNames, PowerShellCommandMatch.'
references:
  - https://attack.mitre.org/techniques/T1070/008
author: Shahrukh Khan
date: 2026-02-21
license: MIT
tags:
  - attack.stealth
  - attack.t1070.008

logsource:
  category: process_creation
  product: windows

detection:
  selection_shell:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_cmdlets:
    CommandLine|contains:
      - 'Search-Mailbox'
      - 'Remove-MailboxExportRequest'
      - 'New-ComplianceSearchAction'
      - 'Remove-MailboxImportRequest'
  condition: selection_shell and selection_cmdlets

falsepositives:
  - Legitimate Exchange/M365 administrators performing eDiscovery, compliance search, or mailbox migration cleanup.

level: medium

title: "T1070.008 Indicator Removal: Clear Mailbox Data"
id: 9d30e357-cd87-4ed1-98d4-697db665c17a
description: 'Behavioral Detection of Mailbox Data and Log Deletion for Anti-Forensics. Previously only matched rm with the mail path in argv position a1, missing common invocations like rm -rf /var/mail/user where flags shift the path to a2/a3; now matches the mail path across a1, a2, and a3. Also adds coverage for the mail/mailx/formail CLI utilities explicitly named as the primary Linux mailbox-deletion vector in the technique description, though interactive delete subcommands entered via stdin remain invisible to argv-based telemetry. Tune using: MailFolderPath, CommandPattern.'
references:
  - https://attack.mitre.org/techniques/T1070/008
author: Shahrukh Khan
date: 2026-05-15
license: MIT
tags:
  - attack.stealth
  - attack.t1070.008

logsource:
  category: process_creation
  product: linux

detection:
  selection_rm_a1:
    type: EXECVE
    a0|endswith: '/rm'
    a1|contains:
      - '/var/mail/'
      - '/var/spool/mail/'
  selection_rm_a2:
    type: EXECVE
    a0|endswith: '/rm'
    a2|contains:
      - '/var/mail/'
      - '/var/spool/mail/'
  selection_rm_a3:
    type: EXECVE
    a0|endswith: '/rm'
    a3|contains:
      - '/var/mail/'
      - '/var/spool/mail/'
  selection_mailutil:
    type: EXECVE
    a0|endswith:
      - '/mail'
      - '/mailx'
      - '/formail'
    a1|contains:
      - '-f'
      - '/var/mail/'
      - '/var/spool/mail/'

  condition: 1 of selection_rm_* or selection_mailutil

falsepositives:
  - 'Mail administrators occasionally purge spool files during maintenance; correlate with a non-mail-admin user context.'
  - 'Users legitimately opening their own mailbox with mail -f <path> or mailx -f <path>; the interactive delete subcommand itself (e.g. d*) is entered via stdin and is not visible in argv, so this rule can only flag the invocation targeting a mailbox file, not confirm a deletion actually occurred.'

level: medium

title: "T1070.008 Indicator Removal: Clear Mailbox Data"
id: 815dbc52-05d2-4e8b-b38d-a5d6d9375cd7
description: 'Behavioral Detection of Mailbox Data and Log Deletion for Anti-Forensics. (Retargeted to the file_delete macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ScriptCommandMatch, LibraryPathMatch.'
references:
  - https://attack.mitre.org/techniques/T1070/008
author: Shahrukh Khan
date: 2026-06-15
license: MIT
tags:
  - attack.stealth
  - attack.t1070.008

logsource:
  category: file_delete
  product: macos

detection:
  selection:
    TargetFilename|contains:
      - '/Library/Mail/'
      - 'Envelope Index'

  condition: selection

falsepositives:
  - Users manually deleting old mail accounts or rebuilding a corrupted local mailbox produce identical file deletions.

level: medium

title: "T1070.008 Indicator Removal: Clear Mailbox Data"
id: 3efd5444-2cd0-4786-a980-66fdf31e2f0f
description: 'Behavioral Detection of Mailbox Data and Log Deletion for Anti-Forensics. (Data Component: Command Execution; baseline tier: fallback.) Tune using: CmdletFilter, UserRoleScope.'
references:
  - https://attack.mitre.org/techniques/T1070/008
author: Shahrukh Khan
date: 2026-01-24
license: MIT
tags:
  - attack.stealth
  - attack.t1070.008

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection_search_mailbox:
    CommandLine|contains: 'Search-Mailbox'
  selection_search_mailbox_delete:
    CommandLine|contains: '-DeleteContent'
  selection_remove_export:
    CommandLine|contains: 'Remove-MailboxExportRequest'
  selection_audit_bypass:
    CommandLine|contains: 'Set-MailboxAuditBypassAssociation'
  selection_audit_bypass_enabled:
    CommandLine|contains: '-AuditBypassEnabled $true'

  condition: (selection_search_mailbox and selection_search_mailbox_delete) or selection_remove_export or (selection_audit_bypass and selection_audit_bypass_enabled)

falsepositives:
  - Exchange administrators legitimately running Remove-MailboxExportRequest as routine export cleanup; this cmdlet alone is common enough that it should be paired with account-role context for high-confidence alerting.

level: high

Related sub-techniques

• T1070.003 Clear Command History
• T1070.004 File Deletion
• T1070.007 Clear Network Connection History and Configurations
• T1070.009 Clear Persistence
• T1070.010 Relocate Malware
• T1070.006 Timestomp
• T1070.005 Network Share Connection Removal

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1070.008 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan