{"id":"T1070.008","name":"Clear Mailbox Data","url":"https://attack.mitre.org/techniques/T1070/008","tactics":["stealth"],"platforms":["Linux","macOS","Office Suite","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0266","stix_id":"x-mitre-detection-strategy--08633541-0006-480a-a2d9-e1c81952cc71","name":"Behavioral Detection of Mailbox Data and Log Deletion for Anti-Forensics","url":"https://attack.mitre.org/detectionstrategies/DET0266","analytics":[{"id":"AN0737","stix_id":"x-mitre-analytic--ddbf61e2-7dad-40ef-90ef-7bec707b50fd","name":"Analytic 0737","description":"Detects mailbox manipulation or deletion via PowerShell (e.g., Remove-MailboxExportRequest), file deletion from Outlook data stores (Unistore.db), or tampering with quarantined mail logs.","url":"https://attack.mitre.org/detectionstrategies/DET0266#AN0737","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:PowerShell","channel":"EventCode=4103, 4104, 4105, 4106","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"wineventlog-powershell"},{"name":"WinEventLog:Sysmon","channel":"EventCode=23","data_component":"DC0040","data_component_name":"File Deletion","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Security","channel":"EventCode=4663, 4670, 4656","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"wineventlog-security"},{"name":"m365:exchange","channel":"Transport Rule Modification","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"m365-exchange"}],"mutable_elements":[{"field":"MailstorePath","description":"Outlook files in AppData\\Local\\Comms\\Unistore\\data"},{"field":"TransportRuleNames","description":"Target suspicious rule changes (e.g., header removal)"},{"field":"PowerShellCommandMatch","description":"Regex match on `Remove-MailboxExportRequest` and similar Exchange cmdlets"}],"live":true,"detection_strategies":["DET0266"],"techniques":["T1070.008"]},{"id":"AN0738","stix_id":"x-mitre-analytic--9933242a-f96e-4b3e-896f-e7335f410a4f","name":"Analytic 0738","description":"Detects the use of mail utilities like `mail` or `mailx` to delete mailbox content, or file-level deletion of inbox files from `/var/spool/mail/` or `/var/mail/` following suspicious sessions.","url":"https://attack.mitre.org/detectionstrategies/DET0266#AN0738","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"},{"name":"auditd:SYSCALL","channel":"unlink/unlinkat","data_component":"DC0040","data_component_name":"File Deletion","log_source_slug":"auditd-syscall"}],"mutable_elements":[{"field":"MailFolderPath","description":"Common inbox file locations like /var/spool/mail/, /var/mail/"},{"field":"CommandPattern","description":"Usage of mailx or echo piped to mail followed by deletion"}],"live":true,"detection_strategies":["DET0266"],"techniques":["T1070.008"]},{"id":"AN0739","stix_id":"x-mitre-analytic--cd10c7fd-edef-4f85-aff3-9eaa35906b18","name":"Analytic 0739","description":"Detects removal of Apple Mail artifacts via AppleScript or direct deletion of mailbox content in ~/Library/Mail/, especially when preceded by Remote Login or C2-related API access.","url":"https://attack.mitre.org/detectionstrategies/DET0266#AN0739","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"log stream","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"macos-unifiedlog"},{"name":"macos:osquery","channel":"file_events","data_component":"DC0040","data_component_name":"File Deletion","log_source_slug":"macos-osquery"}],"mutable_elements":[{"field":"ScriptCommandMatch","description":"AppleScript references to Mail.app and delete commands"},{"field":"LibraryPathMatch","description":"Files within ~/Library/Mail/V*/ folders"}],"live":true,"detection_strategies":["DET0266"],"techniques":["T1070.008"]},{"id":"AN0740","stix_id":"x-mitre-analytic--dff59103-f6d4-4580-8316-a0528768b4b3","name":"Analytic 0740","description":"Detects Exchange Online or on-prem transport rule changes (e.g., header stripping) and mailbox export cleanup via `Remove-MailboxExportRequest`, as well as admin actions via Exchange PowerShell sessions.","url":"https://attack.mitre.org/detectionstrategies/DET0266#AN0740","platforms":["Office Suite"],"log_source_references":[{"name":"m365:exchange","channel":"Admin Audit Logs, Transport Rules","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"m365-exchange"},{"name":"WinEventLog:PowerShell","channel":"Exchange Cmdlets","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"wineventlog-powershell"}],"mutable_elements":[{"field":"CmdletFilter","description":"Include `New-TransportRule`, `Set-TransportRule`, `Remove-*` actions"},{"field":"UserRoleScope","description":"Track role assignments for admins performing deletions"}],"live":true,"detection_strategies":["DET0266"],"techniques":["T1070.008"]}],"live":true,"version":"1.0","techniques":["T1070.008"]}],"sigma_rules":[{"id":"4e485d01-e18a-43f6-a46b-ef20496fa9d3","title":"Windows Mail App Mailbox Access Via PowerShell Script","author":"frack113","status":"test","level":"medium","date":"2023-07-08","modified":null,"description":"Detects PowerShell scripts that try to access the default Windows MailApp MailBox. This indicates manipulation of or access to the stored emails of a user. E.g. this could be used by an attacker to exfiltrate or delete the content of the emails.","references":["https://github.com/redcanaryco/atomic-red-team/blob/02cb591f75064ffe1e0df9ac3ed5972a2e491c97/atomics/T1070.008/T1070.008.md"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.stealth","attack.t1070.008","detection.threat-hunting"],"path":"rules-threat-hunting/windows/powershell/powershell_script/posh_ps_mailbox_access.yml","techniques":["T1070.008"],"cves":[]},{"id":"fc3e237f-2fef-406c-b90d-b3ae7e02fa8f","title":"Access To Windows Outlook Mail Files By Uncommon Applications","author":"frack113","status":"test","level":"low","date":"2024-05-10","modified":"2024-07-29","description":"Detects file access requests to Windows Outlook Mail by uncommon processes.\nCould indicate potential attempt of credential stealing.\nRequires heavy baselining before usage\n","references":["https://darkdefender.medium.com/windows-10-mail-app-forensics-39025f5418d2","https://github.com/redcanaryco/atomic-red-team/blob/58496ee3306e6e42a7054d36a94e6eb561ee3081/atomics/T1070.008/T1070.008.md#atomic-test-4---copy-and-modify-mailbox-data-on-windows"],"logsource":{"product":"windows","category":"file_access"},"tags":["attack.stealth","attack.t1070.008","detection.threat-hunting"],"path":"rules-threat-hunting/windows/file/file_access/file_access_win_office_outlook_mail_credential.yml","techniques":["T1070.008"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}