Detecting and Mitigating Clear Mailbox Data (T1070.008)

Clear Mailbox Data (MITRE ATT&CK T1070.008) is a Stealth technique. MITRE lists Linux, macOS, Office Suite and Windows as platforms.

Email applications let users and programs export and delete mailbox data through command line tools or APIs. That data includes emails, metadata, and logs such as export requests. Adversaries may change or delete it to remove evidence.

How attackers use it

MITRE says adversaries may remove logs, artifacts and metadata that point to phishing or internal spearphishing, email collection, mail protocols used for command and control, or email-based exfiltration.

Examples MITRE gives:

• On Exchange servers, the ExchangePowerShell module and its Remove-MailboxExportRequest cmdlet to delete evidence of mailbox exports.
• On Linux and macOS, the command line utility mail, or AppleScript to talk to APIs on macOS.
• Organization-wide transport rules that remove emails and metadata or headers that mark spam or suspicious activity, which lowers the chance that security products catch malicious mail.

How to detect it

MITRE's detection strategy has four analytics:

• Windows: mailbox manipulation or deletion through PowerShell, such as Remove-MailboxExportRequest, file deletion from Outlook data stores like Unistore.db, or tampering with quarantine mail logs.
• Linux: use of mail utilities such as mail or mailx to delete content, or file-level deletion of inbox files in /var/spool/mail/ or /var/mail/ after suspicious sessions.
• macOS: removal of Apple Mail artifacts through AppleScript, or direct deletion of mailbox content in ~/Library/Mail/, especially after Remote Login or C2-related API access.
• Exchange: Exchange Online or on-premises transport rule changes, such as header stripping, mailbox export cleanup, and admin actions in Exchange PowerShell sessions.

Collect Exchange admin audit logs and mailbox audit logs, and keep a list of approved transport rules so changes are easy to spot.

How to reduce the risk

MITRE lists three mitigations:

1. Audit. In Exchange, administrators can use Get-TransportRule and Remove-TransportRule to find and remove potentially malicious transport rules.
2. Remote data storage. Forward mail data and events to a log server or repository, with minimal delay.
3. Restrict file and directory permissions. Protect locally stored event files with proper permissions and authentication, and limit privilege escalation.

Check your own environment

# Exchange Management Shell: list transport rules (read only)
Get-TransportRule | Select-Object Name, State, Priority, WhenChanged

# Exchange Management Shell: list mailbox export requests (read only)
Get-MailboxExportRequest

Compare the rule list with your change records. Any rule you cannot explain is a finding. Also check who holds the roles that allow mailbox export.

Quick check

Sources

• MITRE ATT&CK T1070.008: Clear Mailbox Data