ATT&CK technique
View on MITRE ATT&CK →
T1070.008
Clear Mailbox Data
Stealth
10 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | M365 Exchange MFA Notification Email Deleted or Moved | production | 2026-10-20 |
| splunk | O365 Email Password and Payroll Compromise Behavior | production | 2026-09-23 |
| splunk | O365 Email Receive and Hard Delete Takeover Behavior | production | 2026-09-23 |
| splunk | O365 Email Send and Hard Delete Exfiltration Behavior | production | 2026-09-23 |
| splunk | O365 Email Send Attachments Excessive Volume | production | 2026-09-23 |
| splunk | Cisco ASA - User Account Deleted From Local Database | production | 2026-05-13 |
| splunk | O365 Email Hard Delete Excessive Volume | production | 2026-05-13 |
| splunk | O365 Email Send and Hard Delete Suspicious Behavior | production | 2026-05-13 |
| sigma | Access To Windows Outlook Mail Files By Uncommon Applications | test | 2024-07-29 |
| sigma | Windows Mail App Mailbox Access Via PowerShell Script | test | 2023-07-08 |