Anti-Forensics
Account Misuse
Browser or System Proxy Configuration
Clear Browser Artifacts
Clear Email Artifacts
Decrease Privileges
Delayed Execution Triggers
Delete User Account
Deletion of Volume Shadow Copy
Disk Wiping
File Deletion
File Encryption
Hide Artifacts
Hiding or Destroying Command History
Log Deletion
Log Modification
Modify Windows Registry
Physical Destruction of Storage Media
Physical Removal of Disk Storage
Steganography
System Shutdown
Timestomping
Tripwires
Uninstalling Software
Virtualization
Windows System Time Modification
- ID: AF027
- Created: 11th August 2025
- Updated: 11th August 2025
- Contributor: The ITM Team
Clear Email Artifacts
A subject clears email artifacts to hide evidence of their activities, such as deleting emails, auto-forwarding rules, or other mailbox rules.
Subsections
| ID | Name | Description |
|---|---|---|
| AF027.006 | Shared Mailbox Deletion | A subject intentionally deletes a shared mailbox that has been used for illegitimate activity - such as Exfiltration via Corporate Email, distribution of unsolicited bulk messages, or staging of sensitive data - with the purpose of denying access to investigators. |