Anti-Forensics
Account Misuse
Audit Trail Saturation
CCTV Surveillance Evasion
Clear Browser Artifacts
Clear Email Artifacts
Code Contribution Obfuscation and Misrepresentation
Cross-System Activity Fragmentation
Decrease Privileges
Delayed Execution Triggers
Delete User Account
Deletion of Volume Shadow Copy
Disable Logging
Disk Wiping
File Deletion
File Encryption
Hide Artifacts
Hiding or Destroying Command History
Incremental Data Collection
Investigative Deception
Log Deletion
Log Modification
Message Deletion
Message Modification
Modify Windows Registry
Network Obfuscation
Notification Suppression
Parent Process ID Spoofing
Physical Destruction of Evidence
Physical Identity Concealment
Physical Removal of Disk Storage
Retention Window Exploitation
Rootkit
Stalling
Steganography
System Shutdown
System Time Modification
Timestomping
Tripwires
Trusted Tool Misuse
Uninstalling Software
Virtualization
- ID: AF027.008
- Created: 15th November 2026
- Updated: 15th November 2026
- Contributor: The ITM Team
Delete Emails With Rules
A subject creates or modifies automated email rules to delete incoming messages that may provide evidence of their activities or involvement in an infringement. These rules may target emails based on sender addresses, subject lines, keywords, or other message characteristics, automatically deleting matching communications upon receipt.
The subject may use these rules to suppress security notifications, conceal communications with third parties, or remove other potentially incriminating messages without requiring manual intervention. Depending on the email platform and rule configuration, messages may be moved to deleted or recoverable item locations, or permanently deleted where supported.
This technique may hinder investigations by preventing relevant communications from appearing in the subject's inbox and reducing the availability of evidence during subsequent mailbox examination.