ITM is an open framework - Submit your contributions now.

Insider Threat Matrix™Insider Threat Matrix™
  • ID: AF030.002
  • Created: 15th March 2026
  • Updated: 15th March 2026
  • MITRE ATT&CK®: T1070
  • Contributor: The ITM Team

Deletion of Non-Corporate Communication Messages

The subject deletes messages from communication platforms that are not owned or administered by the organization. These platforms may include personal messaging services such as SMS, WhatsApp, Signal, Telegram, or other external communication applications.

 

Subjects may use these channels to conduct conversations outside corporate monitoring systems. Deleting these messages may be an attempt to remove evidence of coordination, disclosure of sensitive information, or communication with external parties.

 

Because these platforms typically operate outside organizational infrastructure, direct visibility into message activity is often limited. Evidence of deletion may instead emerge through device forensics, recovered artifacts, witness testimony, or references within other communication records.