Anti-Forensics
Account Misuse
Clear Browser Artifacts
Clear Email Artifacts
Decrease Privileges
Delayed Execution Triggers
Delete User Account
Deletion of Volume Shadow Copy
Disk Wiping
File Deletion
File Encryption
Hide Artifacts
Hiding or Destroying Command History
Log Deletion
Log Modification
Message Deletion
Modify Windows Registry
Network Obfuscation
Physical Destruction of Storage Media
Physical Removal of Disk Storage
Stalling
Steganography
System Shutdown
Timestomping
Tripwires
Uninstalling Software
Virtualization
Windows System Time Modification
- ID: AF030.002
- Created: 15th March 2026
- Updated: 15th March 2026
- MITRE ATT&CK®: T1070
- Contributor: The ITM Team
Deletion of Non-Corporate Communication Messages
The subject deletes messages from communication platforms that are not owned or administered by the organization. These platforms may include personal messaging services such as SMS, WhatsApp, Signal, Telegram, or other external communication applications.
Subjects may use these channels to conduct conversations outside corporate monitoring systems. Deleting these messages may be an attempt to remove evidence of coordination, disclosure of sensitive information, or communication with external parties.
Because these platforms typically operate outside organizational infrastructure, direct visibility into message activity is often limited. Evidence of deletion may instead emerge through device forensics, recovered artifacts, witness testimony, or references within other communication records.
MITRE ATT&CK® Mapping (1)
ATT&CK Enterprise Matrix Version 18.1