Anti-Forensics
Account Misuse
Audit Trail Saturation
Clear Browser Artifacts
Clear Email Artifacts
Code Contribution Obfuscation and Misrepresentation
Cross-System Activity Fragmentation
Decrease Privileges
Delayed Execution Triggers
Delete User Account
Deletion of Volume Shadow Copy
Disable Logging
Disk Wiping
File Deletion
File Encryption
Hide Artifacts
Hiding or Destroying Command History
Incremental Data Collection
Investigative Deception
Log Deletion
Log Modification
Message Deletion
Message Modification
Modify Windows Registry
Network Obfuscation
Parent Process ID Spoofing
Physical Destruction of Evidence
Physical Destruction of Storage Media
Physical Removal of Disk Storage
Retention Window Exploitation
Rootkit
Stalling
Steganography
System Shutdown
System Time Modification
Timestomping
Tripwires
Trusted Tool Misuse
Uninstalling Software
Virtualization
- ID: AF042.003
- Created: 07th November 2026
- Updated: 07th November 2026
- Contributor: The ITM Team
Coordinated False Accounts
A subject coordinates with other individuals to supply a shared, knowingly false account of relevant events. The subject may agree a cover story, distribute scripted explanations, coach another individual’s responses, or revise accounts so that materially false statements appear consistent across separate interviews or submissions.
The coordinated account is intended to conceal relevant conduct or create the appearance of independent corroboration. Similar wording or consistent recollections alone are insufficient: classification requires evidence that the participants knowingly coordinated a false version of events.