Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1070.008_clear-mailbox-data
Adversaries may modify mail and mail application data to remove evidence of their activity.
Passed 17 of 21 test cases with the skill, and 13 of 21 without it.
and 6 more in the full report
5 fixed14 passed either way4 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 3 test cases the skill fixed. Same model, same prompt, with and without the skill.
We are logging a risk finding for our enterprise risk register regarding vulnerable local mail stores and weak anti-tampering controls on mail data. Which CWE identifier best categorizes this weakness when protective security mechanisms fail to prevent unauthorized modification or deletion?
| Checked | Without skill | With skill |
|---|---|---|
| CWE-693 | Missed | Passed |
| Protection Mechanism Failure | Missed | Passed |
The instructions your model reads when the skill loads.
Sub-technique of: T1070
Adversaries may modify mail and mail application data to remove evidence of their activity. Email applications allow users and other programs to export and delete mailbox data via command line tools or use of APIs. Mail application data can be emails, email metadata, or logs generated by the application or operating system, such as export requests.
Adversaries may manipulate emails and mailbox data to remove logs, artifacts, and metadata, such as evidence of Phishing/Internal Spearphishing, Email Collection, Mail Protocols for command and control, or email-based exfiltration such as Exfiltration Over Alternative Protocol. For example, to remove evidence on Exchange servers adversaries have used the ExchangePowerShell PowerShell module, including Remove-MailboxExportRequest to remove evidence of mailbox exports. On Linux and macOS, adversaries may also delete emails through a command line utility called mail or use AppleScript to interact with APIs on macOS.
Adversaries may also remove emails and metadata/headers indicative of spam or suspicious activity (for example, through the use of organization-wide transport rules) to reduce the likelihood of malicious emails being detected by security products.
Platforms: Linux, macOS, Office Suite, Windows
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Copies and deletes mail data on Windows
Supported Platforms: windows Elevation Required: Yes
test cases passed, vs 13 / 21 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.