Anti-Forensics
Account Misuse
Audit Trail Saturation
Clear Browser Artifacts
Clear Email Artifacts
Code Contribution Obfuscation and Misrepresentation
Cross-System Activity Fragmentation
Decrease Privileges
Delayed Execution Triggers
Delete User Account
Deletion of Volume Shadow Copy
Disable Logging
Disk Wiping
File Deletion
File Encryption
Hide Artifacts
Hiding or Destroying Command History
Incremental Data Collection
Log Deletion
Log Modification
Message Deletion
Message Modification
Modify Windows Registry
Network Obfuscation
Parent Process ID Spoofing
Physical Destruction of Storage Media
Physical Removal of Disk Storage
Retention Window Exploitation
Rootkit
Stalling
Steganography
System Shutdown
System Time Modification
Timestomping
Tripwires
Trusted Tool Misuse
Uninstalling Software
Virtualization
- ID: AF030.002
- Created: 15th March 2026
- Updated: 27th May 2026
- MITRE ATT&CK®: T1070
- Contributor: The ITM Team
Deletion of Non-Corporate Communication Messages
The subject deletes messages from communication platforms that are not owned or administered by the organization. These platforms may include personal messaging services such as SMS, WhatsApp, Signal, Telegram, or other external communication applications.
Subjects may use these channels to conduct conversations outside corporate monitoring systems. Deleting these messages may be an attempt to remove evidence of coordination, disclosure of sensitive information, or communication with external parties.
Because these platforms typically operate outside organizational infrastructure, direct visibility into message activity is often limited. Evidence of deletion may instead emerge through device forensics, recovered artifacts, witness testimony, or references within other communication records.
MITRE ATT&CK® Mapping (1)
ATT&CK Enterprise Matrix Version 19.2