Anti-Forensics
Account Misuse
Audit Trail Saturation
Clear Browser Artifacts
Clear Email Artifacts
Code Contribution Obfuscation and Misrepresentation
Cross-System Activity Fragmentation
Decrease Privileges
Delayed Execution Triggers
Delete User Account
Deletion of Volume Shadow Copy
Disable Logging
Disk Wiping
File Deletion
File Encryption
Hide Artifacts
Hiding or Destroying Command History
Incremental Data Collection
Investigative Deception
Log Deletion
Log Modification
Message Deletion
Message Modification
Modify Windows Registry
Network Obfuscation
Notification Suppression
Parent Process ID Spoofing
Physical Destruction of Evidence
Physical Removal of Disk Storage
Retention Window Exploitation
Rootkit
Stalling
Steganography
System Shutdown
System Time Modification
Timestomping
Tripwires
Trusted Tool Misuse
Uninstalling Software
Virtualization
- ID: AF044
- Created: 08th November 2026
- Updated: 08th November 2026
- Contributor: The ITM Team
Notification Suppression
A subject deliberately prevents, diverts, conceals, or delays notifications to stop intended recipients from becoming aware of unauthorized conduct or to delay verification, investigation, or response. Notifications may be automatically generated or manually issued and may take any form, including emails, text messages, mobile or browser push notifications, in-application alerts, collaboration-platform messages, automated telephone calls, pager alerts, printed correspondence, or verbal notices. The intended recipients may be inside or outside the organization, including customers, account holders, system owners, approvers, auditors, and incident responders. Relevant notifications may concern account creation, changes to credentials or contact details, transactions, access grants, information transfers, service failures, security events, or policy exceptions.
The subject may interfere with notification generation, recipient selection, routing, delivery, or presentation. This may involve disabling notification rules, removing recipients from distribution groups, substituting false contact details, redirecting notices to a subject-controlled destination, modifying notification preferences, concealing delivered messages, or withholding a required communication. Suppression may target a particular event, account, recipient, or notification category, or operate more broadly across a system or business process. The subject may introduce the change before an infringement, maintain it during continuing activity, or restore the original settings afterward. The defining behavior is interference with the notification intended to expose the activity, rather than the destruction of the underlying evidence. Transaction records, audit events, and other source information may remain intact and available for investigation.