Deletion of Security/Password-Reset Notification Emails (Evasion Cleanup)

Ankit Mehta@Secvyn

•updated Aug 7, 2026•4•0•2

Detects the deletion of multiple items from an Office 365 mailbox that match common security-related email subject keywords. This behavior is indicative of an attacker attempting to cover their tracks by removing security alerts, MFA notifications, or password reset confirmations following a compromise.