Techniques › T1565.003 › AN1098
AN1098 Analytic 1098
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detect runtime manipulation by monitoring system calls for modifications to shared libraries, ELF binaries, or environment variables that affect how data is displayed. Look for suspicious writes to application directories and mismatch in binary integrity baselines.</p>
- Detects
- T1565.003 Runtime Data Manipulation
- Part of
- DET0391 Detection Strategy for Runtime Data Manipulation.
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| auditd:SYSCALL | open, write: File writes to application binaries or libraries at runtime | DC0061 File Modification |
| linux:syslog | Execution of modified binaries or abnormal library load sequences | DC0021 OS API Execution |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
WatchedBinaries | Specific critical application binaries or libraries to monitor for unauthorized changes. |
IntegrityCheckFrequency | Interval for verifying hashes of executables and libraries. |