{"id":"T1565.003","name":"Runtime Data Manipulation","url":"https://attack.mitre.org/techniques/T1565/003","tactics":["impact"],"platforms":["Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0391","stix_id":"x-mitre-detection-strategy--41107d12-dd2e-439f-af29-1a10dcfcb6ce","name":"Detection Strategy for Runtime Data Manipulation.","url":"https://attack.mitre.org/detectionstrategies/DET0391","analytics":[{"id":"AN1097","stix_id":"x-mitre-analytic--c07e8730-b5cf-4a74-be3a-938184af42df","name":"Analytic 1097","description":"Monitor for runtime data manipulations by detecting suspicious modification of application binaries, API hooking, or unexpected behavior from processes responsible for rendering or displaying data. Correlate registry edits, process creation, and unexpected binary hash mismatches.","url":"https://attack.mitre.org/detectionstrategies/DET0391#AN1097","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=11","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=15","data_component":"DC0059","data_component_name":"File Metadata","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Security","channel":"EventCode=4657","data_component":"DC0063","data_component_name":"Windows Registry Key Modification","log_source_slug":"wineventlog-security"}],"mutable_elements":[{"field":"MonitoredPaths","description":"Directory paths of business-critical applications where runtime manipulations are most impactful."},{"field":"HashBaseline","description":"Expected cryptographic hashes of application binaries used for runtime data display."}],"live":true,"detection_strategies":["DET0391"],"techniques":["T1565.003"]},{"id":"AN1098","stix_id":"x-mitre-analytic--e2e39b7e-02e4-4e7a-966c-6b05721da8f7","name":"Analytic 1098","description":"Detect runtime manipulation by monitoring system calls for modifications to shared libraries, ELF binaries, or environment variables that affect how data is displayed. Look for suspicious writes to application directories and mismatch in binary integrity baselines.","url":"https://attack.mitre.org/detectionstrategies/DET0391#AN1098","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"open, write: File writes to application binaries or libraries at runtime","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"auditd-syscall"},{"name":"linux:syslog","channel":"Execution of modified binaries or abnormal library load sequences","data_component":"DC0021","data_component_name":"OS API Execution","log_source_slug":"linux-syslog"}],"mutable_elements":[{"field":"WatchedBinaries","description":"Specific critical application binaries or libraries to monitor for unauthorized changes."},{"field":"IntegrityCheckFrequency","description":"Interval for verifying hashes of executables and libraries."}],"live":true,"detection_strategies":["DET0391"],"techniques":["T1565.003"]},{"id":"AN1099","stix_id":"x-mitre-analytic--a9c30b9d-6810-47d3-8bf5-ca787836e7ef","name":"Analytic 1099","description":"Monitor for runtime manipulation by observing changes in application bundles, unexpected signing modifications, and runtime API calls that inject or alter how data is displayed. Detect alterations in CFNetwork or CoreFoundation frameworks responsible for rendering data.","url":"https://attack.mitre.org/detectionstrategies/DET0391#AN1099","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"Unexpected application binary modifications or altered signing status","data_component":"DC0059","data_component_name":"File Metadata","log_source_slug":"macos-unifiedlog"},{"name":"macos:osquery","channel":"CALCULATE: Mismatch in file integrity of critical macOS applications","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"macos-osquery"}],"mutable_elements":[{"field":"AllowedApps","description":"Whitelisted applications expected to handle sensitive runtime data."},{"field":"SignatureEnforcement","description":"Policy enforcement for validating application code signing integrity."}],"live":true,"detection_strategies":["DET0391"],"techniques":["T1565.003"]}],"live":true,"version":"1.0","techniques":["T1565.003"]}],"sigma_rules":[],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}