Techniques › T1565
T1565 Data Manipulation
impact — Linux, macOS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
3
analytics
3
Sigma rules tagged attack.t1565
2
KEV CVEs mapped here
<p>Adversaries may insert, delete, or manipulate data in order to influence external outcomes or hide activity, thus threatening the integrity of the data. By manipulating data, adversaries may attempt to affect a business process, organizational understanding, or decision making.</p><p>The type of modification and the impact it will have depends on the target application and process as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
| CVE | Vendor / product | Mapping type | State | Added |
|---|---|---|---|---|
| CVE-2025-24993 | Microsoft Windows | secondary impact | Mapped | 2025-03-11 |
| CVE-2021-31207 | Microsoft Exchange Server | primary impact | Mapped | 2021-11-03 |
Detection strategy · ATT&CK Enterprise v19.2
- DET0059 Detection Strategy for Data Manipulation v1.0
AN0162 WindowsCorrelate unauthorized or anomalous file modifications, deletions, or metadata changes with suspicious process execution or API calls. Detect abnormal changes to structured data (e.g., database files, logs, financial records) outside expected business process activity.Tunable:
MonitoredFilePathsTimeWindowAuthorizedProcessesAN0163 LinuxDetect unauthorized manipulation of log files, database entries, or system configuration files through auditd and syslog. Correlate shell commands that alter HISTFILE or data-related processes with abnormal file access patterns.auditd:SYSCALLopen, unlink, rename: Suspicious file access, deletion, or modification of sensitive paths→ DC0061 File Modificationlinux:syslogUnexpected SQL or application log entries showing tampered or malformed data→ DC0085 Network Traffic ContentTunable:WatchedDirectoriesCommandExclusionsAN0164 macOSDetect manipulation of system or application files in/Library,/System, or user data directories using FSEvents and Unified Logs. Identify anomalous process execution modifying plist files, structured data, or logs outside expected update cycles.macos:unifiedlogAnomalous plist modifications or sensitive file overwrites by non-standard processes→ DC0061 File Modificationmacos:osqueryopen, execve: Unexpected processes accessing or modifying critical files→ DC0021 OS API ExecutionTunable:AllowedPlistEditorsFileIntegrityBaseline
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1565
Author: Sittikorn S
· 2021-06-29 (modified 2021-08-20) · logsource: product=aws service=cloudtrail · 16124c2d-e40b-4fcc-8f2c-5ab7870a2223
Identifies disabling of default Amazon Elastic Block Store (EBS) encryption in the current region.
Disabling default encryption does not change the encryption status of your existing volumes.
Author: Austin Songer @austinsonger
· 2021-08-15 (modified 2022-10-09) · logsource: product=gcp service=gcp.audit · 234f9f48-904b-4736-a34c-55d23919e4b7
Identifies when sensitive information is re-identified in google Cloud.
Author: Borna Talebi
· 2021-09-14 (modified 2022-10-09) · logsource: product=windows category=ps_script · 4368354e-1797-463c-bc39-a309effbe8d7
Detects powershell scripts that adds a Name Resolution Policy Table (NRPT) rule for the specified namespace.
This will bypass the default DNS server and uses a specified server for answering the query.