T1565.001 / ATT&CK

Windows Analytic 0555

Identify unauthorized creation, deletion, or modification of business-critical stored data such as Office documents, database files, and log archives. Detect anomalous processes modifying stored data outside of expected workflows (e.g., non-database processes modifying database files).

• WinEventLog:Sysmon EventCode=11
• WinEventLog:Sysmon EventCode=23
• WinEventLog:Sysmon EventCode=15
• WinEventLog:Security EventCode=4663, 4670, 4656

Linux Analytic 0556

Detect suspicious file creation, modification, or deletion in stored data directories (e.g., `/var/lib/mysql/`, `/var/log/`, mail spools). Identify shell commands interacting directly with structured data files instead of legitimate database utilities.

• auditd:SYSCALL open, unlink, rename: File creation or deletion involving critical stored data
• auditd:SYSCALL write: Modification of structured stored data by suspicious processes

macOS Analytic 0557

Monitor sensitive data files such as plist-based storage, mail archives, or Office files for unexpected modifications. Detect anomalous processes modifying stored data outside expected update cycles using FSEvents and Unified Logs.

• macos:unifiedlog Unexpected creation or modification of stored data files in protected directories
• macos:osquery CREATE, DELETE, WRITE: Stored data manipulation attempts by unauthorized processes