Cross-source coverage
T1565 / ATT&CK
Data Manipulation
43 rules across 10 sources.
From MITRE ATT&CK 19.2
Adversaries may insert, delete, or manipulate data in order to influence external outcomes or hide activity, thus threatening the integrity of the data. By manipulating data, adversaries may attempt to affect a business process, organizational understanding, or decision making.
The type of modification and the impact it will have depends on the target application and process as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.
- Tactics
- Impact
- Platforms
- Linux · macOS · Windows
- Telemetry
-
WinEventLog:SysmonWinEventLog:Securityauditd:SYSCALLlinux:syslogmacos:unifiedlogmacos:osquery
How MITRE says to detect it DET0059
Detection Strategy for Data Manipulation
Windows Analytic 0162
Correlate unauthorized or anomalous file modifications, deletions, or metadata changes with suspicious process execution or API calls. Detect abnormal changes to structured data (e.g., database files, logs, financial records) outside expected business process activity.
WinEventLog:SysmonEventCode=11WinEventLog:SysmonEventCode=2WinEventLog:SysmonEventCode=15WinEventLog:SecurityEventCode=4663, 4670, 4656
Linux Analytic 0163
Detect unauthorized manipulation of log files, database entries, or system configuration files through auditd and syslog. Correlate shell commands that alter HISTFILE or data-related processes with abnormal file access patterns.
auditd:SYSCALLopen, unlink, rename: Suspicious file access, deletion, or modification of sensitive pathslinux:syslogUnexpected SQL or application log entries showing tampered or malformed data
macOS Analytic 0164
Detect manipulation of system or application files in `/Library`, `/System`, or user data directories using FSEvents and Unified Logs. Identify anomalous process execution modifying plist files, structured data, or logs outside expected update cycles.
macos:unifiedlogAnomalous plist modifications or sensitive file overwrites by non-standard processesmacos:osqueryopen, execve: Unexpected processes accessing or modifying critical files
Sub-techniques with coverage
Counted in the 43 above — a rule tagged a sub-technique covers this technique too.
elastic/detection-rules
17 rules| Detection | Severity | Format |
|---|---|---|
| Agent Spoofing - Multiple Hosts Using Same Agent | High | Elastic TOML |
| AWS CloudTrail Log Updated | High | Elastic TOML |
| AWS S3 Static Site JavaScript File Uploaded | High | Elastic TOML |
| GKE CoreDNS or Kube-DNS Configuration Modified | High | Elastic TOML |
| Kubernetes CoreDNS or Kube-DNS Configuration Modified | High | Elastic TOML |
| AWS Bedrock Knowledge Base or RAG Data Source Tampering | Medium | Elastic TOML |
| AWS EC2 Encryption Disabled | Medium | Elastic TOML |
| AWS S3 Unauthenticated Bucket Access by Rare Source | Medium | Elastic TOML |
| Deprecated - M365 Security Compliance Potential Ransomware Activity | Medium | Elastic TOML |
| First Time Seen Memcached Writer | Medium | Elastic TOML |
+ 7 more from elastic/detection-rules → showing the 10 highest-severity
SigmaHQ/sigma
11 rules| Detection | Severity | Format |
|---|---|---|
| Commands to Clear or Remove the Syslog - Builtin | High | Sigma |
| History File Deletion | High | Sigma |
| Powershell Add Name Resolution Policy Table Rule | High | Sigma |
| AWS EC2 Disable EBS Encryption | Medium | Sigma |
| Azure Device or Configuration Modified or Deleted | Medium | Sigma |
| Azure DNS Zone Modified or Deleted | Medium | Sigma |
| Cisco Denial of Service | Medium | Sigma |
| Cisco Modify Configuration | Medium | Sigma |
| Google Cloud Re-identifies Sensitive Information | Medium | Sigma |
| ISATAP Router Address Was Set | Medium | Sigma |
+ 1 more from SigmaHQ/sigma → showing the 10 highest-severity
Wazuh Core Ruleset
6 rules| Detection | Severity | Format |
|---|---|---|
| Squid: Infected machine with W32.Beagle.DP. | High | Wazuh XML |
| Auditd: File or a directory access ended abnormally. | Medium | Wazuh XML |
| Integrity checksum changed. | Medium | Wazuh XML |
| Log file size reduced. | Medium | Wazuh XML |
| Registry Key Integrity Checksum Changed | Low | Wazuh XML |
| Registry Value Integrity Checksum Changed | Low | Wazuh XML |
falcosecurity/rules
2 rules| Detection | Severity | Format |
|---|---|---|
| Contact cloud metadata service from container | Low | Falco YAML |
| Contact K8S API Server From Container | Low | Falco YAML |
panther-labs/panther-analysis
2 rules| Detection | Severity | Format |
|---|---|---|
| AppOmni Alert Passthrough | Medium | Panther Python |
| AWS EC2 EBS Encryption Disabled | Medium | Panther Python |
Azure/Azure-Sentinel
1 rule| Detection | Severity | Format |
|---|---|---|
| AI Agents - Instructions changed on previously published agent | Undefined | KQL |
chainguard-dev/osquery-defense-kit
1 rule| Detection | Severity | Format |
|---|---|---|
| Unexpected /etc/hosts entries | Undefined | osquery SQL |
elastic/protections-artifacts
1 rule| Detection | Severity | Format |
|---|---|---|
| Suspicious Recursive File Deletion via Built-In Utilities | Undefined | Elastic TOML |
socfortress/Wazuh-Rules
1 rule| Detection | Severity | Format |
|---|---|---|
| operation. · office_365.Operation = EditForm | Low | Wazuh XML |
splunk/security_content
1 rule| Detection | Severity | Format |
|---|---|---|
| Windows WBAdmin File Recovery From Backup | Undefined | SPL |