tfMITRE ATT&CK technique

Data Manipulation T1565

Tactic: Impact
Platforms: Linux, macOS, Windows
Version: 1.1
Created: 02 March 2020
Last modified: 12 May 2026

Sub-techniques 312 rules across the family · 3 mapped directly to T1565 · 2 of 3 carry rules

.001Stored Data Manipulation7 .002Transmitted Data Manipulation2 .003Runtime Data Manipulation0

Adversaries may insert, delete, or manipulate data in order to influence external outcomes or hide activity, thus threatening the integrity of the data.[1] By manipulating data, adversaries may attempt to affect a business process, organizational understanding, or decision making.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups45th pct

Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware44th pct

Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.

Detection rules54th pct

Detection rules54th percentile · 54% of ATT&CK techniques have this many detection rules written or fewer.

Data Manipulation MITRE reference T1565

45th pctamong all ATT&CK techniques for number of groups

1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

FIN13G1016 ↗

Has injected fraudulent transactions into compromised networks that mimic legitimate behavior to siphon off incremental amounts of money.1

created 2023-07-271 referenceaka Elephant Beetle

All 1 groups for this technique

Offense vs defense T1565

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 3Splunk ESCU (cumulative) · 0

first rule: 2021 Q2

Data Manipulation detection strategy DET0059

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Data Manipulation

Enterprise

3 platforms

AN0162 · Windows

Correlate unauthorized or anomalous file modifications, deletions, or metadata changes with suspicious process execution or API calls. Detect abnormal changes to structured data (e.g., database files, logs, financial records) outside expected business process activity.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File CreationDC0039	WinEventLog:Sysmon	EventCode=11
File AccessDC0055	WinEventLog:Security	EventCode=4663, 4670, 4656
File MetadataDC0059	WinEventLog:Sysmon	EventCode=15
File ModificationDC0061	WinEventLog:Sysmon	EventCode=2

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
MonitoredFilePaths	List of critical data directories or files; environment-specific tuning required.
TimeWindow	Threshold for correlating process execution with rapid data changes.
AuthorizedProcesses	Expected processes permitted to modify business-critical data.

AN0163 · Linux

Detect unauthorized manipulation of log files, database entries, or system configuration files through auditd and syslog. Correlate shell commands that alter HISTFILE or data-related processes with abnormal file access patterns.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File ModificationDC0061	auditd:SYSCALL	open, unlink, rename: Suspicious file access, deletion, or modification of sensitive paths
Network Traffic ContentDC0085	linux:syslog	Unexpected SQL or application log entries showing tampered or malformed data

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
WatchedDirectories	Specific log or data directories critical to integrity; tune per organization.
CommandExclusions	Legitimate scripts/tools excluded from data manipulation monitoring.

AN0164 · macOS

Detect manipulation of system or application files in /Library, /System, or user data directories using FSEvents and Unified Logs. Identify anomalous process execution modifying plist files, structured data, or logs outside expected update cycles.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
OS API ExecutionDC0021	macos:osquery	open, execve: Unexpected processes accessing or modifying critical files
File ModificationDC0061	macos:unifiedlog	Anomalous plist modifications or sensitive file overwrites by non-standard processes

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
AllowedPlistEditors	Whitelisted processes authorized to modify plist or configuration files.
FileIntegrityBaseline	Baseline hash values for key files to support integrity validation.

Data Manipulation detections T1565

3 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

54th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs