APT38G0082 ↗
Has used DYEPACK to create, delete, and alter records in databases used for SWIFT transactions.1
tfMITRE ATT&CK sub-technique
Stored Data Manipulation T1565.001
sub-technique of T1565 Data Manipulation
- Tactic
- Impact
- Platforms
- Linux, macOS, Windows
- Version
- 1.1
- Created
- 02 March 2020
- Last modified
- 13 November 2025
Adversaries may insert, delete, or manipulate data at rest in order to influence external outcomes or hide activity, thus threatening the integrity of the data.[1][2] By manipulating stored data, adversaries may attempt to affect a business process, organizational understanding, and decision making.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
1
Threat groups45th pct
Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.2
Tools & malware51st pct
Tools & malware51st percentile · 51% of ATT&CK techniques have this many tools implementing them or fewer.7
Detection rules69th pct
Detection rules69th percentile · 69% of ATT&CK techniques have this many detection rules written or fewer.Stored Data Manipulation MITRE reference T1565.001
45th pctamong all ATT&CK techniques for number of groups
1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
All 1 groups for this technique
2 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
MultiLayer WiperS1135 ↗
Changes the original path information of deleted files to make recovery efforts more difficult.1
SUNSPOTS0562 ↗
Created a copy of the SolarWinds Orion software source file with a .bk extension to backup the original content, wrote SUNBURST using the same filename but with a .tmp extension, and then moved SUNBURST using MoveFileEx to the original filename with a .cs extension so it could be compiled within Orion software.1
All 2 software entries for this technique
Offense vs defense T1565.001
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 0Sigma rules (cumulative) · 6Splunk ESCU (cumulative) · 1
first rule: 2019 Q3Stored Data Manipulation detection strategy DET0193
MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection Strategy for Stored Data Manipulation across OS Platforms.
3 platforms
AN0555 · Windows
Identify unauthorized creation, deletion, or modification of business-critical stored data such as Office documents, database files, and log archives. Detect anomalous processes modifying stored data outside of expected workflows (e.g., non-database processes modifying database files).
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| File CreationDC0039 | WinEventLog:Sysmon | EventCode=11 |
| File DeletionDC0040 | WinEventLog:Sysmon | EventCode=23 |
| File MetadataDC0059 | WinEventLog:Sysmon | EventCode=15 |
| File ModificationDC0061 | WinEventLog:Security | EventCode=4663, 4670, 4656 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| MonitoredDirectories | Paths to sensitive stored data files such as database directories or email archives. |
| AuthorizedProcesses | List of legitimate processes expected to create, delete, or modify stored data. |
| TimeWindow | Threshold for correlating multiple suspicious file operations within a short period. |
AN0556 · Linux
Detect suspicious file creation, modification, or deletion in stored data directories (e.g., /var/lib/mysql/, /var/log/, mail spools). Identify shell commands interacting directly with structured data files instead of legitimate database utilities.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| File CreationDC0039 | auditd:SYSCALL | open, unlink, rename: File creation or deletion involving critical stored data |
| File ModificationDC0061 | auditd:SYSCALL | write: Modification of structured stored data by suspicious processes |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| WatchedPaths | Environment-specific paths where business-critical stored data resides. |
| CommandExclusions | Legitimate scripts/utilities excluded to minimize false positives. |
AN0557 · macOS
Monitor sensitive data files such as plist-based storage, mail archives, or Office files for unexpected modifications. Detect anomalous processes modifying stored data outside expected update cycles using FSEvents and Unified Logs.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| File DeletionDC0040 | macos:osquery | CREATE, DELETE, WRITE: Stored data manipulation attempts by unauthorized processes |
| File ModificationDC0061 | macos:unifiedlog | Unexpected creation or modification of stored data files in protected directories |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| FileIntegrityBaseline | Baseline hash values or metadata for stored data files to detect manipulation. |
| AllowedEditors | Whitelisted applications permitted to update stored data (e.g., Outlook, MySQL). |
Consider encrypting important information to reduce an adversary’s ability to perform tailored data modifications.
Remote Data StorageM1029
Consider implementing IT disaster recovery plans that contain procedures for taking regular data backups that can be used to restore organizational data. Ensure backups are stored off system and is protected from common methods adversaries may use to gain access and manipulate backups.
Ensure least privilege principles are applied to important information resources to reduce exposure to data manipulation risk.