tfMITRE ATT&CK sub-technique

Runtime Data Manipulation T1565.003

sub-technique of T1565 Data Manipulation

Tactic: Impact
Platforms: Linux, macOS, Windows
Version: 1.2
Created: 02 March 2020
Last modified: 13 November 2025

Adversaries may modify systems in order to manipulate the data as it is accessed and displayed to an end user, thus threatening the integrity of the data.[1][2] By manipulating runtime data, adversaries may attempt to affect a business process, organizational understanding, and decision making.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups45th pct

Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Runtime Data Manipulation MITRE reference T1565.003

45th pctamong all ATT&CK techniques for number of groups

1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

APT38G0082 ↗

Has used DYEPACK.FOX to manipulate PDF data as it is accessed to remove traces of fraudulent SWIFT transactions from the data displayed to the end user.1

created 2019-01-291 referenceaka NICKEL GLADSTONE

All 1 groups for this technique

Offense vs defense T1565.003

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Runtime Data Manipulation detection strategy DET0391

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Runtime Data Manipulation.

Enterprise

3 platforms

AN1097 · Windows

Monitor for runtime data manipulations by detecting suspicious modification of application binaries, API hooking, or unexpected behavior from processes responsible for rendering or displaying data. Correlate registry edits, process creation, and unexpected binary hash mismatches.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File CreationDC0039	WinEventLog:Sysmon	EventCode=11
File MetadataDC0059	WinEventLog:Sysmon	EventCode=15
Windows Registry Key ModificationDC0063	WinEventLog:Security	EventCode=4657

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
MonitoredPaths	Directory paths of business-critical applications where runtime manipulations are most impactful.
HashBaseline	Expected cryptographic hashes of application binaries used for runtime data display.

AN1098 · Linux

Detect runtime manipulation by monitoring system calls for modifications to shared libraries, ELF binaries, or environment variables that affect how data is displayed. Look for suspicious writes to application directories and mismatch in binary integrity baselines.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
OS API ExecutionDC0021	linux:syslog	Execution of modified binaries or abnormal library load sequences
File ModificationDC0061	auditd:SYSCALL	open, write: File writes to application binaries or libraries at runtime

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
WatchedBinaries	Specific critical application binaries or libraries to monitor for unauthorized changes.
IntegrityCheckFrequency	Interval for verifying hashes of executables and libraries.

AN1099 · macOS

Monitor for runtime manipulation by observing changes in application bundles, unexpected signing modifications, and runtime API calls that inject or alter how data is displayed. Detect alterations in CFNetwork or CoreFoundation frameworks responsible for rendering data.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File MetadataDC0059	macos:unifiedlog	Unexpected application binary modifications or altered signing status
File ModificationDC0061	macos:osquery	CALCULATE: Mismatch in file integrity of critical macOS applications

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
AllowedApps	Whitelisted applications expected to handle sensitive runtime data.
SignatureEnforcement	Policy enforcement for validating application code signing integrity.

Runtime Data Manipulation detections T1565.003

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs