{"id":"T1565.001","name":"Stored Data Manipulation","url":"https://attack.mitre.org/techniques/T1565/001","tactics":["impact"],"platforms":["Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0193","stix_id":"x-mitre-detection-strategy--e3776b4e-00b0-44cd-9e77-5df960a979d7","name":"Detection Strategy for Stored Data Manipulation across OS Platforms.","url":"https://attack.mitre.org/detectionstrategies/DET0193","analytics":[{"id":"AN0555","stix_id":"x-mitre-analytic--e08eb9fa-4a45-434b-9776-277bd545f1f7","name":"Analytic 0555","description":"Identify unauthorized creation, deletion, or modification of business-critical stored data such as Office documents, database files, and log archives. Detect anomalous processes modifying stored data outside of expected workflows (e.g., non-database processes modifying database files).","url":"https://attack.mitre.org/detectionstrategies/DET0193#AN0555","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=11","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=23","data_component":"DC0040","data_component_name":"File Deletion","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=15","data_component":"DC0059","data_component_name":"File Metadata","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Security","channel":"EventCode=4663, 4670, 4656","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"wineventlog-security"}],"mutable_elements":[{"field":"MonitoredDirectories","description":"Paths to sensitive stored data files such as database directories or email archives."},{"field":"AuthorizedProcesses","description":"List of legitimate processes expected to create, delete, or modify stored data."},{"field":"TimeWindow","description":"Threshold for correlating multiple suspicious file operations within a short period."}],"live":true,"detection_strategies":["DET0193"],"techniques":["T1565.001"]},{"id":"AN0556","stix_id":"x-mitre-analytic--425a3e89-ac22-4ff3-bc1e-ca1672113075","name":"Analytic 0556","description":"Detect suspicious file creation, modification, or deletion in stored data directories (e.g., `/var/lib/mysql/`, `/var/log/`, mail spools). Identify shell commands interacting directly with structured data files instead of legitimate database utilities.","url":"https://attack.mitre.org/detectionstrategies/DET0193#AN0556","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"open, unlink, rename: File creation or deletion involving critical stored data","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"auditd-syscall"},{"name":"auditd:SYSCALL","channel":"write: Modification of structured stored data by suspicious processes","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"auditd-syscall"}],"mutable_elements":[{"field":"WatchedPaths","description":"Environment-specific paths where business-critical stored data resides."},{"field":"CommandExclusions","description":"Legitimate scripts/utilities excluded to minimize false positives."}],"live":true,"detection_strategies":["DET0193"],"techniques":["T1565.001"]},{"id":"AN0557","stix_id":"x-mitre-analytic--23b6aee9-90fc-46b8-bf8b-36043218f393","name":"Analytic 0557","description":"Monitor sensitive data files such as plist-based storage, mail archives, or Office files for unexpected modifications. Detect anomalous processes modifying stored data outside expected update cycles using FSEvents and Unified Logs.","url":"https://attack.mitre.org/detectionstrategies/DET0193#AN0557","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"Unexpected creation or modification of stored data files in protected directories","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"macos-unifiedlog"},{"name":"macos:osquery","channel":"CREATE, DELETE, WRITE: Stored data manipulation attempts by unauthorized processes","data_component":"DC0040","data_component_name":"File Deletion","log_source_slug":"macos-osquery"}],"mutable_elements":[{"field":"FileIntegrityBaseline","description":"Baseline hash values or metadata for stored data files to detect manipulation."},{"field":"AllowedEditors","description":"Whitelisted applications permitted to update stored data (e.g., Outlook, MySQL)."}],"live":true,"detection_strategies":["DET0193"],"techniques":["T1565.001"]}],"live":true,"version":"1.0","techniques":["T1565.001"]}],"sigma_rules":[{"id":"1182f3b3-e716-4efa-99ab-d2685d04360f","title":"History File Deletion","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-06-20","modified":"2022-09-15","description":"Detects events in which a history file gets deleted, e.g. the ~/bash_history to remove traces of malicious activity","references":["https://github.com/sleventyeleven/linuxprivchecker/","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.003/T1552.003.md"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.impact","attack.t1565.001"],"path":"rules/linux/process_creation/proc_creation_lnx_susp_history_delete.yml","techniques":["T1565.001"],"cves":[]},{"id":"46530378-f9db-4af9-a9e5-889c177d3881","title":"Azure Device or Configuration Modified or Deleted","author":"Austin Songer @austinsonger","status":"test","level":"medium","date":"2021-09-03","modified":"2022-10-09","description":"Identifies when a device or device configuration in azure is modified or deleted.","references":["https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#core-directory"],"logsource":{"product":"azure","service":"activitylogs"},"tags":["attack.impact","attack.t1485","attack.t1565.001"],"path":"rules/cloud/azure/activity_logs/azure_device_or_configuration_modified_or_deleted.yml","techniques":["T1485","T1565.001"],"cves":[]},{"id":"86157017-c2b1-4d4a-8c33-93b8e67e4af4","title":"Potential Suspicious Change To Sensitive/Critical Files","author":"@d4ns4n_ (Wuerth-Phoenix)","status":"test","level":"medium","date":"2023-05-30","modified":"2026-03-18","description":"Detects changes of sensitive and critical files. Monitors files that you don't expect to change without planning on Linux system.\nThese files include, but are not limited to, system configuration files, authentication files, and critical application files.\nAttackers often target these files to maintain persistence, escalate privileges, or disrupt system operations.\n","references":["https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview#which-files-should-i-monitor"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.impact","attack.t1565.001"],"path":"rules/linux/process_creation/proc_creation_lnx_susp_sensitive_file_access.yml","techniques":["T1565.001"],"cves":[]},{"id":"af6925b0-8826-47f1-9324-337507a0babd","title":"Azure DNS Zone Modified or Deleted","author":"Austin Songer @austinsonger","status":"test","level":"medium","date":"2021-08-08","modified":"2022-08-23","description":"Identifies when DNS zone is modified or deleted.","references":["https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes"],"logsource":{"product":"azure","service":"activitylogs"},"tags":["attack.impact","attack.t1565.001"],"path":"rules/cloud/azure/activity_logs/azure_dns_zone_modified_or_deleted.yml","techniques":["T1565.001"],"cves":[]},{"id":"d94a35f0-7a29-45f6-90a0-80df6159967c","title":"Cisco Denial of Service","author":"Austin Clark","status":"test","level":"medium","date":"2019-08-15","modified":"2023-01-04","description":"Detect a system being shutdown or put into different boot mode","references":[],"logsource":{"product":"cisco","service":"aaa"},"tags":["attack.impact","attack.t1495","attack.t1529","attack.t1565.001"],"path":"rules/network/cisco/aaa/cisco_cli_dos.yml","techniques":["T1495","T1529","T1565.001"],"cves":[]},{"id":"e09eb557-96d2-4de9-ba2d-30f712a5afd3","title":"Commands to Clear or Remove the Syslog - Builtin","author":"Max Altgelt (Nextron Systems)","status":"test","level":"high","date":"2021-09-10","modified":"2022-11-26","description":"Detects specific commands commonly used to remove or empty the syslog","references":["https://www.virustotal.com/gui/file/fc614fb4bda24ae8ca2c44e812d12c0fab6dd7a097472a35dd12ded053ab8474"],"logsource":{"product":"linux"},"tags":["attack.impact","attack.t1565.001"],"path":"rules/linux/builtin/lnx_clear_syslog.yml","techniques":["T1565.001"],"cves":[]}],"kev_cves":[{"cveID":"CVE-2025-0108","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2022-41328","state":"mapped","mapping_types":["secondary_impact"]}],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}