Techniques › T1565 › T1565.001
T1565.001 Stored Data Manipulation
impact — Linux, macOS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
3
analytics
6
Sigma rules tagged attack.t1565.001
2
KEV CVEs mapped here
<p>Adversaries may insert, delete, or manipulate data at rest in order to influence external outcomes or hide activity, thus threatening the integrity of the data. By manipulating stored data, adversaries may attempt to affect a business process, organizational understanding, and decision making.</p><p>Stored data could include a variety of file formats, such as Office files, databases, stored emails, and custom file formats. The type of modification and the impact it will have depends on the type of data as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
| CVE | Vendor / product | Mapping type | State | Added |
|---|---|---|---|---|
| CVE-2025-0108 | Palo Alto Networks PAN-OS | primary impact | Mapped | 2025-02-18 |
| CVE-2022-41328 | Fortinet FortiOS | secondary impact | Mapped | 2023-03-14 |
Detection strategy · ATT&CK Enterprise v19.2
- DET0193 Detection Strategy for Stored Data Manipulation across OS Platforms. v1.0
AN0555 WindowsIdentify unauthorized creation, deletion, or modification of business-critical stored data such as Office documents, database files, and log archives. Detect anomalous processes modifying stored data outside of expected workflows (e.g., non-database processes modifying database files).Tunable:
MonitoredDirectoriesAuthorizedProcessesTimeWindowAN0556 LinuxDetect suspicious file creation, modification, or deletion in stored data directories (e.g.,/var/lib/mysql/,/var/log/, mail spools). Identify shell commands interacting directly with structured data files instead of legitimate database utilities.auditd:SYSCALLopen, unlink, rename: File creation or deletion involving critical stored data→ DC0039 File Creationauditd:SYSCALLwrite: Modification of structured stored data by suspicious processes→ DC0061 File ModificationTunable:WatchedPathsCommandExclusionsAN0557 macOSMonitor sensitive data files such as plist-based storage, mail archives, or Office files for unexpected modifications. Detect anomalous processes modifying stored data outside expected update cycles using FSEvents and Unified Logs.macos:unifiedlogUnexpected creation or modification of stored data files in protected directories→ DC0061 File Modificationmacos:osqueryCREATE, DELETE, WRITE: Stored data manipulation attempts by unauthorized processes→ DC0040 File DeletionTunable:FileIntegrityBaselineAllowedEditors
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1565.001
Author: Florian Roth (Nextron Systems)
· 2022-06-20 (modified 2022-09-15) · logsource: product=linux category=process_creation · 1182f3b3-e716-4efa-99ab-d2685d04360f
Detects events in which a history file gets deleted, e.g. the ~/bash_history to remove traces of malicious activity
Author: Austin Songer @austinsonger
· 2021-09-03 (modified 2022-10-09) · logsource: product=azure service=activitylogs · 46530378-f9db-4af9-a9e5-889c177d3881
Identifies when a device or device configuration in azure is modified or deleted.
Author: @d4ns4n_ (Wuerth-Phoenix)
· 2023-05-30 (modified 2026-03-18) · logsource: product=linux category=process_creation · 86157017-c2b1-4d4a-8c33-93b8e67e4af4
Detects changes of sensitive and critical files. Monitors files that you don't expect to change without planning on Linux system.
These files include, but are not limited to, system configuration files, authentication files, and critical application files.
Attackers often target these files to maintain persistence, escalate privileges, or disrupt system operations.
Author: Austin Songer @austinsonger
· 2021-08-08 (modified 2022-08-23) · logsource: product=azure service=activitylogs · af6925b0-8826-47f1-9324-337507a0babd
Identifies when DNS zone is modified or deleted.
Author: Austin Clark
· 2019-08-15 (modified 2023-01-04) · logsource: product=cisco service=aaa · d94a35f0-7a29-45f6-90a0-80df6159967c
Detect a system being shutdown or put into different boot mode
Author: Max Altgelt (Nextron Systems)
· 2021-09-10 (modified 2022-11-26) · logsource: product=linux · e09eb557-96d2-4de9-ba2d-30f712a5afd3
Detects specific commands commonly used to remove or empty the syslog
Rules tagged at the parent level (attack.t1565) 3
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Sittikorn S
· 2021-06-29 (modified 2021-08-20) · logsource: product=aws service=cloudtrail · 16124c2d-e40b-4fcc-8f2c-5ab7870a2223
Identifies disabling of default Amazon Elastic Block Store (EBS) encryption in the current region.
Disabling default encryption does not change the encryption status of your existing volumes.
Author: Austin Songer @austinsonger
· 2021-08-15 (modified 2022-10-09) · logsource: product=gcp service=gcp.audit · 234f9f48-904b-4736-a34c-55d23919e4b7
Identifies when sensitive information is re-identified in google Cloud.
Author: Borna Talebi
· 2021-09-14 (modified 2022-10-09) · logsource: product=windows category=ps_script · 4368354e-1797-463c-bc39-a309effbe8d7
Detects powershell scripts that adds a Name Resolution Policy Table (NRPT) rule for the specified namespace.
This will bypass the default DNS server and uses a specified server for answering the query.