T1565.002 Transmitted Data Manipulation

impact — Linux, macOS, Windows · attack.mitre.org · JSON

MITRE detection strategy

analytics

Sigma rules tagged attack.t1565.002

KEV CVEs mapped here

<p>Adversaries may alter data en route to storage or other systems in order to manipulate external outcomes or hide activity, thus threatening the integrity of the data. By manipulating transmitted data, adversaries may attempt to affect a business process, organizational understanding, and decision making.</p><p>Manipulation may be possible over a network connection or between system processes where there is an opportunity deploy a tool that will intercept and change information. The type of modification and the impact it will have depends on the target transmission mechanism as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.</p>

KEV CVEs mapped to this technique · CTID Mappings Explorer

None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.

Detection strategy · ATT&CK Enterprise v19.2

DET0254 Detection Strategy of Transmitted Data Manipulation v1.0
AN0702 Windows
Monitor for anomalies in transmitted data streams, including mismatched file integrity checks, API interception, or man-in-the-middle modifications. Detect unexpected use of APIs that handle network I/O where transmitted data integrity could be manipulated.

WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation
WinEventLog:Sysmon EventCode=15 → DC0059 File Metadata

Tunable: IntegrityBaseline MonitoredPorts

AN0703 Linux
Detect alterations of transmitted data via monitoring syscalls (send, recv, write) or middleware interception. Identify mismatched file hashes when compared at origin vs. destination. Watch for anomalous activity from processes interacting with secure transmission services (e.g., OpenSSL, scp).

auditd:SYSCALL send, recv, write: Abnormal interception or alteration of transmitted data → DC0021 OS API Execution
linux:syslog Integrity mismatch warnings or malformed packets detected → DC0085 Network Traffic Content

Tunable: WatchedProcesses HashCheckInterval

AN0704 macOS
Monitor system APIs such as CFNetwork and SecureTransport for anomalies in transmitted data streams. Detect mismatches in file hashes or SSL/TLS downgrade attempts that enable manipulation of transmitted data.

macos:unifiedlog Suspicious anomalies in transmitted data integrity during application network operations → DC0078 Network Traffic Flow
macos:osquery CALCULATE: Integrity validation of transmitted data via hash checks → DC0021 OS API Execution

Tunable: TLSValidationRules AllowedApps

Sigma rules · SigmaHQ da9bb07d64, tag `attack.t1565.002`

Cisco Modify Configuration mediumtest

Author: Austin Clark · 2019-08-12 (modified 2025-04-28) · logsource: product=cisco service=aaa · 671ffc77-50a7-464f-9e3d-9ea2b493b26b

Modifications to a config that will serve an adversary's impacts or persistence

ISATAP Router Address Was Set mediumexperimental

Author: hamid · 2025-10-19 · logsource: product=windows service=system · d22df9cd-2aee-4089-93c7-9dc4eae77f2c

Detects the configuration of a new ISATAP router on a Windows host. While ISATAP is a legitimate Microsoft technology for IPv6 transition, unexpected or unauthorized ISATAP router configurations could indicate a potential IPv6 DNS Takeover attack using tools like mitm6. In such attacks, adversaries advertise themselves as DHCPv6 servers and set malicious ISATAP routers to intercept traffic. This detection should be correlated with network baselines and known legitimate ISATAP deployments in your environment.

Techniques: T1557 T1565.002

Rules tagged at the parent level (attack.t1565) 3

These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.

AWS EC2 Disable EBS Encryption mediumstable

Author: Sittikorn S · 2021-06-29 (modified 2021-08-20) · logsource: product=aws service=cloudtrail · 16124c2d-e40b-4fcc-8f2c-5ab7870a2223

Identifies disabling of default Amazon Elastic Block Store (EBS) encryption in the current region. Disabling default encryption does not change the encryption status of your existing volumes.

Techniques: T1486 T1565

Google Cloud Re-identifies Sensitive Information mediumtest

Author: Austin Songer @austinsonger · 2021-08-15 (modified 2022-10-09) · logsource: product=gcp service=gcp.audit · 234f9f48-904b-4736-a34c-55d23919e4b7

Identifies when sensitive information is re-identified in google Cloud.

Techniques: T1565

Powershell Add Name Resolution Policy Table Rule hightest

Author: Borna Talebi · 2021-09-14 (modified 2022-10-09) · logsource: product=windows category=ps_script · 4368354e-1797-463c-bc39-a309effbe8d7

Detects powershell scripts that adds a Name Resolution Policy Table (NRPT) rule for the specified namespace. This will bypass the default DNS server and uses a specified server for answering the query.