T1565: Data Manipulation

Adversaries may insert, delete, or manipulate data in order to influence external outcomes or hide activity, thus threatening the integrity of the data. By manipulating data, adversaries may attempt to affect a business process, organizational understanding, or decision making.

The type of modification and the impact it will have depends on the target application and process as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.

Positive Technologies products that cover the technique

MaxPatrol SIEM knowledge base

Subtechniques

Detection

ID	DS0009	Data source and component	Process: OS API Execution	Description	Monitor for API calls associated with altering data. Remote access tools with built-in features may interact directly with the Windows API to gather information.

ID	DS0029	Data source and component	Network Traffic: Network Traffic Content	Description	Monitor for networks that solicits and obtains the configuration information of the queried device.

ID	DS0022	Data source and component	File: File Creation	Description	Monitor for newly constructed files in order to manipulate external outcomes or hide activity

ID	DS0029	Data source and component	Network Traffic: Network Traffic Flow	Description	Monitor for network traffic originating from unknown/unexpected hardware devices.

ID	DS0022	Data source and component	File: File Deletion	Description	Monitor for unexpected deletion of a file in order to manipulate external outcomes or hide activity

ID	DS0022	Data source and component	File: File Modification	Description	Monitor for unexpected files with manipulated data in order to manipulate external outcomes or hide activity

ID	DS0022	Data source and component	File: File Metadata	Description	Monitor for contextual data about a file, which may include information such as name, the content (ex: signature, headers, or data/media), user/owner, permissions, etc that would aid in the manipulation of data to hide activity

ID	Data source and component	Description
DS0009	Process: OS API Execution	Monitor for API calls associated with altering data. Remote access tools with built-in features may interact directly with the Windows API to gather information.
DS0029	Network Traffic: Network Traffic Content	Monitor for networks that solicits and obtains the configuration information of the queried device.
DS0022	File: File Creation	Monitor for newly constructed files in order to manipulate external outcomes or hide activity
DS0029	Network Traffic: Network Traffic Flow	Monitor for network traffic originating from unknown/unexpected hardware devices.
DS0022	File: File Deletion	Monitor for unexpected deletion of a file in order to manipulate external outcomes or hide activity
DS0022	File: File Modification	Monitor for unexpected files with manipulated data in order to manipulate external outcomes or hide activity
DS0022	File: File Metadata	Monitor for contextual data about a file, which may include information such as name, the content (ex: signature, headers, or data/media), user/owner, permissions, etc that would aid in the manipulation of data to hide activity

Mitigation

ID	M1041	Name	Encrypt Sensitive Information	Description	Consider encrypting important information to reduce an adversary’s ability to perform tailored data modifications.

ID	M1029	Name	Remote Data Storage	Description	Consider implementing IT disaster recovery plans that contain procedures for taking regular data backups that can be used to restore organizational data. Ensure backups are stored off system and is protected from common methods adversaries may use to gain access and manipulate backups.

ID	M1030	Name	Network Segmentation	Description	Identify critical business and system processes that may be targeted by adversaries and work to isolate and secure those systems against unauthorized access and tampering.

ID	M1022	Name	Restrict File and Directory Permissions	Description	Ensure least privilege principles are applied to important information resources to reduce exposure to data manipulation risk.

ID	Name	Description
M1041	Encrypt Sensitive Information	Consider encrypting important information to reduce an adversary’s ability to perform tailored data modifications.
M1029	Remote Data Storage	Consider implementing IT disaster recovery plans that contain procedures for taking regular data backups that can be used to restore organizational data. Ensure backups are stored off system and is protected from common methods adversaries may use to gain access and manipulate backups.
M1030	Network Segmentation	Identify critical business and system processes that may be targeted by adversaries and work to isolate and secure those systems against unauthorized access and tampering.
M1022	Restrict File and Directory Permissions	Ensure least privilege principles are applied to important information resources to reduce exposure to data manipulation risk.