T1565.001 — Stored Data Manipulation

Tactic: Impact · Platforms: Linux, macOS, Windows

Adversaries may insert, delete, or manipulate data at rest in order to influence external outcomes or hide activity, thus threatening the integrity of the data. By manipulating stored data, adversaries may attempt to affect a business process, organizational understanding, and decision making.…

Sub-technique of Data Manipulation (T1565).

Sigma detection rules (3)

T1565.001 Data Manipulation: Stored Data Manipulation

title: "T1565.001 Data Manipulation: Stored Data Manipulation"
id: d13e7960-abfe-4093-9e9b-7288bd986fdd
description: 'Detects business-data files (documents, databases, mail stores) being written by processes other than their normal owning application, a proxy for out-of-band stored-data manipulation intended to affect business processes or hide activity. (Data Component: File Creation.) Tune using: MonitoredExtensions, TrustedProcessList, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1565/001
author: Shahrukh Khan
date: 2026-02-20
license: MIT
tags:
  - attack.impact
  - attack.t1565.001

logsource:
  category: file_event
  product: windows

detection:
  selection:
    EventID: 11
    TargetFilename|endswith:
      - '.docx'
      - '.xlsx'
      - '.pptx'
      - '.pdf'
      - '.mdb'
      - '.accdb'
      - '.pst'
      - '.ost'
      - '.dbf'
      - '.sql'
      - '.bak'

  filter_office_and_db_processes:
    Image|endswith:
      - '\WINWORD.EXE'
      - '\EXCEL.EXE'
      - '\POWERPNT.EXE'
      - '\OUTLOOK.EXE'
      - '\MSACCESS.EXE'
      - '\sqlservr.exe'
      - '\sqlceip.exe'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and not 1 of filter_*

falsepositives:
  - Backup, sync, or migration tools legitimately rewriting business-data files; add their process paths to filter_office_and_db_processes.

level: medium

T1565.001 Data Manipulation: Stored Data Manipulation

title: "T1565.001 Data Manipulation: Stored Data Manipulation"
id: a9e0ddef-4ecd-48c4-beb6-42960c92e0e7
description: 'Detection Strategy for Stored Data Manipulation across OS Platforms. The previous version flagged any file CREATE under /var/www/html/ or /var/lib/mysql/, which is indistinguishable from ordinary CMS/application deployment or normal database writes, as the rule''s own falsepositives note admitted. Retargeted to scope out writes performed by the expected serving/DB-engine process: a file CREATE/NORMAL event under these paths is only flagged when the writing process (exe) is NOT one of the web server or database engine binaries that legitimately own that data, a much stronger indicator of direct, out-of-band tampering (e.g. an attacker editing site files or DB files with a text editor, or overwriting via rsync/scp, bypassing the application layer entirely). Tune using: WatchedPaths, CommandExclusions.'
references:
  - https://attack.mitre.org/techniques/T1565/001
author: Shahrukh Khan
date: 2026-06-28
license: MIT
tags:
  - attack.impact
  - attack.t1565.001

logsource:
  category: file_change
  product: linux
  service: auditd

detection:
  selection_write:
    type: PATH
    nametype:
      - CREATE
      - NORMAL
    name|contains:
      - '/var/www/html/'
      - '/var/lib/mysql/'
  filter_expected_web_process:
    exe|endswith:
      - '/httpd'
      - '/apache2'
      - '/nginx'
      - '/php-fpm'
  filter_expected_db_process:
    exe|endswith:
      - '/mysqld'
      - '/mariadbd'

  condition: selection_write and not 1 of filter_*

falsepositives:
  - Admin-driven deployments/migrations run via a deploy user's shell, editor, rsync, or scp will still legitimately write under these paths from a non-server process; WatchedPaths/CommandExclusions should allowlist known deployment tooling rather than the app's serving process alone.

level: high

T1565.001 Data Manipulation: Stored Data Manipulation

title: "T1565.001 Data Manipulation: Stored Data Manipulation"
id: e50d2281-b0dd-42cb-85e7-010ad2582c06
description: 'Detection Strategy for Stored Data Manipulation across OS Platforms.. (Retargeted to the file_delete macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: FileIntegrityBaseline, AllowedEditors.'
references:
  - https://attack.mitre.org/techniques/T1565/001
author: Shahrukh Khan
date: 2026-01-08
license: MIT
tags:
  - attack.impact
  - attack.t1565.001

logsource:
  category: file_delete
  product: macos

detection:
  selection:
    TargetFilename|contains:
      - '/Library/Application Support/'
      - '/Documents/'

  condition: selection

falsepositives:
  - Normal application uninstalls and user-initiated file deletions in Documents or Application Support routinely trigger this same event pattern.

level: medium

Related sub-techniques

Explore