T1565.002 — Transmitted Data Manipulation

Tactic: Impact · Platforms: Linux, macOS, Windows

Adversaries may alter data en route to storage or other systems in order to manipulate external outcomes or hide activity, thus threatening the integrity of the data. By manipulating transmitted data, adversaries may attempt to affect a business process, organizational understanding, and decision…

Sub-technique of Data Manipulation (T1565).

Sigma detection rules (3)

T1565.002 Data Manipulation: Transmitted Data Manipulation

title: "T1565.002 Data Manipulation: Transmitted Data Manipulation"
id: ef97c99f-5dc8-4e82-afc7-7f7f0b45fc42
description: 'Detection Strategy of Transmitted Data Manipulation via known MITM/network-interception tooling establishing connections or issuing DNS queries. (Data Component: Network Connection Creation; baseline tier: windows-eventid.) Tune using: IntegrityBaseline, MonitoredPorts.'
references:
  - https://attack.mitre.org/techniques/T1565/002
author: Shahrukh Khan
date: 2026-05-15
license: MIT
tags:
  - attack.impact
  - attack.t1565.002

logsource:
  product: windows
  service: sysmon

detection:
  selection:
    EventID:
      - '3'
      - '22'
    Image|endswith:
      - '\ettercap.exe'
      - '\bettercap.exe'
      - '\mitmproxy.exe'
      - '\arpspoof.exe'
      - '\cain.exe'
      - '\responder.exe'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and not filter_system_account

falsepositives:
  - System and service accounts (SYSTEM, LOCAL SERVICE, NETWORK SERVICE) performing the same action are excluded via filter_system_account; tune further with process/path allowlists if noise remains.

level: medium

T1565.002 Data Manipulation: Transmitted Data Manipulation

title: "T1565.002 Data Manipulation: Transmitted Data Manipulation"
id: 6bac15bc-1bde-4900-bf0b-1d55b9939d8f
description: 'Detection Strategy of Transmitted Data Manipulation. Broadened beyond ettercap/bettercap to also cover arpspoof, dnsspoof, and mitmproxy/mitmdump/mitmweb launches, which are equally common MITM tooling used to intercept and alter in-transit data. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: WatchedProcesses, HashCheckInterval.'
references:
  - https://attack.mitre.org/techniques/T1565/002
author: Shahrukh Khan
date: 2026-03-25
license: MIT
tags:
  - attack.impact
  - attack.t1565.002

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/ettercap'
      - '/bettercap'
      - '/arpspoof'
      - '/dnsspoof'
      - '/mitmproxy'
      - '/mitmdump'
      - '/mitmweb'
  condition: selection

falsepositives:
  - Transmitted data manipulation is an in-flight network MITM behavior auditd cannot observe on the wire; this only catches the attacker''s MITM tool launch, not the actual packet tampering, so hash-check correlation (tune HashCheckInterval) must come from a network sensor. Authorized network testing/QA teams running the same MITM tooling for lab traffic-shaping exercises will also match.

level: high

T1565.002 Data Manipulation: Transmitted Data Manipulation

title: "T1565.002 Data Manipulation: Transmitted Data Manipulation"
id: c07515c8-728a-4de1-b525-ff4c746b36df
description: 'Detection Strategy of Transmitted Data Manipulation. (Retargeted to the network_connection macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: TLSValidationRules, AllowedApps.'
references:
  - https://attack.mitre.org/techniques/T1565/002
author: Shahrukh Khan
date: 2026-02-17
license: MIT
tags:
  - attack.impact
  - attack.t1565.002

logsource:
  category: network_connection
  product: macos

detection:
  selection:
    Image|endswith:
      - '/curl'
      - '/nc'
    DestinationPort:
      - 80
      - 8080

  condition: selection

falsepositives:
  - Unified log network_connection events show only connection metadata, not payload content, so actual in-transit data manipulation cannot be verified from this telemetry alone; plaintext HTTP usage is also common for benign internal services.

level: low

Related sub-techniques

Explore