T1565.003 — Runtime Data Manipulation

Tactic: Impact · Platforms: Linux, macOS, Windows

Adversaries may modify systems in order to manipulate the data as it is accessed and displayed to an end user, thus threatening the integrity of the data. By manipulating runtime data, adversaries may attempt to affect a business process, organizational understanding, and decision making.…

Sub-technique of Data Manipulation (T1565).

Sigma detection rules (3)

T1565.003 Data Manipulation: Runtime Data Manipulation

title: "T1565.003 Data Manipulation: Runtime Data Manipulation"
id: ff6344eb-2420-4fd0-96c0-7e28db259024
description: 'Detection Strategy for Runtime Data Manipulation - creation/overwrite of executable and library files in application install directories, consistent with binary tampering used to alter data as displayed to users. (Data Component: File Creation; baseline tier: windows-eventid.) Tune using: MonitoredPaths, HashBaseline.'
references:
  - https://attack.mitre.org/techniques/T1565/003
author: Shahrukh Khan
date: 2026-06-17
license: MIT
tags:
  - attack.impact
  - attack.t1565.003

logsource:
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '11'
    TargetFilename|endswith:
      - '.exe'
      - '.dll'
      - '.ocx'
      - '.sys'
  selection_install_path:
    TargetFilename|contains:
      - '\Program Files\'
      - '\Program Files (x86)\'
      - '\Windows\System32\'
      - '\Windows\SysWOW64\'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and selection_install_path and not filter_system_account

falsepositives:
  - System and service accounts (SYSTEM, LOCAL SERVICE, NETWORK SERVICE) performing the same action are excluded via filter_system_account; legitimate software installers/updaters writing to these paths; tune further with process/path allowlists if noise remains.

level: medium

T1565.003 Data Manipulation: Runtime Data Manipulation

title: "T1565.003 Data Manipulation: Runtime Data Manipulation"
id: 1404e8c6-6e34-4438-b8da-88eee6d83b4c
description: 'Detection Strategy for binary-overwrite as a Linux-observable proxy for Runtime Data Manipulation. (perm: WRITE is not a real auditd PATH field - PATH records expose nametype/mode/inode, not an access-mode flag - so the previous condition could never match. Retargeted to the syscalls actually used to modify a binary in place: open/openat/rename correlated against a PATH record for the same audit event, both of which auditd genuinely exposes.) Tune using: WatchedBinaries, IntegrityCheckFrequency.'
references:
  - https://attack.mitre.org/techniques/T1565/003
author: Shahrukh Khan
date: 2026-01-22
license: MIT
tags:
  - attack.impact
  - attack.t1565.003

logsource:
  category: file_change
  product: linux
  service: auditd

detection:
  selection:
    type: PATH
    nametype: NORMAL
    name|contains:
      - '/usr/bin/'
      - '/usr/sbin/'
      - '/bin/'
    syscall:
      - open
      - openat
      - rename

  condition: selection

falsepositives:
  - Package upgrades (apt/yum/dpkg) legitimately overwrite binaries in these paths; correlate with the parent process being a package manager to suppress, and use IntegrityCheckFrequency hash comparisons for confirmation.

level: high

T1565.003 Data Manipulation: Runtime Data Manipulation

title: "T1565.003 Data Manipulation: Runtime Data Manipulation"
id: 6e9f482f-d676-4f27-87f9-c4856c11d682
description: 'Detection Strategy for Runtime Data Manipulation.. (Retargeted to the process_access macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: AllowedApps, SignatureEnforcement.'
references:
  - https://attack.mitre.org/techniques/T1565/003
author: Shahrukh Khan
date: 2026-04-01
license: MIT
tags:
  - attack.impact
  - attack.t1565.003

logsource:
  category: process_access
  product: macos

detection:
  selection:
    TargetImage|endswith:
      - '/Finder.app/Contents/MacOS/Finder'
      - '/loginwindow'
  filter_apple:
    SourceImage|startswith: '/System/Library/'

  condition: selection and not filter_apple

falsepositives:
  - Runtime memory patching of a running process to manipulate its data is only visible as a generic process_access event; unified log does not expose the actual memory region written or its content, so this indicator is inherently ambiguous.

level: high

Related sub-techniques

Explore