Applied Cybernetics Group
T1565 Data Manipulation
- Technique
T1565- Tactics
- Impact
- Research, 90 days
- 1
- KEV CVEs mapped
- 2
- SigmaHQ rules
- 3
- Elastic, Splunk
- 19
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1565
MITRE description
Adversaries may insert, delete, or manipulate data in order to influence external outcomes or hide activity, thus threatening the integrity of the data.(Citation: Sygnia Elephant Beetle Jan 2022) By manipulating data, adversaries may attempt to affect a business process, organizational understanding, or decision making. The type of modification and the impact it will have depends on the target application and process as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.
KEV CVEs mapped to this technique
MITRE CTID maps these KEV CVEs to this technique by hand. They are the actively exploited vulnerabilities behind this technique's KEV signal.
Research citing this technique
Reports and advisories from the last 90 days that cite this technique.
-
2026-10-14Group-IB: KGB RAT: A Fully Undetectable Windows Trojan Built to Spy, Steal, and Terrorize
Detection coverage
SigmaHQ community rules
- AWS EC2 Disable EBS Encryption (core)
- Google Cloud Re-identifies Sensitive Information (core)
- Powershell Add Name Resolution Policy Table Rule (core)
Elastic and Splunk rules
- Agent Spoofing - Multiple Hosts Using Same Agent (elastic)
- Hosts File Modified (elastic)
- AWS S3 Unauthenticated Bucket Access by Rare Source (elastic)
- AWS Bedrock Knowledge Base or RAG Data Source Tampering (elastic)
- AWS CloudTrail Log Updated (elastic)
- AWS EC2 Encryption Disabled (elastic)
- AWS EKS CoreDNS or Kube-DNS Configuration Modified (elastic)
- Potential AWS S3 Bucket Ransomware Note Uploaded (elastic)
- AWS S3 Static Site JavaScript File Uploaded (elastic)
- GKE CoreDNS or Kube-DNS Configuration Modified (elastic)
- High Number of Closed Pull Requests by User (elastic)
- Several Failed Protected Branch Force Pushes by User (elastic)
- High Number of Protected Branch Force Pushes by User (elastic)
- GitHub Actions Unusual Bot Push to Repository (elastic)
- Kubernetes Secret or ConfigMap Access via Azure Arc Proxy (elastic)
- Kubernetes CoreDNS or Kube-DNS Configuration Modified (elastic)
- Deprecated - M365 Security Compliance Potential Ransomware Activity (elastic)
- First Time Seen Memcached Writer (elastic)
- Suspicious Sysctl File Event (elastic)