Most data theft stories are about copying. MITRE T1565.001, Stored Data Manipulation, is about changing. It sits under the impact tactic and applies to Linux, macOS and Windows.
How attackers use it
Adversaries may insert, delete or manipulate data at rest to influence outside outcomes or hide activity, which threatens the data's integrity. The aim can be to affect a business process, organizational understanding or decision making.
MITRE says stored data could be Office files, databases, stored emails or custom file formats. The impact depends on the data, and for complex systems the adversary typically needs special expertise and software, usually gained through a prolonged information gathering campaign.
How to detect it
The common signal is the wrong process touching important data:
- Windows: unauthorized creation, deletion or modification of business-critical data such as Office documents, database files and log archives, and non-database processes modifying database files.
- Linux: suspicious changes in data directories such as
/var/lib/mysql/,/var/log/and mail spools, and shell commands that work on structured data files directly instead of using proper database utilities. - macOS: unexpected changes to plist-based storage, mail archives or Office files, outside normal update cycles, using FSEvents and Unified Logs.
File integrity monitoring on a short list of crown-jewel paths does most of the work.
How to reduce the risk
MITRE lists three mitigations:
- Restrict File and Directory Permissions: apply least privilege to important information resources.
- Remote Data Storage: keep regular backups, stored off the system and protected from the methods adversaries use to reach and manipulate backups, as part of an IT disaster recovery plan.
- Encrypt Sensitive Information: encryption reduces an adversary's ability to make tailored changes.
Backups only help if you can tell which version is clean, so keep several generations and test restores.
Check your own environment
- List the five datasets whose silent corruption would hurt most.
- For each, who and what can write to it, and is that list minimal?
- Is there file or row change auditing on them?
- Is the latest backup stored somewhere the production credentials cannot modify?
Quick check
Which process behavior is a red flag for stored data?
A process that is not the expected application or database engine modifying database files or business documents.
