Imagine the database is correct and the report on screen is not. MITRE T1565.003, Runtime Data Manipulation, is about changing data as it is accessed and displayed to a user. It sits under the impact tactic and applies to Linux, macOS and Windows.
How attackers use it
Adversaries modify systems so the data a user sees is altered, which threatens integrity and can steer a business process or decision. MITRE says they may alter application binaries used to display data. They may also use Change Default File Association and Masquerading to get a similar effect. As with other data manipulation, the adversary usually needs special expertise and prior information gathering.
How to detect it
MITRE's analytics focus on the integrity of the thing doing the displaying:
- Windows: suspicious changes to application binaries, API hooking, unexpected behavior from processes that render data, and binary hash mismatches, correlated with registry edits and process creation.
- Linux: modifications to shared libraries, ELF binaries or environment variables that affect display, writes to application directories and mismatches against integrity baselines.
- macOS: changes in application bundles, unexpected signing modifications and runtime API calls that inject or alter how data is displayed, including in CFNetwork or CoreFoundation frameworks.
The common thread is a baseline. Without known-good hashes or signatures for your key applications you have nothing to compare against.
How to reduce the risk
MITRE lists two mitigations:
- Network Segmentation: identify the critical business and system processes adversaries may target and isolate them.
- Restrict File and Directory Permissions: prevent critical processes from being replaced, overwritten or reconfigured to load malicious code.
If you build or ship the applications that display data, the same idea applies to your pipeline: know what went into each build and be able to verify it. A software bill of materials and build provenance give you that baseline. The free in-browser dependency scan needs no login, keeps the file on your machine and covers up to 100 dependencies, which is a quick way to see what a project actually pulls in.
Try it yourself
Click through it at your own pace, or open it full screen.
Check your own environment
- Do you keep hashes or signatures for the applications your finance, reporting and operations teams rely on?
- Who has write access to those application directories?
- Are file association changes on critical document types logged?
Quick check
Why can data be wrong on screen when the stored data is correct?
Because the application or library that displays it may have been altered, so it presents modified values at runtime.
