Most security programs are built around confidentiality: keep secrets in. Integrity gets less attention, and that is the gap MITRE T1565, Data Manipulation, describes. It sits under the impact tactic and applies to Linux, macOS and Windows.
What it is
Adversaries may insert, delete or manipulate data to influence outside outcomes or hide their activity, threatening the integrity of the data. By changing data, they may try to affect a business process, the organization's understanding of events, or decision making.
MITRE adds a realistic note. In complex systems, an adversary would likely need special expertise and possibly specialized software, typically gained through a prolonged information gathering campaign. That makes this a patient technique, and it makes early detection of the information gathering phase valuable.
T1565 has three subtechniques, which have their own guides: stored data manipulation (T1565.001), transmitted data manipulation (T1565.002) and runtime data manipulation (T1565.003). The difference is where the change happens: at rest, in motion, or at the moment of display.
How attackers use it
The parent technique is deliberately general. The effect depends on the target application and process, so MITRE gives no single procedure. Think of the outcomes instead:
- Financial or operational records that no longer match reality.
- Logs and audit data that no longer tell the real story.
- Records that people rely on to make a decision, now subtly wrong.
The damage is often found late, and once found, trust in all related data drops until it is rechecked.
How to detect it
MITRE's analytics look for changes that do not fit a business process:
- Windows: unauthorized or abnormal file modifications, deletions or metadata changes, correlated with suspicious process execution or API calls, particularly in structured data like databases, logs and financial records outside expected business activity.
- Linux: unauthorized changes to logs, database entries or configuration files, seen through auditd and syslog, along with shell commands that alter
HISTFILEor data-related processes and abnormal file access patterns. - macOS: manipulation of system or application files in
/Library,/Systemor user data directories, seen through FSEvents and Unified Logs, with anomalous processes modifying plist files, structured data or logs outside update cycles.
Two ideas make these workable. First, know who is allowed to change each dataset, which is a short list for most valuable data. Second, record changes in a place the writer cannot edit, because an attacker who can alter data may try to alter the log of the alteration.
How to reduce the risk
MITRE lists four mitigations.
- Encrypt Sensitive Information. Encryption reduces an adversary's ability to perform tailored modifications. Encrypting data in storage and in transit makes it harder to change meaningfully without the keys.
- Remote Data Storage. Have an IT disaster recovery plan with regular backups of organizational data. Store backups off the system, and protect them from the methods adversaries use to reach and manipulate them. A backup that production credentials can overwrite is not a safe backup.
- Network Segmentation. Identify the business and system processes adversaries would want to tamper with, and isolate and secure those systems against unauthorized access.
- Restrict File and Directory Permissions. Apply least privilege to important information resources.
Check your own environment
A short exercise that pays off:
- Name your top ten datasets by consequence of silent change, such as ledgers, pricing tables, configuration of safety systems, customer entitlements and audit logs.
- For each, list who and what can write to it. Include service accounts and scheduled jobs.
- Note whether a change would be noticed, how, and how soon.
- Confirm that you can restore a known-good version and have tested it in the last year.
- Check where integrity matters in transit, such as data feeds from partners, and whether those feeds carry a checksum or signature.
On Linux, a read-only starting point for who touched a file is the audit log, if auditd has a watch on the path:
ausearch -f /path/to/important/file -i
If nothing comes back, you probably have no watch set, which is itself the finding.
Where it connects to other techniques
Because the goal is influence, data manipulation often follows access techniques covered elsewhere in this series: valid accounts, remote services and lateral movement. If you see stored data change after an unusual login, treat it as one incident. Likewise, MITRE notes in the runtime subtechnique that adversaries may combine file association changes or masquerading with altered applications.
Quick check
Why is data manipulation hard to notice?
The data is still present and the systems still work, so nothing looks broken. The change only shows up when someone compares it with a trusted source.
Which mitigation protects you after a successful manipulation?
Remote data storage: regular backups kept off the system and protected from tampering, so you can restore known-good data.
What distinguishes the three subtechniques?
Where the change happens: stored data at rest, transmitted data in motion, and runtime data at the time it is displayed.
