T1565: Data Manipulation
Adversaries may insert, delete, or manipulate data in order to influence external outcomes or hide activity, thus threatening the integrity of the data.[1] By manipulating data, adversaries may attempt to affect a business process, organizational understanding, or decision making.
The type of modification and the impact it will have depends on the target application and process as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.
Analyst context for executives and security teams
Data Manipulation is an integrity-focused impact technique: the risk is not just data theft, but adversaries changing, deleting, or inserting data so business processes, reports, customer records, financial decisions, or investigations become unreliable. For leaders, the key question is whether critical decisions depend on data that can be altered without rapid detection or independent validation.
Executive priority
Prioritize this where inaccurate data could disrupt operations, financial reporting, customer trust, legal evidence, or incident response. The supplied ATT&CK context highlights that manipulation may target stored data, transmitted data, or runtime presentation of data, so control ownership often spans application teams, infrastructure, IAM, network security, SOC, and audit/compliance. Executives should ask which high-value systems have integrity monitoring, least-privilege write access, off-host logging, segmentation, and recoverable trusted records.
Technical view
ATT&CK lists Linux, macOS, and Windows for this technique under Impact. No official detection text is provided, but the relationship set includes DET0059, Detection Strategy for Data Manipulation, and sub-techniques for stored, transmitted, and runtime manipulation. SOC and IR teams should validate whether they can distinguish authorized business changes from suspicious insert, delete, or modification activity in sensitive files, databases, stored emails, custom file formats, network-transmitted data, inter-process data paths, and application binaries or components that affect what users see.
Likely telemetry
- File and directory write, delete, rename, ownership, and permission-change events on sensitive paths
- Database, application, and transaction audit logs for critical business records
- Centralized or remote log storage showing whether local evidence was altered or missing
- Network telemetry for data movement between systems where transmitted manipulation could occur
- Process execution, application binary integrity, and endpoint security events on Linux, macOS, and Windows
Detection direction
- Because ATT&CK provides no official detection procedure, validate local detections against the three related sub-technique areas: stored, transmitted, and runtime data manipulation.
- Tune for unauthorized or unusual changes to high-value data stores, application files, and display/runtime components, while accounting for legitimate batch jobs, maintenance windows, and application releases.
- Correlate data changes with user, service account, process, host, and change-ticket context to reduce false positives and expose unapproved modifications.
- Confirm that logs needed to investigate manipulation are forwarded off-host or otherwise protected from tampering.
- Use relationship context conservatively: FIN13 and PHASEJAM are linked as users of this technique in ATT&CK, but local detections should be behavior-based rather than assuming a specific actor or tool.
Mitigation priorities
- Start with least privilege using Restrict File and Directory Permissions (M1022), especially removing unnecessary write permissions on sensitive files and directories.
- Protect investigative evidence and critical records with Remote Data Storage (M1029), including centralized log management or other off-host storage where appropriate.
- Use Network Segmentation (M1030) to limit which systems and applications can reach or modify critical data paths.
- Apply Encrypt Sensitive Information (M1041) where it supports confidentiality and integrity protection for sensitive information at rest, in transit, or during processing.
- For critical business processes, pair technical controls with approval workflows and reconciliation so manipulation attempts are more likely to be noticed before decisions are made from corrupted data.
Analyst notes and limits
This technique is broad and impact-oriented. The practical defensive value comes from mapping it to specific business processes and deciding which data must be trustworthy, who can modify it, how changes are logged, and how integrity is independently verified. Complex systems may require specialized knowledge to manipulate effectively, which also means defenders should involve application owners and process owners during detection design and incident response.
The official ATT&CK object does not provide detection guidance, and the supplied DET0059 relationship does not include detailed detection logic. Telemetry and control recommendations therefore need local validation against the organization’s applications, data flows, operating systems, and business-critical records. No claim is made here about active exploitation or guaranteed detection coverage.
Data Manipulation
Adversaries may insert, delete, or manipulate data in order to influence external outcomes or hide activity, thus threatening the integrity of the data.[1] By manipulating data, adversaries may attempt to affect a business process, organizational understanding, or decision making.
The type of modification and the impact it will have depends on the target application and process as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Related techniques
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1565.002 | Transmitted Data Manipulation Sub-technique | Transmitted Data Manipulation subtechnique of this object. |
| Enterprise | T1565.003 | Runtime Data Manipulation Sub-technique | Runtime Data Manipulation subtechnique of this object. |
| Enterprise | T1565.001 | Stored Data Manipulation Sub-technique | Stored Data Manipulation subtechnique of this object. |
Groups, software, and campaigns
G1016: FIN13
S9014: PHASEJAM
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.1 | Current bundle | 155fceb877ce… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
Sygnia Elephant Beetle Jan 2022
Sygnia Incident Response Team. (2022, January 5). TG2003: ELEPHANT BEETLE UNCOVERING AN ORGANIZED FINANCIAL-THEFT OPERATION. Retrieved February 9, 2023.
Open source URL -
[2]
mitre-attack T1565Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.