T1565.003: Runtime Data Manipulation
Adversaries may modify systems in order to manipulate the data as it is accessed and displayed to an end user, thus threatening the integrity of the data.[1][2] By manipulating runtime data, adversaries may attempt to affect a business process, organizational understanding, and decision making.
Adversaries may alter application binaries used to display data in order to cause runtime manipulations. Adversaries may also conduct Change Default File Association and Masquerading to cause a similar effect. The type of modification and the impact it will have depends on the target application and process as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.
Analyst context for executives and security teams
Runtime Data Manipulation is an integrity risk: an adversary may change how data is presented to users while it is being accessed, causing people or business processes to make decisions from misleading information. For leaders, the material issue is not only data theft or outage, but whether trusted applications, reports, or operational views can be made untrustworthy on Linux, macOS, or Windows systems.
Executive priority
Prioritize this technique where business decisions, financial processes, operational workflows, or compliance evidence depend on the accuracy of displayed application data. Executives should ask which critical applications would cause material harm if their binaries, file associations, or display paths were altered, and whether security teams can prove integrity controls and monitoring around those systems. This is especially relevant to incident decision-making because manipulated runtime views can delay recognition of the real state of the environment.
Technical view
ATT&CK places this sub-technique under Data Manipulation for the Impact tactic. The supplied description highlights alteration of application binaries used to display data, and related techniques such as Change Default File Association and Masquerading that can produce similar effects. SOC and IR teams should validate monitoring for unauthorized changes to application files, executable paths, file associations, and suspicious masquerading around applications that present high-value data. Because MITRE provides no official detection text here, local engineering must define baselines for critical applications and use the related DET0391 detection strategy as a starting point rather than assuming coverage.
Likely telemetry
- File integrity and file modification events for application binaries and directories
- File and directory permission and ownership changes
- Process execution telemetry showing unexpected application paths, names, or parent-child relationships
- Operating system events related to default file association changes
- Endpoint detection telemetry for masquerading-like behavior on Linux, macOS, and Windows
Detection direction
- Inventory applications and systems where displayed data directly influences business decisions or operational actions, then prioritize integrity monitoring around those assets.
- Tune detections for unauthorized modification of application binaries, unexpected executable replacement, and suspicious file association changes.
- Correlate endpoint file-change events with process execution so teams can distinguish dormant tampering from tampered applications actually being run.
- Account for false positives from legitimate software updates, packaging tools, administrative maintenance, and approved application migrations.
- Review coverage for masquerading-like conditions because a visually similar or renamed application may cause users to trust manipulated output.
Mitigation priorities
- Restrict file and directory permissions on sensitive application files, directories, and supporting components so unnecessary write access is removed.
- Apply least privilege to users, groups, and processes that can modify applications involved in high-value data display or decision workflows.
- Use network segmentation to reduce exposure of critical systems and limit paths an adversary could use to reach or manipulate them.
- Align integrity controls with change management so defenders can quickly separate approved modifications from suspicious runtime manipulation risk.
- For complex or specialized systems, identify where specialized software and administrative knowledge create concentration of risk, then review access paths and monitoring depth.
Analyst notes and limits
This object is a sub-technique of T1565 Data Manipulation and is associated with the Impact tactic. The official description emphasizes that adversaries may manipulate data as accessed and displayed to end users, including by altering application binaries, and that complex systems may require specialized knowledge obtained through prolonged information gathering. Relationship context also shows mitigations M1022 Restrict File and Directory Permissions and M1030 Network Segmentation, plus a related detection strategy DET0391.
MITRE did not provide official detection content for this object in the supplied fields. The take therefore focuses on conservative validation areas derived from the description, platforms, tactics, and relationships. Actual priority and detection feasibility depend on local application criticality, endpoint telemetry, change management quality, and whether critical display paths are known and monitored.
Runtime Data Manipulation
Adversaries may modify systems in order to manipulate the data as it is accessed and displayed to an end user, thus threatening the integrity of the data.[1][2] By manipulating runtime data, adversaries may attempt to affect a business process, organizational understanding, and decision making.
Adversaries may alter application binaries used to display data in order to cause runtime manipulations. Adversaries may also conduct Change Default File Association and Masquerading to cause a similar effect. The type of modification and the impact it will have depends on the target application and process as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Related techniques
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1565 | Data Manipulation | This object subtechnique of Data Manipulation. |
| Enterprise | T1494 | Runtime Data Manipulation | Runtime Data Manipulation revoked by this object. |
Groups, software, and campaigns
G0082: APT38
APT38 is a North Korean state-sponsored threat group that specializes in financial cyber operations; it has been attributed to the Reconnaissance General Bureau.[1] Active since at least 2014, APT38 has targeted banks, financial institutions, casinos, cryptocurrency exchanges, SWIFT system endpoints, and ATMs in at least 38 countries worldwide. Significant operations include the 2016 Bank of Bangladesh heist, during which APT38 stole $81 million, as well as attacks against Bancomext [2] and Banco de Chile [2]; some of their attacks have been destructive.[1][2][3][4]
North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters or subgroups.
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.2 | Current bundle | 977758e10b6f… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
FireEye APT38 Oct 2018
FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024.
Open source URL -
[2]
DOJ Lazarus Sony 2018
Department of Justice. (2018, September 6). Criminal Complaint - United States of America v. PARK JIN HYOK. Retrieved March 29, 2019.
Open source URL -
[3]
mitre-attack T1565.003Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.