T1565 Data Manipulation
Adversaries may insert, delete, or manipulate data in order to influence external outcomes or hide activity, thus threatening the integrity of the data.(Citation: Sygnia Elephant Beetle Jan 2022) By manipulating data, adversaries may attempt to affect a business process, organizational understanding, or decision making. The type of modification and the impact it will have depends on the target…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- Commands to Clear or Remove the Syslog - Builtinhightest · linux
- History File Deletionhightest · linux
- Powershell Add Name Resolution Policy Table Rulehightest · windows
- AWS EC2 Disable EBS Encryptionmediumstable · aws
- Azure DNS Zone Modified or Deletedmediumtest · azure
- Azure Device or Configuration Modified or Deletedmediumtest · azure
- Cisco Denial of Servicemediumtest · cisco
- Cisco Modify Configurationmediumtest · cisco
- Google Cloud Re-identifies Sensitive Informationmediumtest · gcp
- Potential Suspicious Change To Sensitive/Critical Filesmediumtest · linux
- ISATAP Router Address Was Setmediumexperimental · windows
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.