T1565.001 Stored Data Manipulation — Detection Rules

Source-backed rule directory

• Azure Device or Configuration Modified or Deleted · test · medium · {"product":"azure","service":"activitylogs"}
• Azure DNS Zone Modified or Deleted · test · medium · {"product":"azure","service":"activitylogs"}
• Commands to Clear or Remove the Syslog - Builtin · test · high · {"product":"linux"}
• History File Deletion · test · high · {"category":"process_creation","product":"linux"}
• Potential Suspicious Change To Sensitive/Critical Files · test · medium · {"category":"process_creation","product":"linux"}
• Cisco Denial of Service · test · medium · {"product":"cisco","service":"aaa"}

Atlas deterministic concepts

No exact concept selected.

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0193 Detection Strategy for Stored Data Manipulation across OS Platforms.

AN0555 Analytic 0555

Identify unauthorized creation, deletion, or modification of business-critical stored data such as Office documents, database files, and log archives. Detect anomalous processes modifying stored data outside of expected workflows (e.g., non-database processes modifying database files).

AN0556 Analytic 0556

Detect suspicious file creation, modification, or deletion in stored data directories (e.g., `/var/lib/mysql/`, `/var/log/`, mail spools). Identify shell commands interacting directly with structured data files instead of legitimate database utilities.

AN0557 Analytic 0557

Monitor sensitive data files such as plist-based storage, mail archives, or Office files for unexpected modifications. Detect anomalous processes modifying stored data outside expected update cycles using FSEvents and Unified Logs.