T1565 Data Manipulation — Detection Rules

Detection workspace for T1565 Data Manipulation: 3 Sigma sources, 1 Atlas concepts and 0 anomaly models. No live detection validation.

Source-backed rule directory

AWS EC2 Disable EBS Encryption · stable · medium · {"product":"aws","service":"cloudtrail"}
Google Cloud Re-identifies Sensitive Information · test · medium · {"product":"gcp","service":"gcp.audit"}
Powershell Add Name Resolution Policy Table Rule · test · high · {"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"}

Atlas deterministic concepts

T1565 Data Manipulation

Published pseudocode, not an executable rule

MATCH(update_or_delete_on_protected_record) AND actor NOT_IN approved_writers -> ALERT

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0059 Detection Strategy for Data Manipulation

AN0162 Analytic 0162

Correlate unauthorized or anomalous file modifications, deletions, or metadata changes with suspicious process execution or API calls. Detect abnormal changes to structured data (e.g., database files, logs, financial records) outside expected business process activity.

AN0163 Analytic 0163

Detect unauthorized manipulation of log files, database entries, or system configuration files through auditd and syslog. Correlate shell commands that alter HISTFILE or data-related processes with abnormal file access patterns.

AN0164 Analytic 0164

Detect manipulation of system or application files in `/Library`, `/System`, or user data directories using FSEvents and Unified Logs. Identify anomalous process execution modifying plist files, structured data, or logs outside expected update cycles.

Connected ecosystem references

Linked tags

rule_source_available

Simulation, tools and telemetry

T1565 simulation workspace

No reviewed association in this snapshot.

Threat actor context

These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.

FIN13 · G1016

Existing anomaly research

Original publication snapshot · Anomaly Detection Atlas

Complete technique engineering workbook

Collection configuration and event examples · Anomaly models and design worksheet · Tools and documented software · Simulation procedures · Offline synthetic collection check

Exact source tags are not semantic relevance verdicts. Review actual rule conditions and observation points; imported rules are not backend-compiled or live-validated.

Pinned research references. No browser attack runner or production-validated detector is asserted. Imported procedures remain unvalidated; any bounded lab evidence has its own scope. ATT&CK / Atomic provenance · Detection provenance.