Esc
Stored Data Manipulation - T1565.001

(ATT&CK® Technique)
Definition

Adversaries may insert, delete, or manipulate data at rest in order to influence external outcomes or hide activity, thus threatening the integrity of the data. By manipulating stored data, adversaries may attempt to affect a business process, organizational understanding, and decision making.
D3FEND Inferred Relationships

Browse the D3FEND knowledge graph by clicking on the nodes below.
        graph LR;

     T1565001["Stored Data Manipulation"] --> |modifies| File["File"]; class T1565001 OffensiveTechniqueNode;
        class File ArtifactNode; click File href "/dao/artifact/d3f:File";
        click T1565001 href "/offensive-technique/attack/T1565.001/"; click File href "/dao/artifact/d3f:File";             FileEviction["File Eviction"] -->
          | deletes | File["File"];

          FileEviction["File Eviction"] -.->
            | may-evict | T1565001["Stored Data Manipulation"] ;
          class FileEviction DefensiveTechniqueNode;
          class File ArtifactNode;
          click FileEviction href "/technique/d3f:FileEviction"; FileEncryption["File Encryption"] -->
          | encrypts | File["File"];

          FileEncryption["File Encryption"] -.->
            | may-harden | T1565001["Stored Data Manipulation"] ;
          class FileEncryption DefensiveTechniqueNode;
          class File ArtifactNode;
          click FileEncryption href "/technique/d3f:FileEncryption";                           FileIntegrityMonitoring["File Integrity Monitoring"] -->
          | analyzes | File["File"];

          FileIntegrityMonitoring["File Integrity Monitoring"] -.->
            | may-detect | T1565001["Stored Data Manipulation"] ;
          class FileIntegrityMonitoring DefensiveTechniqueNode;
          class File ArtifactNode;
          click FileIntegrityMonitoring href "/technique/d3f:FileIntegrityMonitoring"; RestoreFile["Restore File"] -->
          | restores | File["File"];

          RestoreFile["Restore File"] -.->
            | may-restore | T1565001["Stored Data Manipulation"] ;
          class RestoreFile DefensiveTechniqueNode;
          class File ArtifactNode;
          click RestoreFile href "/technique/d3f:RestoreFile"; LocalFilePermissions["Local File Permissions"] -->
          | restricts | File["File"];

          LocalFilePermissions["Local File Permissions"] -.->
            | may-isolate | T1565001["Stored Data Manipulation"] ;
          class LocalFilePermissions DefensiveTechniqueNode;
          class File ArtifactNode;
          click LocalFilePermissions href "/technique/d3f:LocalFilePermissions";                                  ContentFiltering["Content Filtering"] -->
          | filters | File["File"];

          ContentFiltering["Content Filtering"] -.->
            | may-isolate | T1565001["Stored Data Manipulation"] ;
          class ContentFiltering DefensiveTechniqueNode;
          class File ArtifactNode;
          click ContentFiltering href "/technique/d3f:ContentFiltering"; FileAnalysis["File Analysis"] -->
          | analyzes | File["File"];

          FileAnalysis["File Analysis"] -.->
            | may-detect | T1565001["Stored Data Manipulation"] ;
          class FileAnalysis DefensiveTechniqueNode;
          class File ArtifactNode;
          click FileAnalysis href "/technique/d3f:FileAnalysis";                                 ContentModification["Content Modification"] -->
          | modifies | File["File"];

          ContentModification["Content Modification"] -.->
            | may-isolate | T1565001["Stored Data Manipulation"] ;
          class ContentModification DefensiveTechniqueNode;
          class File ArtifactNode;
          click ContentModification href "/technique/d3f:ContentModification"; ContentQuarantine["Content Quarantine"] -->
          | quarantines | File["File"];

          ContentQuarantine["Content Quarantine"] -.->
            | may-isolate | T1565001["Stored Data Manipulation"] ;
          class ContentQuarantine DefensiveTechniqueNode;
          class File ArtifactNode;
          click ContentQuarantine href "/technique/d3f:ContentQuarantine"; DecoyFile["Decoy File"] -->
          | spoofs | File["File"];

          DecoyFile["Decoy File"] -.->
            | may-deceive | T1565001["Stored Data Manipulation"] ;
          class DecoyFile DefensiveTechniqueNode;
          class File ArtifactNode;
          click DecoyFile href "/technique/d3f:DecoyFile";                                        RemoteFileAccessMediation["Remote File Access Mediation"] -->
          | isolates | File["File"];

          RemoteFileAccessMediation["Remote File Access Mediation"] -.->
            | may-isolate | T1565001["Stored Data Manipulation"] ;
          class RemoteFileAccessMediation DefensiveTechniqueNode;
          class File ArtifactNode;
          click RemoteFileAccessMediation href "/technique/d3f:RemoteFileAccessMediation";
json